Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: In this paper, the authors propose a randomization-based tensorization framework towards robust network learning. The high-level idea of this work is to reparameterize the network parameters W of each layer with low-rank tensors, where the factor matrices are injected with randomization through randomly sampled sketching matrices. Since the randomization is is done within a subspace than directly on the weight matrix itself, the authors claim that this brings certain advantages such as less sparsity.

Strengths:
+ Well-written paper with good clarity and technical correctness.
+ Interesting idea with novelty.
+ Good ablation study with clear performance improvement from the proposed framework.
+ Good applications with binarized networks and audio classification.

Weaknesses:
- Insufficient and badly conducted comparative study with recent SOTAs.
- Insufficient experiment with larger datasets (such as CIFAR-100) or enough variety of datasets (such as SVHN).
- No direct experiment verification that supports the advantage of randomization in a subspace
- No discussions on the training complexities and the extendability to large-scale datasets/networks, such as ImageNet/ResNet-101.
- Missing citation and comparison to the following two SOTAs:
1. Xie et al., Feature Denoising for Improving Adversarial Robustness, CVPR19
2. Mustafa et al., Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks, ICCV19

Comments:
I consider the idea of this paper novel and interesting. Considering tensor factorization with randomization for network robustness makes a lot of sense but overall the experiments of this paper are not well-conducted towards comparative studies with other SOTAs, although ablation study shows the considerably improved robustness from the proposed method. The main concerns of this paper lie in several aspects:
1. It seems that the authors did not report their comparison to recent SOTAs (such as Lin et al, 2019) comprehensively enough, nor were the benchmark measures (missing several other attacks, especially black box ones), datasets and backbones fully aligned. It is unclear how much the architecture of a backbone can impact the fairness of comparison. There is also no apples to apples comparison to directly verify the advantage of this work over non-subspace-based randomization method.
2. The authors failed to cite and compare to recent two SOTAs (listed above) which conduct large-scale experiments with bigger models. And there is no discussion about the extendability/generalizability of the proposed method to these data and models. Therefore, the contributions of this work somehow become less convincing.

Minor typos:
In page 4 "Randomizing in the latent subspace": 
\lambda^F \in R^O --> \lambda_F \in R^F
M_O = diag(\lambda_F) --> M_F = diag(\lambda_F)
please unify subscripts/superscripts for all \lambda.
review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: This paper tackles the problem of designing neural network architectures that are robust to adversarial attacks. Several defense techniques against adversarial attacks have been proposed, mainly adversarial training (train on perturbed inputs) and introducing random perturbation to the weights or activations of the network. The paper claims that one limitation of the second approach is that it introduces artifacts (e.g. sparsity). The authors propose a simple but original idea to address this issue: parameterize the network's weight matrices as low rank tensors (in the Tucker format) and randomize the weights by sketching the core tensor of the Tucker decomposition (in effect, the sketching amounts to randomly setting fibers of the core tensor to 0). 

I think this paper can be relevant to the community but I am not confident that this is an important contribution. The idea is interesting and addresses the problem of sparsity artifacts in randomized defense strategies, but it does not appear clearly why using tensor decomposition techniques is a sound approach for designing robust networks (besides overcoming sparsity artifacts). I believe there may be more fundamental (theoretical, principled) arguments to motivate the approach, but this is not explored in the paper: the idea is interesting but not supported by much theoretical insight. Yes, using Tucker decomposition allows one to have randomized but still dense weights. Is it the only reason to use tensor decomposition? Why not do the same with a simple low rank matrix for example?

The experimental section is developed but I find the experimental setting not clearly described (e.g., what is the metric? is it the accuracy over adversarial examples?). Maybe this is because I am not familiar with the adversarial defense literature. 

In conclusion, I am a bit on the fence for this paper. The idea is interesting and definitely worth exploring but to me a more thorough discussion and analysis of why tensor decomposition techniques are relevant is missing. Still, the approach is original and this paper may spark future work further exploring these questions, so I recommend acceptance.

* Comments / Questions *

- Paragraph "Latent high-order parametrization of the network". If I understand correctly, the core tensor G in the decomposition as the same size of W, so at this stage W is not parameterized as a low rank tensor (W is actually over-parmeterized). This is only when the stochastic vectors \lambda are introduced that the Tucker rank of W is implicitly reduced. This could be clarified.

- Is stochasticity preserved at test time (unlike when using dropout but like in Wang, et al. (2018))?

- What is the metric used in Table 1 to compare the models?

- Would it make sense to explore other tensor decomposition models (e.g. CP, tensor train, tensor ring, ...)? Are there any particular reasoning motivating the choice of Tucker?



review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: The authors propose  to use randomized tensor factorization in the weight space as a defense to adversarial attack, which builds upon the existing works on using randomization on the weights or activation as a defense methods.

Pros:
1. The idea of using randomized tensor factorization for dense is novel
2. It seems that this defense is robust to large perturbation (epsilon), and the accuracy on clean data is high when combined with PGD adv.training.

Cons:
1.  I don't understand why using randomization in the latent space of the weights can retain the classification accuracy on clean data. The authors say that this is because both the weights and the activations are not sparse. But I don't understand the relation between sparsity and accuracy. Can the author can provide some evidence on this (probably from the previous acceleration literatures). Besides, I think an accuracy of 90.1 on CIFAR10 (Tab.2) is not high.
2. As in the review written by Anthony Wittmer, the author should include experiments to check the obfuscated gradient issue.
review_title: Official Blind Review #3

Meta-review: Three reviewers have assessed this submission and were moderately positive about it . However, the reviewers have also raised a number of concerns. Initially, they complained about substandard experimentation which has been resolved to some degree after rebuttal (rev. believe more can be done in terms of unifying them, investigating backbones, attack methods, and experimental settings in light of recent papers).

A somewhat bigger criticism concerns the theoretical part: 
1. Rev. remained unclear why using tensor decomposition techniques is a sound approach for designing robust network.
2. AC and rev. also noted during discussions that using low rank constraints (and other mechanisms) and i.e. encouraging smoothness (one important mechanism among many in robustness to attacks) have been extensively investigated in the literature, yet, the proposed idea makes scarce if any theoretical connection to such important theoretical tools.

Some references (not exhaustive) that may help authors further study the above aspects are:
Certified Adversarial Robustness via Randomized Smoothing, Cohen et al.
Local Gradients Smoothing: Defense against localized adversarial attacks, Naseer et al.
Limitations of the Lipschitz constant as adefense against adversarial examples, Huster et al.
Learning Low-Rank Representations, Huster et al.

On balance, AC feels that despite the enthusiasm, this paper is not ready yet for the publication in ICLR as the key theory behind the proposed idea is missing. Thus, this submission falls marginally short of acceptance in ICLR 2020. However, the authors are encouraged to build up a compelling theory and resubmit to another venue (currently the paper feels like a solid workshop idea that needs to be investigated further).
Decision: Reject