Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper proposes a method for learning robust binary neural networks from random initialization. The proposed training scheme includes  adaptive pruning approach and an edge pop-up algorithm for training the binary model to obtain a binary mask for pruning using a PGD-like method. It shows clear improvement over other adversarial training methods for binary models in experiments. Some theoretical analysis for the adaptive pruning method is provided.
strengths_and_weaknesses: ### Strengths
- The training algorithm is clearly stated makes sense. 
- The experimental results are impressive with evident improvement over comparing methods.
- Some theoretical analysis for the adaptive pruning method is provided.
- The ablation study and sensitivity analysis are very clear and are consistent with intuition. For example, the ablation study for the hyper-parameter $p$ for adaptive pruning aligns very well with the analysis.

### Weakness
- Only one neural net model (ResNet34) is evaluated in the experiments.
questions: - Can the authors provide some intuition or analysis regarding why this training scheme could work?
limitations: - It would be interesting to investigate whether the proposed training method can also be applied to training binary Transformers.
review_title: null

final_score: rating: 4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
review_content: summary: For a robust binary model built with Strong Lottery Ticket Hypothesis, the paper proposes a model compress method with three strategies: adaptive layer-wise pruning, a binary initialization scheme, and adding a last batch normalization layer. Experiments on CIFAR-10 and CIFAR-100 show that the proposed method outperforms previous competitive methods such as ATMC [22].
strengths_and_weaknesses: Strengths.
1) In Section 1 and Section 3.1 (Equation (2)), the paper clearly introduces the base model [19] that the paper works on: a robust binary model built with Strong Lottery Ticket Hypothesis.
2) In Section 3.2 and Section 3.2, introduction of the proposed three techniques is easy-to-follow, except too more "In Appendix ...". The proposed three techniques, adaptive layer-wise pruning, a binary initialization scheme, and adding a last batch normalization layer, are reasonable.
3) Experiments on CIFAR-10 and CIFAR-100 show that the proposed method outperforms previous competitive methods such as ATMC [22]. The paper further provides necessary analysis on the subnetwork patterns, and sensitivity analysis on the pruning strategy and added last batch-normalization layer.

Weaknesses.
1) My major concern is that the paper's proposed three techniques are not systematical but auxiliary model compression strategies. For example, the proposed adaptive pruning is a straightforward trade-off between fixed pruning rate and fixed number of parameters, and the key parameter $p$ is manually but not automatically selected in all experiments. Moreover, the paper works on a base model [19] which is already a robust binary model. The paper focuses on model compression only but not further improving binarization and adversarial robustness. 
2) In Table 4, different methods use different $p$, e.g., $p=1.0$ for RST and $p=0.1$ for the proposed method. I think all methods should use the same $p$ value for fair comparison.
3) Since tiny-scale datasets CIFAR-10 and CIFAR-100 are easily to be overfitting. I suggest the authors use large-scale datasets such as tinyImageNet for experiments. 
questions: 1) Are the proposed three techniques useful for regular DNNs in addition to the robust binary models [19]?
2) Why do the methods in Table 4 use different $p$ value? Are the methods in Table 4 fairly compared with each other?
3) Is the proposed method scalable to large-scale datasets such as tinyImageNet?
limitations: As mentioned above, a major limitation is that the paper's proposed three techniques are not systematical but auxiliary model compression strategies.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper presents a method for searching binary randomly initialized networks to generate pruned and robust models. The paper leverages the existing edge-popup algorithm for pruning untrained networks via learning important scores instead of model weights. The paper also proposes adding a last layer batchnorm to stabilize the training of their compressed robust models. The paper conducts several experiments to support their claim of achieving state-of-the-art robust binary networks.
strengths_and_weaknesses: Strengths:
- The paper is well motivated
- The quality of writing is good, the ideas are well explained
- The experimental results support the authors' claims, achieving state-of-the-art results for pruned binary robust models

Weaknesses:
- The novelty of this work is a bit limited, as it combines existing techniques (edge-popup + adversarial loss similar to [1] and [2]), that being said the end results are very impressive
- I would have liked to see more analysis on why the method is so successful, as opposed to adversarial training and/or binarization/pruning schemes


[1] Ramanujan, V., Wortsman, M., Kembhavi, A., Farhadi, A., & Rastegari, M. (2020). What's hidden in a randomly weighted neural network?. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 11893-11902).

