The application of deep recurrent networks to audio transcription has led to impressive gains in automatic speech recognition (ASR) systems. Many have demonstrated that small adversarial perturbations can fool deep neural networks into incorrectly predicting a specified target with high confidence. Current work on fooling ASR systems have focused on white-box attacks, in which the model architecture and parameters are known. In this paper, we adopt a black-box approach to adversarial generation, combining the approaches of both genetic algorithms and gradient estimation to solve the task. We achieve a 89.25% targeted attack similarity after 3000 generations while maintaining 94.6% audio file similarity.
PAPER SUMMARY:
This paper introduces a biologically motivated black-box attack algorithm. 
The target model in this case is DNN applied to the ASR context (automatic speech recognition system). 
NOVELTY & SIGNIFICANCE:
The proposed approach extends the previous genetic approach of (Alzantot et al., 2018) to attack a more complicated ASR system (that handles phrases and sentences). The new contribution here is an add-on momentum mutation component on top of the existing genetic programming architecture of (Alzantot et al., 2018) as illustrated in Figure 3.
This however appears very incremental seeing that integrating the mutation component into existing system is straight-forward and that mutation is not even a new concept -- it has always been a vital component in genetic programming paradigm.
It is also unclear how this mutation component improves over the existing work (more on this in the sections below).
Another issue is this work seems to ignore the recent literature on adversarial black-box attacks to DNN model. To list a few:
Chen, P.-Y.; Zhang, H.; Sharma, Y.; Yi, J.; and Hsieh, C.-J. 2017b.
ZOO: Zeroth-order optimization-based  black-box attacks to deepneural networks without training substitute models. 
In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (15-26) ACM
Cheng,  M.;  Le,  T.;  Chen,  P.-Y.;  Yi,  J.;  Zhang,  H.;  and  Hsieh,C.-J.2018.
Query-efficient hard-label black-box attack:  An optimization-based approach. arXiv preprint arXiv:1807.04457
While these works have not been used to attacking ASR system, they should be directly applicable to such system since after all, they are black-box attacks. I think the proposed method needs to be compared with these works.
TECHNICAL SOUNDNESS:
I find it surprising that even though the proposed method is claimed to be a black-box attack but in the end, it actually exploits the fact that the target model uses CTC decoder. This pertains specifically to the target model's internal architecture and a black-box attack is not supposed to know this.
CLARITY:
The paper is clearly written.
EMPIRICAL RESULTS:
I do not understand this statement:
"That 35% of random attacks were successful in this respect highlights the fact that black box
adversarial attacks are definitely possible and highly effective at the same time"
Why is 35% successful attack rate a positive result? The result tends to suggest that this is an attack with low success rate. 
The 2nd paragraph in 3.2 seems to give a vague explanation: "the vast majority of failure cases are only a few edit distances away from the target. 
This suggests that running the algorithm for a few more iterations could produce a higher success rate, although at the cost of correlation similarity".
Given the above statement, I do not see why the authors didn't actually "run the algorithm for a few more iterations" to verify it ...
I am also curious why is the success rate of the proposed method is significantly lower than that of the existing system -- I assume "single word black box" is the work of (Alzantot et al., 2018).
I find the empirical evaluation somewhat sloppy: why are the tested method not compared on the same benchmark? How do we interpret the results then?
REVIEW SUMMARY:
The paper misses the recent literature on black-box attack. The authors need to compare with those to demonstrate the efficiency of their proposed work. I also find the contribution of this paper too incremental & its empirical evaluation appears somewhat sloppy and not convincing (see my specific comments above).