Year: 2018

Abstract:
Adversarial examples, referred to as augmented data points generated by imperceptible perturbation of input samples, have recently drawn much attention. Wellcrafted adversarial examples may even mislead state-of-the-art deep models to make wrong predictions easily. To alleviate this problem, many studies focus on investigating how adversarial examples can be generated and/or resisted. All the existing work handles this problem in the Euclidean space, which may however be unable to describe data geometry. In this paper, we propose a generalized framework that addresses the learning problem of adversarial examples with Riemannian geometry. Specifically, we define the local coordinate systems on Riemannian manifold, develop a novel model called Adversarial Training with Riemannian Manifold, and design a series of theory that manages to learn the adversarial examples in the Riemannian space feasibly and efficiently. The proposed work is important in that (1) it is a generalized learning methodology since Riemmanian manifold space would be degraded to the Euclidean space in a special case; (2) it is the first work to tackle the adversarial example problem tractably through the perspective of geometry; (3) from the perspective of geometry, our method leads to the steepest direction of the loss function. We also provide a series of theory showing that our proposed method can truly find the decent direction for the loss function with a comparable computational time against traditional adversarial methods. Finally, the proposed framework demonstrates superior performance to the traditional counterpart methods on benchmark data including MNIST, CIFAR10 and SVHN.

heading: 1 INTRODUCTION
text: Recently Deep Neural Networks (DNN) achieve a big success on a wide range of challengeable tasks, such as image classification, speech recognition, and object detection (LeCun et al., 2015)(He et al., 2017). However, recent studies have found that DNNs can be easily fooled by some special input called adversarial examples which are referred to as augmented data points generated by imperceptible perturbation of input samples (Szegedy et al., 2013)(Biggio et al., 2013)(Nguyen et al., 2015). Although such perturbation is visually imperceptible, it can lead DNNs to make incorrect predictions with high confidence.
There have been a lot of proposals studying how to generate more powerful adversarial examples, and how to build up robust networks to defend them (Goodfellow et al., 2014)(Szegedy et al., 2013). This interesting problem was first studied in (Liu & Nocedal, 1989) where the authors proposed a simple way to produce adversarial examples with L-BFGS optimization. A more powerful approach Fast Gradient Sign Method (FGSM) is later proposed in (Goodfellow et al., 2014) and further extended to a more general case with lp constraint for perturbation (Lyu et al., 2015)(Shaham et al., 2015). The multi-step variant FGSMk was proposed in (Kurakin et al., 2016) which is essentially projected gradient decent (PGD) on the negative loss. Aside from studying how to generate adversarial examples, some researchers developed methods to defend them. The adversarial training was proposed by (Goodfellow et al., 2014) (Lyu et al., 2015) which augmented the training set with adversarial examples. This method not only increases the model robustness for adversarial examples but also improves the generalization for benign samples. Some feature squeezing (Xu et al., 2017) and defensive distillation (Papernot et al., 2016) were also exploited to resist adversarial attacking. Semisupervised version of adversarial training was developed in (Miyato et al., 2015) (Miyato et al.,
