One intriguing property of neural networks is their inherent vulnerability to adversarial inputs, which are maliciously crafted samples to trigger target networks to misbehave. The state-of-the-art attacks generate adversarial inputs using either pixel perturbation or spatial transformation. Thus far, several provable defenses have been proposed against pixel perturbation-based attacks; yet, little is known about whether such solutions exist for spatial transformation-based attacks. This paper bridges this striking gap by conducting the first systematic study on provable defenses against spatially transformed adversarial inputs. Our findings convey mixed messages. On the impossibility side, we show that such defenses may not exist in practice: for any given networks, it is possible to find legitimate inputs and imperceptible transformations to generate adversarial inputs that force arbitrarily large errors. On the possibility side, we show that it is still feasible to construct adversarial training methods to significantly improve the resilience of networks against adversarial inputs over empirical datasets. We believe our findings provide insights for designing more effective defenses against spatially transformed adversarial inputs.
Summary: The paper studies a new attack model based on spatial transformations. The authors first formalize an attack model based on spatial transformation and then study attacks and defenses for this model. 
Clarity: While the paper studies an important problem -- it's important to move out of the norm ball based attack models and consider different attacks like spatial transformations, in the current version, the presentation lacks clarity in both the formulation of the attack model, attacks, defenses and explanation of the results. For example, the impossibility result isn't clear: the claim is that any classifier has adversarial spatial transformations that are successful in causing misclassifcation for some threshold on the size of transformation. There is no explanation of how large this threshold is in practice. Is it small enough to be called an "impossibility result"? What does this threshold intuitively depend on?
Originality: The key contribution seems to be the formalization of some notion of spatial transformation. However, the final expression (Proposition 1) basically looks just like an l_p norm but after transforming it by some "fixed" matrix M. The expressions for this new attack model where || M r|| < \eps for some perturbation \eps look pretty similar to the case previously considered (where M was essentially identity). For example, Raghunathan et al. 2018 and Hein & Andriushchenko 2017. The paper is also missing discussion on the structure of this matrix M, and how it changes the attacks and defenses in practice 
Significance: I think the problem of spatial transformation based adversarial examples is important and the authors have the right goals. However, the current presentation makes it hard to understand the main results provided and hence I would rate that the contribution is not very significant. 
Overall: I highly recommend the authors to revise the presentation and clarify a) the main conceptual differences of the new attack model (matrix M of proposition 1) b) Formalize the impossibility and possibility results carefully with concrete theoretical/empirical results to back the claims