I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate pinning?
The document you linked to details how the author bypassed pinned certificate validation in two different ways : by disassembling the application, removing the check and rebuilding the APK or by changing the certificate in the application keystore. Both method require a high degree of access to the application.
There are no way to fully protect your application against this. That is one of the reason why you should never trust the client.
However, these attacks requires the attacker to be able to replace your application with the modified version. If the attacker is the owner of the device, you simply cannot prevent it. Otherwise, the best you can do is rely on the OS security and warn your users not to root their devices.