[2] Sehwag, V., Wang, S., Mittal, P., & Jana, S. (2020). Hydra: Pruning adversarially robust neural networks. Advances in Neural Information Processing Systems, 33, 19655-19666.
questions: 1) In the Signed Kaiming Constant initialization (SKC) in line 175, is the 1-r a typo? since the original paper does not have the pruning ratio in the initialization step. If it is not a typo, does that mean every pruning ratio requires a different randomly initialized network?

2) Is the last normalization layer a standard batchnorm layer, or a homogenous (affine=False) batchnorm layer as used in other layers?

3) The observation that more pruning leads to higher robustness is very intriguing, especially when existing pruning + adversarial training methods, such as HYDRA [1] and ADMM [2], typically show that robustness decreases with the pruning rate (as is expected). Moreover, the edge-pop up algorithm typically achieves its best performance (in the non adversarial setting) when r=0.5, as it maximizes the number of possible network choices. Could the authors shed more light on the reason why their method seems to contradict both these existing observations?

4) If I understood correctly, the proposed method is able to generate 99% pruned binary networks, that achieve adversarial robustness that is higher than all other baselines, which includes full precision adversarially trained models and their pruned versions, as well as other trained binary models. For context, the state-of-the-art 99% pruned full precision baseline achieved by HYDRA suffers massive degradation in terms of robustness, when compared to an unpruned baseline. The results reported in this paper are very impressive and also very intriguing, as they seems too good to be true. I believe more experiments/analysis is warranted to explain why this method is so much more effective than prior work. One simple experiment perhaps is to initialize the weights to constant values between [-1,1] instead of the binary {-1,1}, and keep everything else the same. One would expect that pruning this baseline should have even better robust accuracy than the binarized version, and thus surpass that of any FP baseline. Another question is what would happen if we train the pruned models from scratch (that is take the pruning mask and initialize another model for adversarial training). It would be great if the authors can address this. 

[1] Sehwag, V., Wang, S., Mittal, P., & Jana, S. (2020). Hydra: Pruning adversarially robust neural networks. Advances in Neural Information Processing Systems, 33, 19655-19666.

[2] Ye, S., Xu, K., Liu, S., Cheng, H., Lambrechts, J. H., Zhang, H., ... & Lin, X. (2019). Adversarial robustness vs. model compression, or both?. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 111-120).
limitations: The authors claim that their work is generic and does not suffer from limitations or potential negative societal impact.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This manuscript extends the Strong Lottery Ticket Hypothesis to binary networks and proposed a new method to obtain compact binary networks with better robustness. The proposed method consists of three main parts: a) adaptively pruning different network layers; b) an effective binary initialization scheme; c) adding the last batch normalization layer. Extensive experiments on CIFAR-10/100 and ImageNet-100 validate the effectiveness of the method.
strengths_and_weaknesses: #### Strength:

1. The paper is well written with sufficient details of the proposed methods.
2. Experimental results on three datasets show superior performance against multiple baseline methods, including vanilla AT, Flying Bird, BCS, RST, HYDRA, and ATMC.
3. Analysis of the derived sparse patterns is provided.

#### Weakness:

1. The proposed methods search for sparse binary subnetworks within randomly-initialized networks. It's unclear whether such a scheme is better than training the parameters directly. It seems the proposed methods (adaptive pruning, binary initialization, and last batch normalization layer) can also to used to optimize the parameters of randomly-initialized networks. 
2. As the proposed methods aim to obtain binary neural networks, which are both compact and robust. The comparison about training and inference cost (e.g., FLOPs) is important.
3. It seems better to firstly report the comparison results in Section 4.2, and then conduct the ablation study of three proposed methods (Section 4.1).
questions: None
limitations: To some extent, this paper may help to build more secure and compact deep learning systems in the real world. But the real-world system faces all types of attacks, which are far beyond adversarial examples.
review_title: null

Meta-review: metareview: The reviewers agree the paper studies an interesting problem on training robust binary neural networks and the paper does a good job in evaluating the proposed approach on multiple datasets and compares well with baselines. However the paper also has some drawbacks such as the proposed method has limited novelty and is a combination of existing techniques, missing comparisons to standard training based approaches, evaluations limited to ResNets.  Overall the paper is on borderline. I suggest acceptance and encourage the authors to include all the changes that came up during discussion in the final version and discuss the limitations.
confidence: Less certain
Decision: Accept