2018) (Miyato et al., 2016) called Virtual Adversarial Training (VAT), where the output distribution was smoothed by penalizing the KL-divergence between outputs of original and adversarial examples. Moreover, some researchers provided the theory and principles for adversarial examples (Fawzi et al., 2016). Furthermore, (Ma et al., 2018) have demonstrated that the adversarial examples are a dense region of pixel space instead of isolated points.
All these existing adversarial training methods simply consider the adversarial example problem in the Euclidean space with the orthogonal coordinate system. Specifically, this traditional adversarial training methods aim to solve a robust optimization problem (Lyu et al., 2015):
min θ E(x,y)vD[max ϵ L(x+ ϵ, y, θ)] s.t. ∥ϵ∥p ≤ σ (1)
where L denotes a loss function and the pair of input and label (x, y) is assumed to be drawn from the data distribution D. The robust optimization problem is defined as a min-max problem with respect to the worst perturbation ϵ and the best model parameters θ. The adversarial perturbation ϵ is restricted within lp-ball around benign example x. The FGSM can be seen as a special case with p =∞. Such restriction is defined in Euclidean space and the similarity between two points is measured by Minkowski distance.
However, data points may be in practice attached on a geometric manifold which cannot be appropriately described with Euclidean coordinate system. In this case, the Euclidean metric would be not rational. Moreover, existing adversarial training methods usually search the worst perturbation through the gradient of loss function with respect to x, since the gradient is considered as the steepest direction. However, in a geometric manifold, particularly in Riemannian space, the gradient of a loss function unnecessarily presents the steepest direction. Figure 1 illustrates the difference between a Riemannian space and the Euclidean space, where the detailed mathematic notation can be seen in Section 2. Clearly, In this figure, assuming that the data are attached in the manifold as defined in Figure 1(a), the Euclidean distance may not appropriately reflect the true distance between two points (e.g., ξ(0) and ξ(a)).
In this paper, we extend the traditional adversarial problem to Riemannian space and propose a novel adversarial method called Adversarial Training with Riemannian Manifold (ATRM). ATRM is regarded as a generalized framework in that Riemannian space contains the Euclidean space as a special case. In more details, we start with defining the local coordinate system and Riemannian metric tensor to evaluate the similarity between two points in Riemannian space. We then propose to restrict the adversarial perturbation within lp-ball around natural examples x on Riemannian manifold, and develop a framework to search the worst perturbation through the generalized trust region method. Our proposed method is to solve the adversarial problem from the perspective of geometry which is similar to Natural Gradient methods (Amari, 1998), however, our method is implemented on input space instead of parameter space of DNNs.
We list the main contributions of this paper as follows: 1) To our best knowledge, this is the first work to tackle the adversarial example problem through the perspective of geometry. 2) We study the adversarial example in the more generalized Riemannian space of which Euclidean space is a special case. 3) Our method considers the curvature information of the loss function which can be viewed as the second order method, enabling a more accurate direction of adversarial perturbation. Importantly, from the perspective of geometry, our method leads to the steepest direction of loss
function in Riemannian space. 4) We also provide a series of theory showing that our proposed method can truly find the decent direction for the loss function with a comparable computational time against traditional adversarial method (one more backward backward prorogation).

