Venue: ICLR 2018 conference

Reviews:

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: This paper develops a new differentiable upper bound on the performance of classifier when the adversarial input in l_infinity is assumed to be applied.
While the attack model is quite general, the current bound is only valid for linear and NN with one hidden layer model, so the result is quite restrictive.

However the new bound is an "upper" bound of the worst-case performance which is very different from the conventional sampling based "lower" bounds. Therefore minimizing this upper bound together with a classification loss makes perfect sense and provides a theoretically sound approach to train a robust classifier.
This paper provides a gradient of this new upper bound with respect to model parameters so we can apply the usual first order optimization scheme to this joint optimization (loss + upper bound).
In conclusion, I recommend this paper to be accepted, since it presents a new and feasible direction of a principled approach to train a robust classifier, and the paper is clearly written and easy to follow.
 
There are possible future directions to be developed.

1. Apply the sum-of-squares (SOS) method.
The paper's SDP relaxation is the straightforward relaxation of Quadratic Program (QP), and in terms of SOS relaxation hierarchy, it is the first hierarchy. One can increase the complexity going beyond the first hierarchy, and this should provides a computationally more challenging but tighter upper bound.
The paper already mentions about this direction and it would be interesting to see the experimental results.

2. Develop a similar relaxation for deep neural networks.
The author already mentioned that they are pursuing this direction. While developing the result to the general deep neural networks might be hard, residual networks maybe fine thanks to its structure.
review_title: A path towards a principled approach to train a robust classifier

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper derived an upper bound on adversarial perturbation for neural networks with one hidden layer. The upper bound is derived via (1) theorem of middle value; (2) replace the middle value by the maximum (eq 4); (3) replace the maximum of the gradient value (locally) by the global maximal value (eq 5); (4) this leads to a non-convex quadratic program, and then the authors did a convex relaxation similar to maxcut to upper bound the function by a SDP, which then can be solved in polynomial time.

The main idea of  using upper bound (as opposed to lower bound) is reasonable. However, I find there are some limitations/weakness of the proposed method:
1. The method is likely not extendable to more complicated and more practical networks, beyond the ones discussed in the paper (ie with one hidden layer)
2. SDP while tractable, would still require very expensive computation to solve exactly.
3. The relaxation seems a bit loose - in particular, in above step 2 and 3, the authors replace the gradient value by a global upper bound on that, which to me seems can be pretty loose.
review_title: The main idea of  using upper bound (as opposed to lower bound) is reasonable. However, I find there are some limitations/weakness of the proposed method:

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: The authors propose a new defense against security attacks on neural networks. The attack model involves a standard l_inf norm constraint. Remarkably, the approach outputs a security certificate (security guarantee) on the algorithm, which makes it appealing for security use in practice. Furthermore, the authors include an approximation of the certificate into their objective function, thus training networks that are more robust against attacks. The approach is evaluated for several attacks on MNIST data.

First of all, the paper is very well written and structured. As standard in the security community, the attack model is precisely formalized (I find this missing in several other ML papers on the topic). The certificate is derived with rigorous and sound math. An innovative approximation based on insight into a relation to the MAXCUT algorithm is shown. An innovative training criterion based on that certificate is proposed. Both the performance of the new training objective and the tightness of the cerificate are analyzed empirically showing that good agreement with the theory and good results in terms of robustness against several attacks.

In summary, this is an innovative paper that treats the subject with rigorous mathematical formalism and is successful in the empirical evaluation. For me, it is a clear accept. The only drawback I see is the missing theoretical and empirical comparison to the recent NIPS 2017 paper by Hein et al.

review_title: Innovative rigorous defense against adversarial attacks on NNs

Meta-review: The paper presents a differentiable upper bound on the performance of classifier on an adversarially perturbed example (with small perturbation in the L-infinity sense). The paper presents novel ideas, is well-written, and appears technically sound. It will likely be of interest to the ICLR community.

The only downside of the paper is its limited empirical evaluation: there is evidence suggesting that defenses against adversarial examples that work well on MNIST/CIFAR do not necessarily transfer well to much higher-dimensional datasets, for instance, ImageNet. The paper could, therefore, would benefit from empirical evaluations of the defenses on a dataset like ImageNet.
Decision: Accept (Poster)