Venue: ICLR 2018 conference

Reviews:

final_score: rating: 7: Good paper, accept
review_content: 
This paper starts by gently going over the concept of adversarial attacks on neural networks (black box vs white box, reactive vs proactive, transfer of attacks, linearity hypothesis), as well as low-precision nets and their deployement advantages. 
Adversarial examples are introduced as a norm-measurable deviation from natural inputs to a system. We are reminded of adversarial training, and of the fact that binarized nets are highly non linear due to the nature of their weights and activations.

This paper then proposes to examine the robustness of binarized neural networks to adversarial attacks on MNIST and CIFAR-10.

The quantization scheme used here is v32 Conv2D -> ReLU -> BNorm -> sign -> bit Conv2D -> ReLU -> Scalar -> BNorm -> sign, but sign is really done with the stochastic quantization method of Courbariaux et al, even at test time (in order to make it more robust).

What the experimental results show:
- High capacity BNNs are usually more robust to white-box attacks than normal networks, probably because the gradient information that an adversary would use becomes very poor as training progresses.
- BNNs are harder to properly train with adversarial examples because of the polarized weight distribution that they induce
- Against black-box attacks, it seems there is little difference between NNs and BNNs.

Some comments and questions:
- In figure 1 I'm not sure what "Scalar" refers to, and it is not explained in the paper (nor could I find it explained in Papernot et al 2017a).
- Do you adopt the "Shift based Batch Normalizing Transform" of Courbariaux et al? If not, why?
- It might be worth at least _quickly_ explaining what the 'Carlini-Wagner L2 from CleverHans' is rather than simply offering a citation with no explanation. Idem for 'smooth substitute model black-box misclassificiation attack'. We often assume our readers know most of what we know, but I find this is often not the case and can discourage the many newcomers of our field.
- "Running these attacks to 1000 iterations [...], therefore we believe this targeted attack represents a fairly substantial level of effort on behalf of the adversary." while true for us researchers, computational difficulty will not be a criterion to stop for state actor or multinational tech companies, unless it can be proven that e.g. the number of iterations needs to grow exponentially (or in some other unreasonable way) in order to get reliable attacks.
- "MLP with binary units 3 better", 'as in Fig.' is missing before '3', or something of the sort.
- You say "We postpone a formal explanation of this outlier for the discussion." but really you're explaining it in the next paragraph (unless there's also another explanation I'm missing). Training BNNs with adversarial examples is hard.
- You compare stochastic BNNs with deterministic NNs, but not with stochastic NNs. What do you think would happen? Some of arguments that you make in favour of BNNs could also maybe be applied to stochastic NNs.

My opinions on this paper:
- Novelty: it certainly seems to be the first time someone has tackled BNNs and adversarial examples
- Relevance: BNNs can be a huge deal when deploying applications, it makes sense to study their vulnerabilities
- Ease of understanding: To me the paper was mostly easy to understand, yet, considering there is no page limit in this conference, I would have buffed up the appendix, e.g. to include more details about the attacks used and how various hyperparameters affect things.
- Clarity: I feel like some details are lacking that would hinder reproducing and extending the work presented here. Mostly, it isn't always clear why the chosen prodecures and hyperparameters were chosen (wrt the model being a BNN)
- Method: I'm concerned by the use of MNIST to study such a problem. MNIST is almost linearly separable, has few examples, and given the current computational landscape, much better alternatives are available (SVHN for example if you wish to stay in the digits domain). Concerning black-box attacks, it seems that BNNs less beneficial in a way; trying more types of attacks and/or delving a bit deeping into that would have been nice. The CIFAR-10 results are barely discussed.

Overall I think this paper is interesting and relevant to ICLR. It could have stronger results both in terms of the datasets used and the variety of attacks tested, as well as some more details concerning how to perform adversarial training with BNNs (or why that's not a good idea).
review_title: Review

final_score: rating: 6: Marginally above acceptance threshold
review_content: his work presents an empirical study demonstrating that binarized networks are more robust to adversarial examples. The authors follow the stochastic binarization procedure proposed by Courbariaux et al. The robustness is tested with various attacks such as the fast gradient sign method and the projected gradient method on MNIST and CIFAR.

The experimental results validate the main claims of the paper on some datasets. While reducing the precision can intuitively improve the robustness, It remains unclear if this method would work on higher dimensional inputs such as Imagenet. Indeed: 

(1) state of the art architectures on Imagenet such as Residual networks are known to be very fragile to precision reduction. Therefore, reducing the precision can also reduce the robustness as it is positively correlated with accuracy. 

(2) Compressing reduces the size of the hypothesis space explored. Therefore, larger models may be needed to make this method work for higher dimensional inputs. 

The paper is well written overall and the main idea is simple and elegant. I am less convinced by the experiments.  
review_title: elegant method, less convincing experiments

final_score: rating: 7: Good paper, accept
review_content: 1) Summary
This paper proposes a study on the robustness of one low-precision neural networks class - binarized neural networks (BNN) - against adversarial attacks. Specifically, the authors show that these low precision networks are not just efficient in terms of memory consumption and forward computation, but also more immune to adversarial attacks than their high-precision counterparts. In experiments, they show the advantage of BNNs by conducting experiments based on black-box and white-box adversarial attacks without the need to artificially mask gradients.


2) Pros:
+ Introduced, studied, and supported the novel idea that BNNs are robust to adversarial attacks.
+ Showed that BNNs are robust to the Fast Gradient Sign Method (FGSM) and Carlini-Wagner attacks in white-box adversarial attacks by presenting evidence that BNNs either outperform or perform similar to the high-precision baseline against the attacks.
+ Insightful analysis and discussion of the advantages of using BNNs against adversarial attacks.

3) Cons:
Missing full-precision model trained with PGD in section 3.2:
The authors mention that the full-precision model would also likely improve with PGD training, but do not have the numbers. It would be useful to have such numbers to make a better evaluation of the BNN performance in the black-box attack setting.


Additional comments:
Can the authors provide additional analysis on why BNNs perform worse than full-precision networks against black-box adversarial attacks? This could be insightful information that this paper could provide if possible.


4) Conclusion:
Overall, this paper proposes great insightful information about BNNs that shows the additional benefit of using them besides less memory consumption and efficient computation. This paper shows that the used architecture for BBNs makes them less susceptible to known white-box adversarial attack techniques.

review_title: Review

Meta-review: Paper was well written and rebuttal was well thought out and convincing.

The reviewers agree that the paper showed BNNs were good (relatively speaking) at resisting adversarial examples. Some question was raised about whether the methods would work on larger datasets and models. The authors offered some experiments in this regard in the rebuttal to this end. Also, a public comment appeared to follow up on CIFAR and report correlated results. 
Decision: Accept (Poster)