heading: 2 MAIN METHODOLOGY
text: In this section, we first study how to generate adversarial examples within l2-ball in Riemannian Manifold. We then define the local metric tensor on the manifold and generate the adversarial examples using our proposed ATRM with l2-ball restriction. Next, we extend our proposed method to lp-ball restriction on Riemannian manifold. Finally, we propose the adversarial training method called ATRM and also provide theories showing that ATRM can find the decent direction of the loss.

heading: 2.1 RIEMANNIAN GEOMETRY
text: In this subsection, we first introduce the mathematical notations and some background of geometry. The Einstein notation is used in this subsection. The Riemannian Manifold is defined as Definition 2.1: Definition 2.1. (Riemannian Manifold (Walschap, 2012)) In differential geometry, a Riemannian manifold (M, g) is a real smooth manifold M equipped with inner product in tangent space TpM at each point p varying smoothly on M , defined by positive definite metric tensor gp. Theorem 2.1. (Geodesic (Amari, 2016)) A curve that connects two points by a minimal distance is a geodesic under the Levi-Civita connection, where the length of a curve c = ξ(t) connecting ξ(0) and ξ(a) is given by
l = ∫ a 0 √ gij(t)ξ̇i(t)ξ̇j(t) dt (2)
where gij(t) denotes the metric tensor at point ξ(t).
The geodesic can be calculated with Theorem 2.1, which measures the distance of two points on Riemannian manifold. It can be seen as an extension of the Euclidian distance in Euclidian space. Lemma 2.2. Let ξ(0) and ξ(a) be two close points on Riemannian manifold, where ξ(t) is a shortest curve connecting these two points. Then, the distance between these two points can be computed by:
ds2 = gij(t)dθ idθj (3)
where dθi = ξ̇(t)idt is the ith component of small vector dθ and gij(t) is the metric tensor (proof can be seen in Appendix D).
We can also rewrite ds2 in form of inner production:
ds2 = ⟨dθiei, dθjej⟩ = ⟨ei, ej⟩dθidθj (4)
where basis vectors {ei} is the set of tangent vectors along the coordinate curves. Combining these two equations, we have:
gij = ⟨ei, ej⟩ (5)
Therefore, the metric tensor G = (gij) is the inner product of basis vectors. In the case of Euclidean space (orthonormal coordinate system), the metric tensor is:
gij = δij = { 1 i=j 0 otherwise
(6)
where δij represents the Kronecker delta. The Euclidean space can be viewed as a special case of Riemannian space with the identity metric tensor. For traditional adversarial training, the data are assumed to be in Euclidean space with the identity metric tensor. In this paper, we consider a more general case that the data are attached on the Riemannian manifold with positive definite metric tensor varying smoothly on the manifold. Figure 1 illustrates the difference between the two spaces.
2.2 ADVERSARIAL PERTURBATION WITHIN l2-BALL ON MANIFOLD
In this subsection, we introduce in details how we exploit a generalized trust region method to search the adversarial perturbation on the Riemannian manifold.
To search the adversarial examples on the Riemannian manifold feasibly, we propose to solve the inner optimization problem of (1) with the generalized trust region method:
ϵ = argmax ϵ Tk{L, x, ϵ} s.t. d(x, x+ ϵ) ≤ σ (7)
where ϵ is a small perturbation and σ is a small value. Tk{L, x, ϵ} denotes the kth order Taylor expansion of function L(.) around x evaluated at x + ϵ. Here k can be set to 1 or 2. d(x, x + ϵ) represents the distance between two points x and x + ϵ. In this paper, we follow the setting of previous research (Lyu et al., 2015) (Shaham et al., 2015) and provide the 1th Taylor expansion for the loss function L(.). We define the d(.) geodesic distance between two points on Riemannian manifold. Since the perturbation ϵ is very small, by applying Lemma 2.2, (7) can be reformulated as:
ϵ = argmax ϵ
L(x) +∇xLT ϵ s.t. gij(x)ϵiϵj ≤ σ2 (8)
where G = (gij(x)) denotes the metric tensor at the point x on data manifold. In (7), since geodesic d(x, x + ϵ) ≤ σ, the geodesic can be evaluated by (3). It can be proved that we can solve the problem (8) with Lagrangian multiplier method and the worst perturbation can be given as:
ϵ ∝ G−1∇xL (9)
The detailed proof of (9) can be seen in Appendix A.

