Venue: ICLR 2023 TinyPapers

Reviews:

final_score: rating: Clear, Correct, and Reproducible (CCR): a submission which meets the reviewing criteria
review_content: summary_of_contributions: The authors investigate whether an ensemble 01 loss networks are more robust to white and black-box attacks compared to ensembles of cross-entropy networks. They find that 01 loss models are harder to attack naturally without adversarial training.
strengths_and_weaknesses: **Strengths:**

- The authors release their source code for reproduction.
- Interesting, to-the-point approach.

**Weaknesses:**

- Lack of clarity in some sections 
- Hard-to-follow paper (See Suggestions)
suggested_changes: - Solid paper overall, and I'd like to see a longer version with more experiments (with varying parameters) soon.
- I would suggest simplifying the abstract to provide an overview of the paper in a concise manner. A lot of the matter can be shifted to the Introduction section, which seems to be underdeveloped and missing specific details.
- The authors may also like to (explicitly or implicitly) go more into the details of the ensembles themselves for unaware but interested readers. Combined with the dense abstract, it was sometimes hard to follow the authors' proposal.
- (Nitpick) I'd suggest the authors use `\citet{}` and `\citep{}` macros in their work for citations. Or, change the way citations are handled to differentiate the author's name in the citation from the main body of the text.
review_title: null

final_score: rating: Needs Clarification (NC): a submission which does not meet the reviewing criteria and needs clarification for its described problem or solution
review_content: summary_of_contributions: This work investigates the robustness of single hidden layer with sign activation 01 loss networks.
strengths_and_weaknesses: Strengths:

1. The source codes have been provided.

Weaknesses:

1. This is a very unclear paper with poor written, which is hard to follow.
2. The problem explored in this work is not novel. Also, the authors have not shown the necessity of investigating this work.
3. The experimental results are not proficient. The authors need to consider PGD with different perturbation steps or the robustbench benchmark.
suggested_changes: Please refer to the weaknesses.
review_title: null

Decision: Invite to present