Recent works have empirically shown that there exist adversarial examples that can be hidden from neural network interpretability (namely, making network interpretation maps visually similar), and interpretability is itself susceptible to adversarial attacks. In this paper, we theoretically show that with the correct measurement of interpretation, it is actually difficult to hide adversarial examples, as confirmed by experiments on MNIST, CIFAR-10 and Restricted ImageNet. Spurred by that, we develop a novel defensive scheme built only on robust interpretation (without resorting to adversarial loss minimization). We show that our defense achieves high classification robustness, outperforming state-of-the-art adversarial training methods against attacks of large perturbation while attaining high interpretation robustness under various settings of adversarial attacks.
The present work considers adversarial attacks that also yield similar outputs for "interpretability methods", which are methods that output some vector corresponding to a given classification (usually the vector is e.g. an image or a similar object). It also shows that by regularizing nearby inputs to have similar interpetations (instead of similar classifications), robustness can be achieved similar to adversarial training. 
I did not understand the motivation of the paper. Why is it important for adversarial attacks to yield similar interpretations? A human would need to assess the interpretations to detect the attack, but it would already be trivial for an attack to be detected given human oversight (just check whether the classification of the image matches the human-assigned label). It also wasn't clear how this was related to the other observation that regularizing based on interpretability yields robustness; these seem like two fairly separate results.
Finally, I found the claim that "interpretability alone helps robustness" to be misleading and not substantiated by the paper. The purported justification is that regularizing nearby inputs to have the same interpretation yields robustness. But a better summary of this observation is that "robustness of interpretability implies robustness of classification", which is not surprising, and is in fact a trivial corollary of the fact that the metric on interpretations dominates the classification error metric (an observation which is made in the paper).
More minor, but I found it hard to follow the writing in the paper (this is related to the motivation being unclear). This is exacerbated by the paper being longer than unusual (10 pages instead of 8).