We investigate the approximation of functions $f$ on a bounded domain
$\Omega\subset \mathbb{R}^d$ by the outputs of single-hidden-layer ReLU neural
networks of width $n$. This form of nonlinear $n$-term dictionary approximation
has been intensely studied since it is the simplest case of neural network
approximation (NNA). There are several celebrated approximation results for
this form of NNA that introduce novel model classes of functions on $\Omega$
whose approximation rates avoid the curse of dimensionality. These novel
classes include Barron classes, and classes based on sparsity or variation such
as the Radon-domain BV classes.
The present paper is concerned with the definition of these novel model
classes on domains $\Omega$. The current definition of these model classes does
not depend on the domain $\Omega$. A new and more proper definition of model
classes on domains is given by introducing the concept of weighted variation
spaces. These new model classes are intrinsic to the domain itself. The
importance of these new model classes is that they are strictly larger than the
classical (domain-independent) classes. Yet, it is shown that they maintain the
same NNA rates.

通过引入加权变分空间的概念，本文给出了在域中定义这些新模型类的更加恰当的定义。这些新模型类固有于域本身，并且与经典（与域无关）模型类相比更大，但仍然保持着相同的神经网络逼近速率。

加权变差空间与浅层 ReLU 网络的逼近

Weighted variation spaces and approximation by shallow ReLU networks

Short answer: Yes, Long answer: No! Indeed, research on adversarial
robustness has led to invaluable insights helping us understand and explore
different aspects of the problem. Many attacks and defenses have been proposed
over the last couple of years. The problem, however, remains largely unsolved
and poorly understood. Here, I argue that the current formulation of the
problem serves short term goals, and needs to be revised for us to achieve
bigger gains. Specifically, the bound on perturbation has created a somewhat
contrived setting and needs to be relaxed. This has misled us to focus on model
classes that are not expressive enough to begin with. Instead, inspired by
human vision and the fact that we rely more on robust features such as shape,
vertices, and foreground objects than non-robust features such as texture,
efforts should be steered towards looking for significantly different classes
of models. Maybe instead of narrowing down on imperceptible adversarial
perturbations, we should attack a more general problem which is finding
architectures that are simultaneously robust to perceptible perturbations,
geometric transformations (e.g. rotation, scaling), image distortions
(lighting, blur), and more (e.g. occlusion, shadow). Only then we may be able
to solve the problem of adversarial vulnerability.

当前对于对抗鲁棒性的研究存在固有局限性，需要突破传统的扰动界限，同时探究更复杂的模型来更全面地解决视觉表示中的对抗扰动问题。