It is well-known that many machine learning models are susceptible to adversarial attacks, in which an attacker evades a classifier by making small perturbations to inputs. This paper discusses how industrial copyright detection tools, which serve a central role on the web, are susceptible to adversarial attacks. We discuss a range of copyright detection systems, and why they are particularly vulnerable to attacks. These vulnerabilities are especially apparent for neural network based systems. As proof of concept, we describe a well-known music identification method and implement this system in the form of a neural net. We then attack this system using simple gradient methods. Adversarial music created this way successfully fools industrial systems, including the AudioTag copyright detector and YouTube's Content ID system. Our goal is to raise awareness of the threats posed by adversarial examples in this space and to highlight the importance of hardening copyright detection systems to attacks.
[Summary] This paper proposed a black(white)-box attacking algorithms to attack industrial copyright detectors. Specifically, a simple un-targeted gradient-based method can successfully fool commercial system like YouTube and AudioTag. This paper has generalized the concept of “adversarial examples” to a new application area, which is indeed a very important one, to raise awareness for the potential threats. 
There are a couple of reasons of why I like this paper: (1) copyright attack and especially defense (missing in this paper) is a more important application compared to others widely studied vision tasks like classification. To increase the copyright detectors' accuracy, companies must have invested a huge amount of money on deep learning based methods. As this paper suggests, these more accurate detectors also come with severe security problems, and such problems are rarely studied before. In addition, the experimental results in this paper show that two commercial systems can be easily compromised in a black-box manner. (2) This paper is clear in writing and easy to follow. I am not an expert in acoustic/audio recognition, but this paper shows that a not very complicated approach can work in real-world without too much domain/expert knowledge. 
My rating for this paper is “3: weak reject”. I think it’s below the line for two reasons: technical novelty and experimental settings. I will elaborate these two points in the following sections.
As the author mentioned and generally believed, almost every machine learning model (black and white-box) can be compromised with adversarial examples, especially in un-targeted manner. “Copyright detector” is just another machine learning model regardless its important usage. The technical approach proposed in this paper is straightforward and limited. First, section 4.2 is very similar to Wang et al. (2003). What’s the biggest improvement or novelty here? All the filters are handcrafted and fixed as suggested by Eq.1 and Eq.2. Why don’t train a network or take a pre-trained DNNs to predict spectrogram?  The biggest advantage of deep learning (end2end trainable as feature extractor) is not utilized.  Second, the solution of Eq.5 is award. Usually we don’t use a softmax with temperature to estimate max, better ways should be tried like gumbel-softmax. Third, besides the optimization methods used for Eq.6, Carlini&Wagner is also widely used for optimizing this objective. What’s the reason that C&W is missed in this paper? Fourth, Eq.8 can be used for targeted attacks. However, this part is missing. Un-targeted attack is considered as easy especially in white-box cases. Targeted attack is a better and harder task for evaluation of algorithms. Fifth, the surrogate loss Eq.4 is basically a hinge loss between two quantized feature maps with mask \psi. It’s pretty standard to me and I am surprised this is the only loss proposed and studied. 
The experiments in this paper is more like a “proof-of-concept” rather than “serious evaluation”. First problem is that the norm is used to evaluate the perturbation. Unlike the norm in image domains which can be visualized and easily understood, I don’t have a clear understanding of how “big” the perturbations are for audios. A cognitive study or something like a user study should be conducted. Another question related to this, the random noise is 3x bigger in terms of norm, does this make huge difference when listening to it? Are these two perturbations both very obvious or both unnoticeable? Second, it seems like a dataset is built but the stats are missing. How big is this dataset? How many songs are used to generate results in Tab.1, Tab.2, and Fig.3? What’s the attack accuracy on AudioTag and Youtube? Third, no baseline methods are compared to in this paper, not even an ablation study. The proposed two methods (default and remix) seem to perform similarly. I don’t think the best thing people can do previously to attack copyright system is just random noise. The authors could argue that there are no previous papers, but I think more realistic baselines should be studied. 
One question, the inline equation at the bottom of Page.4  should be \phi(x) == maxpool(\phi(x)) right? And \psi(x) = ( \phi(x) == maxpool(\phi(x)) ) ?
Overall, I think this paper is not in good shape to be published even though the targeted problem has already become a big concern right now.