Review for NeurIPS paper: Auditing Differentially Private Machine Learning: How Private is Private SGD?