heading: 2.3 DEFINING METRIC TENSOR
text: In the previous subsection, we have derived that the direction of the worst perturbation is relevant to metric tensor and the first derivative of L with respect to x. It is easy to evaluate ∇xL in DNNs through back propagation. It is then very crucial to define the Riemannian manifold for input and the metric tensor G. Since, the adversarial examples are closely related to loss function and classification boundary, we can define the Riemannian manifold and metric tensor from loss function. Specifically, We first take the nth order Taylor expansion of L around x evaluated at x + ϵ (n is an extremely large value):
L(x+ ϵ) ∼= L(x) + L(1)x (x) 1! ϵ+ L(2)x (x) 2! ϵ2 + ...+ L(n)x (x) n! ϵn
= L(x) + L (1) x (x)
1! ϵ+m(x)
(10)
where L(n)x (x) denotes the nth order derivative of L with respect to x and
m(x) = L(2)x (x)
2! ϵ2 + o(x) (11)
The loss function L(x + ϵ) can be written as summation of its 1th order Taylor expansion and the other components of Taylor series m(x). The 1th order Taylor expansion is more reliable when |m(x)| is small enough. Naturally, the restriction can be defined as:
|m(x)| ∼= | L(2)x (x)
2! ϵ2| = 1 2 |ϵTHϵ| ≤ σ2 (12)
However, it is difficult to deal with the constraint (12) in the optimization problem. We can simplify it with its upper bound by using Lemma 2.3.
Lemma 2.3. Assume H be a symmetric square matrix in Rn×n and r ∈ Rn be a vector. Then we have |rTHr| ≤ rT |H|r and |H| represents the matrix with taking the absolute value of each eigenvalue of H (proof can be seen in Appendix E).
Based on Lemma 2.3, we can have 1
2 |ϵTHϵ| ≤ 1 2 ϵT |H|ϵ ≤ σ2 (13)
where H is the Hessian matrix of L with respect to x and σ is a small value. When the loss function is locally convex with respect to x, the Hessian matrix H is positive semidefinite matrix and the absolute Hessian matrix is the same as the Hessian matrix. When the loss function is not locally convex, the non-negative eigenvalues of absolute Hessian matrix keep the same with the Hessian matrix while the negative eigenvalues are changed to positive ones. The curvature information is partially kept. (13) can be viewed as the distance between two close points x and x + ϵ on the Riemannian manifold with metric tensor |H|. Comparing (13) with constraint of (8), we can define the metric tensor as |H|. Substituting |H| in (8), we can easily get the worst perturbation:
ϵ ∝ |H|−1∇xL (14)
In contrast to the traditional adversarial training methods, the metric tensor |H| of our method involves the curvature information of the loss function which can be seen as the second order method. Through the perspective of geometry, the direction of gradient is not guaranteed to be steepest in Riemannian space, however, the metric tensor adjusts it to the steepest one as illustrated in Figure 2. Note that, for DNNs, it is easy to evaluate the Hessian matrix of L with respect to input x by back propagation.
2.4 ADVERSARIAL PERTURBATION WITHIN lp-BALL ON MANIFOLD
In the previous subsections, we have calculated the worst perturbation within l2-ball on Riemannian manifold. Similar to traditional adversarial training methods, we can also extend our method to lp-ball on manifold. First, we introduce Lemma 2.4 before we proceed to the case of lp-ball. Lemma 2.4. Let A a real symmetric positive definite matrix in Rn × Rn. Then we have a unique positive definite matrix S in Rn × Rn so that A = S2 (proof can be seen in Appendix F).
Using Lemma 2.4, we reformulate the constraint of (13)
ϵT |H|ϵ = ϵTSST ϵ = (ϵTS)2 ≤ σ2 (15)
where S is a positive definite matrix which we call a transformation matrix. Then we can easily extend (15) to lp-ball on manifold:
∥ϵTS∥p = ( ∑ i |ϵTS|pi ) 1/p ≤ σ (16)
Substituting (16) with the constraint of (8), we can easily evaluate the corresponding worst perturbation (details are provided in Appendix B):
ϵ = σsign(∇LTS−1)( |∇L TS−1|
∥∇LTS−1∥p∗ )
1 p−1S−1 (17)
where p∗ is the dual of p, i.e., 1p∗ + 1 p = 1. Clearly, when p = 2, the worst perturbation is reduced to (14) which is the case of the perturbation within l2-ball on manifold. When p = ∞, our method reduces to the generalized FGSM:
ϵ = σ lim p→∞
sign(∇LTS−1)( |∇L TS−1|
∥∇LTS−1∥p∗ )
1 p−1S−1 = σsign(∇LTS−1)S−1 (18)
Though we can evaluate the adversarial perturbation for any lp-ball on Riemannan manifold through (17). In this paper, we focus on the constraint of l2-ball and will develop the corresponding adversarial training method to improve the performance of DNNs in the next subsection.

