The paper proposes a novel point of view on adversarial attacks, with interesting theoretical results. R2 and R3 have raised a few concerns, and some of them have been addressed by the rebuttal. The area chair agrees with their assessment and recommends to accept the paper. Note that the paper received two poor-quality reviews (R1 and R4), and the decision was mostly based on R2, R3, and the area chair's expertise.