In the adversarial-perturbation problem of neural networks, an adversary starts with a neural network model F and a point x that F classifies correctly, and applies a small perturbation to x to produce another point x that F classifies incorrectly. In this paper, we propose taking into account the inherent confidence information produced by models when studying adversarial perturbations, where a natural measure of "confidence" is F (x) ∞ (i.e. how confident F is about its prediction?). Motivated by a thought experiment based on the manifold assumption, we propose a "goodness property" of models which states that confident regions of a good model should be well separated. We give formalizations of this property and examine existing robust training objectives in view of them. Interestingly, we find that a recent objective by Madry et al. encourages training a model that satisfies well our formal version of the goodness property, but has a weak control of points that are wrong but with low confidence. However, if Madry et al.'s model is indeed a good solution to their objective, then good and bad points are now distinguishable and we can try to embed uncertain points back to the closest confident region to get (hopefully) correct predictions. We thus propose embedding objectives and algorithms, and perform an empirical study using this method. Our experimental results are encouraging: Madry et al.'s model wrapped with our embedding procedure achieves almost perfect success rate in defending against attacks that the base model fails on, while retaining good generalization behavior.
The authors argue that "good" classifiers naturally represent the classes in a classification as well-separated manifolds, and that adversarial examples are low-confidence examples lying near to one of these manifolds. The authors suggest "fixing" adversarial examples by projecting them back to the manifold, essentially by finding a point near the adversarial example that has high confidence.
There are numerous issues here, which taken together, make the whole story pretty unconvincing.
The term "manifold" is used very sloppily. To be fair, this is unfortunately common in modern machine learning. An actual manifold is a specific mathematical structure with specific properties. In ML, what is generally hypothesized is that the data (often per class) lives "near" to some "low-dimensional" structure. In this paper, even the low-dimensionality isn't used --- the "manifold assumption" is used as a stand-in for "the regions associated with different classes are well-separated." (This is partially discussed in Section 6, where the authors point out correctly that the same defense as used here could be used with a 1-nn model.) This is fine as far as it goes, but the paper refs Basri & Jacobs 2016 multiple times as if it says anything relevant about this paper: Basri & Jacobs is specifically about the ability of deep nets to fit data that falls on (actual, mathematical) manifolds. This reference doesn't add much to the present story.
The essential argument of the paper rests on the "Postulate: (A good model) F is confident on natural points drawn from the manifolds, but has low confidence on points outside of the manifolds." 
This postulate is sloppy and speculative. For instance, taken in its strong form, if believe the postulate, then a good model:
1. Can classify all "natural points" from all classes with 100% accuracy.
2. Can detect adversarial points with 100% accuracy because all high-confidence points are correct classifications and all low-confidence points are adversarial.
3. All adversarial examples will be low-confidence.
Point 1 makes it clear that no good model F fully satisfying the postulate exists --- models never achieve 100% accuracy on difficult real-world distributions. But the method for dealing with adversarial examples seems to require Points 2 and 3 being true.
To be fair, the paper more-or-less admits that how true these points are is not known and is important. Nevertheless, I think this paper comes pretty close to arguing something that I *think* is not true, and doesn't do much to back up its argument. Because of the quality of the writing (generally sloppy), it's hard to tell, but I believe the authors are basically arguing that:
a. You can generally easily detect adversarial points because they are low confidence.
b. If you go through a procedure to find a point near your adversarial point that is high-confidence, you'll get the "correct" (or perhaps "original") class back.
I think b follows from a, but a is extremely suspect. I do not personally work in adversarial examples, and briefly looking at the literature, it seems that most authors *do* focus on how something is classified and not its confidence, but I don't think it's *that* hard to generate high-confidence adversarial examples. Early work by Goodfellow et al. ("Explaining and Harnessing Adversarial Examples", Figure 1, shows an example where the incorrect classification has very high confidence. The present paper only uses Carlini-Wagner attacks. From a read of Carlini-Wagner, it seems they are heavily concerned with finding *minimal* perturbations to achieve a given misclassification; this will of course produce low-confidence adversaries, but I see no reason why this is a general property of all adversarial examples.
The experiments are weak. I applaud the authors for mentioning the experiments are very preliminary, but that doesn't make them any less weak. 
What are we to make of the one image discussed at the end of Section 5 and shown in Figure 1? The authors note that the original image gives low-confidence for the correct class. (Does this mean that the classifier isn't "good"? Is it evidence against some kind of manifold assumption?) The authors note the adversarial category has significantly higher confidence, and say "in this case, it seems that it is the vagueness of the signals/data that lead to a natural difficulty." But the signals and data are ALWAYS vague. If they weren't, machine learning would be easy. This paper proposes something, looks at a tiny number of examples, and already finds a counterexample to the theory. What's the evidence *for* the theory? 
A lot of writing is given over to how this method is "semantic", and I just don't buy it. The connection to manifolds is weak. The basic argument here is really "(1) If our classifiers produce smooth well-separated high-confidence regions, (2) then we can detect adversaries because they're low-confidence, and (3) we can correct adversaries by projecting them back to high-confidence." (1) seems vastly unlikely to me based on all my experience: neural nets often get things wrong, they often get things wrong with high confidence, and when they're right, the confidence is at least sometimes low. The authors use a sloppy postulate about good models and so could perhaps argue I've never seen a good model, but the methods of this paper require a good model. (2) seems to follow logically from (1). (3) is also suspect --- perturbations which are *minimal* can be corrected as this paper does (and Carlini-Wagner attacks are minimal by design), but there's no reason to expect general perturbations to be minimal.
The writing is poor throughout. It's generally readable, but the wordings are often odd, and sometimes so odd it's hard to tell what was meant. For instance, I spent awhile trying to decide whether the authors assumed common classifiers are "good" (according to the postulate) or whether this paper was about a way to *make* classifiers good (I eventually decided the former).