heading: 2.5 ADVERSARIAL TRAINING METHOD WITH RIEMANNIAN MANIFOLD
text: After studying the adversarial examples on manifold, we now consider to design an optimization method to improve the DNNs using the theory in the previous subsections. We first define the overall optimization as the robust optimization problem in a way similar to the traditional adversarial training:
min θ E(x,y)vD[max ϵ L(x+ ϵ, y, θ)] s.t. ∥ϵTS∥p ≤ σ (19)
In this paper, we focus on the l2-ball constraint, while it is easily extended to the lp-ball constraint. In the case of l2, we can reduce the constraint in (19) to ϵT |H|ϵ ≤ σ. To optimize this problem, we can first solve the inner optimization problem then followed by the outer one. We then repeat this process until it converges. The whole process is shown as Algorithm 1. On the other hand, Algorithm 2 demonstrates the function of approximating |H|−1∇xL(yi, xi, θ). Hessian matrix may require a large amount of computation. In Algorithm 1, we approximate |H|−1∇xL(yi, xi, θ) with the first derivative of loss function with respect to input. Specifically, we simply modify the Limited-memory BroydenCFletcherCGoldfarbCShanno (L-BFGS) method. More details can be seen in Appendix C.
Algorithm 1 Framework of ensemble learning for our system. 1: for number of training iterations do 2: Sample a batch of labeled data (xi, yi) with size N . 3: for i in 1...N do 4: di ← |H|−1∇xL(yi, xi, θ) 5: ϵiadv = ξdi 6: end for 7: Update the parameters of neural network with stochastic gradient: 8: 9: −∇θ 1N ∑N i=1 logL(yi, xi + ϵiadv, θ) 10: end for
In Algorithm 1, |H|−1∇xL(yi, xi, θ) represents the normalization of |H|−1∇xL(yi, xi, θ). We now provide the theoretical analysis showing that our proposed method truly offers the decent direction for the optimization problem as (Madry et al., 2017). In order to do this, we first present Theorem 2.5.
Algorithm 2 Approximation for |H|−1∇xL(yi, xi, θ). 1: function APPROHD(yi, xi, θ, ζ) 2: Give ζ very small value 3: g0 = ∇xL(yi, xi, θ) 4: g1 = ∇xL(yi, xi + ζg0, θ) 5: y = g1 − g0 6: s = ζg0 7: ρ = 1
yT s
8: α = ρsT g1 9: q = g1 − αy
10: r0 = q0 11: β = ρyT r0 12: r1 = r0 + (α− β)s 13: return r1 14: end function
Theorem 2.5. (Danskin). Let S be nonempty compact topological space and g : R× S → R such that g(., δ) is differentiable for every δ ∈ S and ∇θg(θ, δ) is continuous on Rn × S. Also assume δ∗(θ) = {δ ∈ argmaxδ∈S g(θ, δ)}. Then the max-function ϕ(θ) = maxδ∈S g(θ, δ) is locally Lipschitz continuous, directionally differentiable, and its directional derivatives satisfy: ϕ′(θ) = supδ∈δ∗(θ) h
T∇g(θ, δ) In particular, if for some θ ∈ Rn the set δ∗(θ) = {δ∗θ} is a singleton, the max-function is differentiable at θ and∇ϕ(θ) = ∇θg(θ, δ∗θ).
This theorem states that the gradients of ϕ(θ) are local objects and the gradients are locally the same as that of g(θ, δ∗θ). With Theorem 2.5, we describe the theory showing that our proposed optimization method truly offers the decent direction:
Lemma 2.6. Let δ̂ ∈ S be a maximizer of maxδL(θ, x+θ, y). Then, we have that−∇thetaL(θ, x+ δ̂, y) is a decent direction for ϕ(θ) = maxδ∈S L(θ, x+ δ, y).
Proof. We apply Theorem 2.5 that g(θ, δ) := L(θ, x + δ, y) and S = Bp(σ), which is defined as the lp-ball with radius σ on Riemannian manifold. The directional derivative in the direction of h = ∇θL(θ, x+ δ̂, y) satisfies:
ϕ′(θ, h) = sup δ∈δ̂(θ) hT∇θL(θ, x+ δ.y) ≥ hTh = ∥∇θL(θ, x+ δ̂, y)∥22 ≥ 0 (20)

heading: 2.6 COMPUTATIONAL ANALYSIS
text: Compared with traditional adversarial training methods, our proposed ATRM need compute the Hessian matrix of the loss function with respect to input additionally. It may cost extra computation to calculate the Hessian matrix. Nonetheless, we exploit in this paper the first-order derivative of the loss function to approximate the product of Hessian matrix and the vector, which is shown in Algorithm 2. Therefore, our proposed method requires backward propagation three times and forward prorogation once. Specifically, the first backward prorogation is used to approximate the Hessian matrix, the second one is used to evaluate the adversarial perturbation, and the last time is to update the parameters of DNNs. In contrast to traditional adversarial training methods, our proposed method need merely one additional backward propagation which is acceptable in practice.

