Anomaly detection discovers regular patterns in unlabeled data and identifies the non-conforming data points, which in some cases are the result of malicious attacks by adversaries. Learners such as One-Class Support Vector Machines (OCSVMs) have been successfully used in anomaly detection, yet their performance may degrade significantly in the presence of sophisticated adversaries, who target the algorithm itself by compromising the integrity of the training data. With the rise in the use of machine learning in mission critical day-to-day activities where errors may have significant consequences, it is imperative that machine learning systems are made secure. To address this, we propose a defense mechanism that is based on a contraction of the data, and we test its effectiveness using OCSVMs. The proposed approach introduces a layer of uncertainty on top of the OCSVM learner, making it infeasible for the adversary to guess the specific configuration of the learner. We theoretically analyze the effects of adversarial perturbations on the separating margin of OCSVMs and provide empirical evidence on several benchmark datasets, which show that by carefully contracting the data in low dimensional spaces, we can successfully identify adversarial samples that would not have been identifiable in the original dimensional space. The numerical results show that the proposed method improves OCSVMs performance substantially (2-7%).
Although the problem addressed in the paper seems interesting, but there lacks of evidence to support some of the arguments that the authors make. And the paper does not contribute novelty to representation learning, therefore, it is not a good fit for the conference. Detailed critiques are as following:
1. The idea proposed by the authors seems too quite simple. It is just performing random projections for 1000 times and choose the set of projection parameters that results in the highest compactness as the dimensionality reduction model parameter before one-class SVM.
2. It says in the experiments part that the authors have used 3 different S_{attack} values, but they only present results for S_{attack} = 0.5. It would be nicer if they include results for all S_{attack} values that they have used in their experiments, which would also give the reader insights on how the anomaly detection performance degrades when the S_attack value change.
3. The paper claims that the nonlinear random projection is a defence against adversary due to the randomness, but there is no results in the paper proving that other non-random projections are susceptible to adversary that is designed to target that projection mechanism and nonlinear random projection is able to get away with that. And PCA as a non-random projection would a nice baseline to compare against.
4. The paper seems to misuse the term “False positive rate” as the y label of figure 3(d/e/f). The definition of false positive rate is FP/(FP+TN), so if the FPR=1 it means that all negative samples are labeled as positive. So it is surprising to see FPR=1 in Figure 3(d) when feature dimension=784 while the f1 score is still high in Figure 3(a). From what I understand, the paper means to present the percentage of adversarial examples that are misclassified instead of all the anomaly examples that get misclassified. The paper should come up with a better term for that evaluation.
5. The conclusion, that robustness of the learned model increases wrt the integrity attacks increases when the projection dimension becomes lower, cannot be drawn from Figure 3(d). Need more experiment on more dimensionality to prove that. 
6. In the appendix B results part, sometimes the word ’S_attack’ is typed wrong. And the values in  “distorted/distorted” columns in Table 5 do not match up with the ones in Figure 3(c).