Weakness: 1. It would make this paper stronger if the authors can show some adversarial robustness of some SOTA defended recognition models on the new set. 2. I would like to see more clear details of how to use DALL-E2 or stable diffusion models to generate hard examples, e.g., how to design prompts and how to filter out some unrealistic images. 3. The new dataset has some great properties. However, how to make it more scalable to real applications besides evaluating the current models trained on a public dataset? What if we have some new classes in our task, but it is not included in this set? 4. It is still unclear how to make the new proposed evaluation set more diverse and representative than the previous method and how to select those representative images.
4. It is still unclear how to make the new proposed evaluation set more diverse and representative than the previous method and how to select those representative images.