1) One very serious problem is that this paper is full of grammatical errors. It is too many and many of them can be detected and corrected by grammatical checker. I only list some in here to justify my observations, instead of all because I don’t want to proofread the authors’ paper. Page 1, learned,, Page 2 and Kurakin et al. (2018) starts Page 2, MI-FGSM, which integrate Page 2, several run-on sentences in the section Gradient Optimization Based Attack Page 2, which is divide Page 2 can removes Page 3 is extend Page 4 mollifer Page 5 hyper-parameters .. is Page 8 with SP-MI-FGSM should be SE-MI-FGSM? Page 8 via SP-MI-FGSM should be SE-MI-FGSM? Page 9, overcomes these two feedbacks. I would like to emphasize once again that this list is far from complete. 2) Although this paper has only 6 equations and several of them are copied from previous papers, the authors made a mistake. In Eq. 4, when i=N-1, alpha=l+(N-1) *(r-l), which is not r, different from what is described before (above Eq. 4). 3) The organization of this paper is also problematic. The authors reviewed other input transformation methods in the method section. They should be putted in Section 2. 4) In the comparison, the authors limit their baselines on input transformation methods and only compare with VR, DI and SI. However, they intentionally/unintentionally ignore the state-of-the-art LinBP and some other methods. As far as I know, LinBP is the currently the best transfer method. 5) The authors only evaluate their method on epsilon=16. Although they follow Wang&He 2021, it does not give a complete picture. More different epsilons are expected. 6) Adding a method on the top of other methods to improve transferability is good but cannot be considered a significant contribution. 7) In addition to untargeted attack, target attack, which is more challenging, should be considered. 8) One problem in the experiments is that some images are incorrect classified by the models. However, they authors do not say it clearly. Only said that “mostly classified correctly by the evaluation models”. How do they impact the experimental results? They will naturally provide better numbers to all methods. It means that the success attack accuracy should be lower than the one reported.
6) Adding a method on the top of other methods to improve transferability is good but cannot be considered a significant contribution.