Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 1: Reject
review_content: This paper suggests using ensemble of both full-precision and low-bits precision models to defense adversarial examples.

From methodological point of view, this idea is quite straightforward and not novel, since there are already several works that applied ensemble methods to improve the robustness of NNs, including the Strauss et.al 2017 and (the following references are not included in the manuscript)
"Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song" 
"Ensemble Adversarial Training: Attacks and Defenses
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick McDaniel" .
"Improving Adversarial Robustness via Promoting Ensemble Diversity
Tianyu Pang, Kun Xu, Chao Du,  Ning Chen,  Jun Zhu " ICML 2019

Though these methods only considered combining full-precision models, the idea is the same in essence and let the low-bits networks involve into the ensemble is quite natural and straightforward. So I don't think the methodology contribution of this paper is enough for publication.

When checking the empirical results, the compared baselines miss a very common-used and strong baseline PGD adversarial training. And also the performance of this ensemble is not significant. 

Considering the weakness of the paper both in methodology development and empirical justification, this work does not merit publication from my point of view. 
review_title: Official Blind Review #4

final_score: rating: 6: Weak Accept
review_content: I think the paper reads well. It proposes to use ensembles of full precision and low-precision models in order to boost up robustness to adversarial attacks. It relies on the fact that low precision models are known to be more robust to adversarial attacks though performing poorly, while ensembling generally boosting up performance. 

I think the premise of the paper is quite clear, and the results seem to be intuitive.  At a high level one worry that I have is if ICLR is the right conference for this work. 

I would have expected maybe a more thorough empirical exploration. E.g. using resnets for ImageNet rather than AlexNet. Providing more baselines for the larger (and more reliable datasets) rather than MNIST which might be a bit misleading. I think the work does a decent job at looking at different number of components in the ensemble and analyzing the proposed method, but maybe not enough comparing and exploring other mechanism proposed as a defense for adversarial attacks. 

However I think the message is clear, the results seem decent and I'm not aware of this being investigated in previous works. 
review_title: Official Blind Review #1

final_score: rating: 6: Weak Accept
review_content: The authors propose an ensemble of low-precision networks as a solution to providing a neural network with solid adversarial robustness whilst also providing good accuracy.

I found the paper easy to read with a high quality introduction and background, the results are very convincing and the idea is simple but intriguing. I think this will shift the community towards seriously considering low precision networks a partial solution to adversarial attacks (alongside adversarial training).

I could not work out from the paper whether the adversarial attacks on the low-precision networks were performed at full precision. I.e. someone could clone the low-precision networks, cast them to full precision, perform an adversarial attack like FGSM and then evaluate on the quantized network. It would be good to clarify this (or make it clearer in the text how you handle this).
review_title: Official Blind Review #3

Meta-review: This paper proposed to apply emsembles of high precision deep networks and low precision ones to improve the robustness against adversarial attacks while not increase the cost in time and memory heavily.  Experiments on different tasks under various types of adversarial attacks show the proposed method improves the robustness of the models without sacrificing the accuracy on normal input.  The idea is simple and effective.  Some reviewers have had concerns on the novelty of the idea and the comparisons with related work but I think the authors give convincing answers to these questions.
Decision: Accept (Poster)