Adversarial examples, referred to as augmented data points generated by imperceptible perturbation of input samples, have recently drawn much attention. Wellcrafted adversarial examples may even mislead state-of-the-art deep models to make wrong predictions easily. To alleviate this problem, many studies focus on investigating how adversarial examples can be generated and/or resisted. All the existing work handles this problem in the Euclidean space, which may however be unable to describe data geometry. In this paper, we propose a generalized framework that addresses the learning problem of adversarial examples with Riemannian geometry. Specifically, we define the local coordinate systems on Riemannian manifold, develop a novel model called Adversarial Training with Riemannian Manifold, and design a series of theory that manages to learn the adversarial examples in the Riemannian space feasibly and efficiently. The proposed work is important in that (1) it is a generalized learning methodology since Riemmanian manifold space would be degraded to the Euclidean space in a special case; (2) it is the first work to tackle the adversarial example problem tractably through the perspective of geometry; (3) from the perspective of geometry, our method leads to the steepest direction of the loss function. We also provide a series of theory showing that our proposed method can truly find the decent direction for the loss function with a comparable computational time against traditional adversarial methods. Finally, the proposed framework demonstrates superior performance to the traditional counterpart methods on benchmark data including MNIST, CIFAR-10 and SVHN.
The authors argue that they propose a method to find adversarial examples, when the data lie on a Riemannian manifold. In particular, they derive a perturbation, which is argued to be the worst perturbation for generating an adversarial example, compared to the classical Euclidean derivation.
I strongly disagree with the proposed (Riemannian) geometric analysis, because there are several technical mistakes, a lot of arbitrary considerations, and flawed assumptions. In particular, my understanding is that the proposed method is not related at all with Riemannian geometry. For justification I will comment some parts:
#1) In Section 1 paragraph 4, and in Section 2.3 after Eq. 14, the sentences about the gradient of a function that is defined on a manifold are strange and unclear. In general, the gradient of a function defined on a manifold, points to the ascent direction. Thus, if I understood correctly the sentences in the paper support that the gradient of such a function is meaningless, so I think that they are wrong.
#2) How the $\ell_2$-ball on a manifold is defined? Usually, we consider a ball on the tangent space, since this is the only Euclidean space related to the manifold. Here, my understanding is that the authors consider the ball directly on the manifold. This is clearly wrong and undefined.
#3) To find the geodesic you have to solve a system of 2nd order non-linear ODEs, and there are additional details which I will not include  here, but can be easily found in the Riemannian geometry literature. Also, I think that the Lemma 2.2. is wrong, since the correct quantity of Eq. 3 is $ds^2 = g_ij(t)d\theta^i d\theta^j dt^2$, where $dt\rightarrow 0$ based on the included proof. This is clearly not a sensible geodesic, it is just the infinitesimal length of a line segment when $t\rightarrow 0$, which means that the two points are infinitesimally close.
#4) If $x, y$ is on a Riemannian manifold then the $x+y$ operator does not make sense, so Eq. 7 is wrong. In particular, for operations on Riemannian manifolds you need to use the exponential and the logarithmic map.
#5) Continuing from #4). Even if we consider the perturbation to be sufficiently small, still the $x+\epsilon$ is not defined. In addition, the constraint in Eq. 8 is wrong, because the inner product related to the Riemannian metric has to be between tangent vectors. Here the $\epsilon$ is an arbitrary quantity, since it is not defined where it actually lies. In general, the derivation here is particularly confusing and not clear at all. In my understanding the constraint of Eq. 8 is a purely linear term, and $d$ is not the geodesic distance on a manifold. It just represents the Mahanalobis distance between the points $x$ and $x+\epsilon$, for a matrix $G$ defined for each $x$, so it is a linear quantity. So Eq. 9 just utilizes a precondiner matrix for the classical linear gradient.
#6) The Eq. 12 is very flawed, since it equalizes a distance with the Taylor approximation error. I think that this is an unrealistic assumption, since these terms measure totally different quantities. Especially, if $d$ is the geodesic distance.
#7) The upper bound in inequality Eq. 13 comes from Eq. 12, and it is basically an assumption for the largest absolute value of the Hessian's eigenvalues. However, this is not discussed in the text, which are the implications?
#8) I find the paper poorly written, and in general, it lacks of clarity. In addition, the technical inconsistencies makes the paper really hard to follow and to be understood. I mentioned above only some of them. Also, there are several places where the sentences do not make sense (see #1), and the assumptions made are really arbitrary (see #6). The algorithms are not easy to follow. Minor comments, you can reduce the white spaces by putting inline Eq. 3, 4, 5, 6, 9, 10, 14, and Figure 2. The notation is very inconsistent, since it is very unclear in which domain/space each quantity/variable lies. Also, in Section 2.5. the authors even change their notation.
In my opinion, the geometrical analysis and the interpretation as a Riemannian manifold is obviously misleading. Apart from the previously mentioned mistakes/comments, I think that the proposed approach is purely linear. Since actually the Eq. 14 implies that the linear gradient of the loss function, is just preconditioned with the Hessian matrix of the loss function with respect to the input $x$. Of course, if this function is convex around $x$, then this quantity is the steepest ascent direction of the loss function, simply on the Euclidean space where $x$ lies. However, when this function is not convex, I am not sure what is the behavior when all the eigenvalues of the Hessian are set to their absolute value. Also, the (arbitrary) constraint in Eq. 13 implicitly sets a bound to the eigenvalues of the Hessian, which in some sense regularizes the curvature of the loss function. To put it simple, I think that the proposed method, is just a way to find a preconditioner matrix for the linear gradient of the loss function, which points to the steepest direction. This preconditioner is based on the Hessian of the loss function, where the absolute values of the eigenvalues are used, and also, are constrained to be bounded from above based on a given value.
Generally, in my opinion the authors should definitely avoid the Riemannian manifold consideration. I believe that they should change their perspective, and consider the method simply as a local preconditioner, which is based on the Hessian and a bound to its (absolute) eigenvalues. They should also discuss what is the implication by setting the eigenvalues to their absolute values. However, since I am not an expert in the field of adversarial examples, I am not sure how novel is this approach.