heading: 3 EXPERIMENT
text: To validate the efficacy of our proposed method, we conduct a series of experiments on benchmark data including MNIST, CIFAR-10, and SVHN. In these experiments, we compare our proposed ATRM with other competitive methods. For MNIST datasets we use the same baseline
as (Rasmus et al., 2015). The same base structure called ’conv-large’ is used on dataset CIFAR-10 and SVHN, which follows (Miyato et al., 2018). Specifically, ’conv-large’ means a large convolutional neural network with seven convolutional layers and three fully-connected layers with dropout where the size of all the convolutional kernels is 3× 3. We first implement our proposed ATRM on handwriting dataset MNIST. Since there is no previous adversarial research on this baseline model on this dataset, we conduct the experiment on two methods (adversarial training with l∞ and l2 constraint) for comparison. The model is trained with 60, 000 labeled samples without any data augmentation and is tested with 10, 000 samples. We train the model with a batch size of 32 and the maximum 500 epochs. There are two hyper parameters {ζ, ξ} in Algorithm 1 and Algorithm 2. We set ζ to a very small value, which is 10−6 in this paper. We tune the value of ξ in the range of {0.1, 0.2, 0.5, 1, 2, 5, 10}. We use the set of hyper parameters that achieved the best performance on the validation set of size 5, 000, selected randomly from the pool of training samples of size 60, 000.
Table 1 lists the performance of various methods including our proposed ATRM and other competitive methods. Except for ATRM, we also conduct the same experiment for the baseline model and traditional adversarial training methods with l2-ball and l∞-ball constraint. We conduct the experiment with this same setting for five times and calculate the mean and standard deviation. As observed, our proposed ATRM demonstrates the best performance. In particular, all the adversarial methods achieve remarkably good performance, while the ATRM shows a further improvement. This validates the advantages of our proposed method over the other methods, especially the other traditional adversarial methods.
For CIFAR-10, we train our proposed model ATRM with 50, 000 labeled samples with data augmentation as conducted in (Miyato et al., 2018) (translation and horizontal flip). The test dataset of CIFAR-10 involves 10, 000 samples. Similar to the experiment on MNIST, we set ζ to a small vaule 10−6, and tune the value of ξ in the range of {1, 2, 5, 8, 10}. We run the experiments for five times and report the average performance and corresponding standard deviation.
Table 2 summarizes the results of different methods on CIFAR-10 dataset. In this experiment, we intentionally compare our proposed method ATRM with the other two very deep models, i.e., the densely connected network (DenseNet) with 190 layers and very deep residual network (ResNet) with 1, 001 layers. Overall, our proposed method demonstrates competitive performance. Though not as good as the very deep networks DenseNet and ResNet, the proposed ATRM shows superior performance to those adversarial learning methods and all the other remaining approaches. Once again, this shows that adversarial learning should be conducted on the geometric manifold rather than the traditional Euclidean space.
The Street View House Numbers (SVHN) dataset contains 32× 32 colored digit images. There are 73, 257 images in the training set, 26, 032 images in the test set, and 531, 131 images for additional training. We train our model using the same setting as (Huang et al., 2017). As can be clearly observed in Table 3, our method demonstrates the best performance. It is even much better than the very deep networks (DenseNet and ResNet). More importantly, our method achieves an obvious improvement compared with the traditional adversarial training algorithms.
Finally, we have also done the experiments to prove the convergence for our proposed method. We have plotted the convergence curves for both training set and validation set of all three datasets as Figure 3 showing.

heading: 4 CONCLUSION
text: We present the novel framework called Adversarial Training with Riemannian Manifold (ATRM) which generalizes the traditional adversarial training method to Riemannian space. For traditional adversarial training methods, the worst perturbation is often searched with the gradient ∇xL. However, when the data lay on a geometric manifold defined as a Riemannian manifold, the gradient ∇xL is not the steepest direction, leading the adversarial perturbation is not the worst one. We present a series of theory showing that our method leads to the steepest direction of the loss function in Riemannian space. In practice, we also develop a practical algorithm guaranteeing the decent direction for the loss function at each epoch. Experiments demonstrate encouraging results on benchmark data including MNIST, CIFAR-10 and SVHN.

