text: This paper proposes a method to generate adversarial examples for text classification problems.  They do this by iteratively replacing words in a sentence with words that are close in its embedding space and which cause a change in the predicted class of the text.  To preserve correct grammar, they only change words that don't significantly change the probability of the sentence under a language model. The approach seems incremental and very similar to existing work such as Papernot et. al.  The paper also states in the discussion in section 5.1 that they generate adversarial examples in state-of-the-art models,  however, they ignore some state of the art models entirely such as Miyato et. al. The experiments are solely missing comparisons to existing text adversarial generation approaches such as Papernot et. al and a comparison to adversarial training for text classification in Miyato et. al which might already mitigate this attack.  The experimental section also fails to describe what kind of language model is used,  (what kind of trigram LM is used?  A traditional (non-neural) LM?  Does it use backoff?). Finally, algorithm 1 does not seem to enforce the semantic constraints in Eq. 4 despite it being mentioned in the text.  This can be seen in section 4.5 where the algorithm is described as choosing words that were far in word vector space.  The last sentence in section 6 is also unfounded. Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z.Berkay Celik, and Ananthram Swami Practical Black-Box Attacks against Machine Learning. Proceedings of the 2017 ACM Asia Conference on Computer and Communications Security Takeru Miyato, Andrew M. Dai and Ian Goodfellow Adversarial Training Methods for Semi-Supervised Text Classification. International Conference on Learning Representation (ICLR), 2017