Adversarial examples are a pervasive phenomenon of machine learning models where seemingly imperceptible perturbations to the input lead to misclassifications for otherwise statistically accurate models. We propose a geometric framework, drawing on tools from the manifold reconstruction literature, to analyze the high-dimensional geometry of adversarial examples. In particular, we highlight the importance of codimension: for low-dimensional data manifolds embedded in high-dimensional space there are many directions off the manifold in which to construct adversarial examples. Adversarial examples are a natural consequence of learning a decision boundary that classifies the low-dimensional data manifold well, but classifies points near the manifold incorrectly. Using our geometric framework we prove (1) a tradeoff between robustness under different norms, (2) that adversarial training in balls around the data is sample inefficient, and (3) sufficient sampling conditions under which nearest neighbor classifiers and ball-based adversarial training are robust.
This paper studies the geometry of adversarial examples under the assumption that dataset encountered in practice exhibit lower dimensional structure despite being embedded in very high dimensional input spaces. Under the proposed framework, the authors analyze several interesting phenomena and give theoretical results related to the necessary number of samples needed to achieves robustness. However, the theory in this paper is not very deep.
Pros:
The logic of this paper is very clear and easy to follow. Definitions and theories are illustrated with well-designed figures.
This paper shows the tradeoff between robustness under two norm and infinity norm for the case when the manifolds of two classes of data are concentric spheres.
When data are distributed on a hypercube in a k dimensional subspace, the authors show that balls with radius \delta centered at data samples only covers a small part of the ‘\delta neighborhood’ of the manifold. 
General theoretical results on robustness and minimum training set to guarantee robustness are given for nearest neighbor classifiers and other classifiers.
Cons:
Most of the theoretical results in this paper are not very general. The tradeoff between robustness in different norms are only shown for concentric spheres; the ‘X^\epsilon is a poor model of \mathcal{M}^\epsilon’ section is only shown for hypercubes in low dimensional subspaces. 
Section 5 is not very convincing. As is discussed later in the paper, although $X^\delta$ only covers a small part of \mathcal{M}^\delta, robustness can be achieved by using balls centered at samples with larger radius.
Most of the analysis is based on the assumption that samples are perfectly distributed to achieve the best possible robustness result. A more interesting case is probably when samples are generated on the manifold following some probabilistic distributions. 
Theorems given in Section 6 are reasonable, but not very significant. It is not very surprising that nearest neighbor classifier is more robust than ‘x^\epsilon based’ algorithms, especially when the samples are perfectly distributed.