This paper provides a useful theoretical underpinning to a field that has had very little theoretical study. It’s not groundbreaking, but it’s useful. The authors try to make stronger claims than they should in the intro/conclusion that might put the reader off from the paper, and that’s unfortunate.
The biggest new useful theoretical result is the discussion of the surface area vs volume of the adversarial subspace. They also echo some comments from other work on possible future defense strategies.