heading: D PROOF FOR LEMMA 2.2
text: Let ξ(0) and ξ(a) be two closed points on Riemannian manifold, where ξ(t) is a shortest curve connecting these two points. Then, we have the square of geodesic distance between these two points:
ds2 = gij(t)dθ idθj (35)
where dθi = ξ̇(t)i is the ith component of small vector dθ and gij(t) is the metric tensor.
Algorithm 3 Approximation for |H|−1∇xL(yi, xi, θ). 1: function APPROHD(yi, xi, θ, ζ) 2: Set ζ to a very small value 3: g0 = ∇xL(yi, xi, θ) 4: g1 = ∇xL(yi, xi + ζg0, θ) 5: y = g1 − g0 6: s = ζg0 7: ρ = 1
yT s
8: α = ρsT g1 9: q = g1 − αy
10: r0 = q0 11: β = ρyT r0 12: r1 = r0 + (α− β)s 13: return r1 14: end function
Proof. We evaluate the geodesic distance between ξ(0) and ξ(a) through Theorem 2.1:
ds = ∫ a 0 √ gij(t)ξ̇i(t)ξ̇j(t) dt (36)
Since ξ(0) and ξ(a) are closed points, a→ 0. Then we have
ds = lim a→0 ∫ a 0 √ gij(t)ξ̇i(t)ξ̇j(t) dt = √ gij(t)ξ̇i(t)ξ̇j(t) (37)
Therefore, we have
ds2 = gij(t)dθ idθj (38)

heading: E PROOF FOR LEMMA 2.3
text: Assume H be a symmetric square matrix in Rn × Rn and r ∈ Rn be a vector. Then we have |rTHr| ≤ rT |H|r and |H| represents the matrix with taking the absolute value of each eigenvalue of H .
Proof. Assume {e1, e2, ..., en} and {λ1, λ2, ..., λn} are the eigenvectors and corresponding eigenvalues of matrix H . Then we reformulate |rTHr| with eigenvectors and corresponding eigenvalues as:
|rTHr| = | ∑ i (rT ei)λi(e T i r)| = | ∑ i λi(r T ei) 2| (39)
We can now use the triangle inequality | ∑ i ri| ≤ ∑ i|ri| and we have:
|rTHr| ≤ ∑ i |λi(rT ei)2| = ∑ i (rT ei)|λ|(rT ei) = rT |H|r (40)

heading: F PROOF FOR LEMMA 2.4
text: Let A be a real symmetric positive definite matrix in Rn × Rn. Then we have a unique positive definite matrix S in Rn × Rn so that A = S2.
Proof. To prove existence: Since A is a real symmetric positive definite matrix, we have A = PT diag(λ1, ..., λn)P , where P is an orthogonal matrix and {λi} are the Eigen values of A (λi > 0). We can find S = PT diag(λ 1 2 1 , ..., λ 1 2 n ) that A = S2.
To prove uniqueness: Let B be another positive definite matrix and A = B2. Since B is positive definite, we have A = TT diag(µ1, ..., µn)T , where T is an orthogonal matrix and {µi} are Eigen values of B (µi > 0). We have A = PT diag(λ1, ..., λn)P , therefore
T−1diag(µ1, ..., µn)T = P −1diag(λ1, ..., λn)P (41)
Let U = (uij)n×n = PT−1 and we have:
diag(µ21, ..., µ 2 n)U = Udiag(λ1, ..., λn) (42)
which is equivalent to:
λiuij = uijµ 2 j (43)
When λ ̸= µ2j , uij = 0, we have λ 1 2 i = uijµj . When λi = µ 2 j , we also have λ 1 2 i = uijµj . Therefore:
diag(µ1, ..., µn)U = Udiag(λ 1 2 1 , ..., λ 1 2 n ) (44)
Then we have:
B = T−1diag(µ1, ..., µn)T = P −1diag(λ 1 2 1 , ..., λ 1 2 n )P = S (45)

Review summaries:
In the paper, the authors proposed to solve the learning problem of adversarial examples from Riemannian geometry viewpoint. More specifically, the Euclidean metric in Eq.(7) is generated to the Riemannian metric (Eq.(8)). Later, the authors built the correspondence between the metric tensor and the higher order of Taylor expansions.  Experiments show the improvement over the state-of-the art methods.