ARQ: A Mixed-Precision Quantization Framework for Accurate and Certifiably Robust DNNs

## Abstract

Abstract Mixed precision quantization has become an important technique for
enabling the execution of deep neural networks (DNNs) on limited resource computing platforms.
Traditional quantization methods have primarily concentrated on maintaining
neural network accuracy, either ignoring the impact of quantization on the
robustness of the network, or using only empirical techniques for improving
robustness. In contrast, techniques for robustness certification, which can
provide strong guarantees about the robustness of DNNs have not been used
during quantization due to their high computation cost. This paper introduces ARQ, an innovative mixed-precision quantization method that not only
preserves the clean accuracy of the smoothed classifiers but also maintains
their certified robustness. ARQ uses reinforcement learning to find accurate and robust
DNN quantization, while efficiently leveraging randomized smoothing,
a popular class of statistical DNN verification algorithms, to guide the search process.
We compare ARQ with multiple state-of-the-art quantization techniques on
several DNN architectures commonly used in quantization studies: ResNet-20 on
CIFAR-10, ResNet-50 on ImageNet, and MobileNetV2 on ImageNet.
We demonstrate that ARQ consistently performs better than these baselines
across all the benchmarks and the input perturbation levels. In many cases, the performance of ARQ quantized networks can reach that of the original DNN with floating-point weights, but with only 1.5 % percent 1.5 ~{}1.5\% 1.5 % instructions.

## 1 Introduction

Mixed precision quantization has become an important technique for
enabling the execution of deep neural networks (DNNs) on limited resource computing platforms. Quantization of an original DNN model with floating-point weights/activations significantly reduces the model size and the complexity of operations, while retaining the model’s accuracy (Wang et al., ).
However, quantizing the model also reduces its *robustness*, i.e., the
ability of the network to produce a correct classification in the presence
of (even small) adversarial input perturbations.

To alleviate this problem, *certified DNN robustness* techniques provide
formal guarantees that the DNN will classify all small perturbations with the same
label as the original input. These techniques are designed to protect against a
broad scope of possible adversarial inputs, unlike commonly used *empirical robustness* techniques, which defend against only a
specific kind of adversarial inputs, typically in a best-effort fashion (Raghunathan et al., ; Li et al., ).

Despite their desirability, certified robustness techniques, have a high computational cost. Many deterministic techniques that have been developed have been used only on small networks and datasets (Singh et al., ; Lechner et al., ; Zhang et al., ).
Statistical methods for robustness certification based on *randomized smoothing* (RS) (Cohen et al., ) currently offer the greatest scalability.
Yet, due to their cost, RS and other similar techniques have not been used *during* quantization but only at the end of the optimization to characterize the level of robustness of the final quantized network.
Using these techniques during model quantization is an open question.

Our Work: ARQ. We present ARQ, a novel robustness-aware mixed-precision quantization framework for neural networks.
ARQ demonstrates for the first time that robustness certification can be included as a part of the search
for optimal quantization of an original DNN.
ARQ’s algorithm takes a pre-trained DNN and encodes a reinforcement learning
(RL) problem that searches for *quantization policies* – the bit-widths
of the weights/activations of all layers in the DNN – that (1) preserve DNN’s
accuracy, (2) improve its robustness, and (3) reduce the model’s computation
cost.
This design allows ARQ to support mixed-precision quantization (MPQ), in which
the weights in each layer can be quantized with different bit-widths, thus
giving fine-grained control over the possible policies.

The key insight behind ARQ’s approach is that the optimization for both
accuracy and robustness aims to maximize the DNN’s *certified radius*,
which characterizes all the slightly perturbed inputs that the DNN classifies with the same label as
the non-perturbed input.
This optimization objective fits well within the RL framework.
ARQ’s algorithm also makes it possible to leverage recent
approaches for incremental analysis of certified robustness to speed up the
quantization policy search.

We compare ARQ with existing searching and learning-based mixed precision
quantization methods that only optimize for accuracy. The baselines include
HAQ (Wang et al., ) (which uses reinforcement learning) and LIMPQ (Tang et al., ) (which uses integer programming) and fixed-precision
quantization method PACT (Choi et al., ). We considered three DNN
architectures commonly used in quantization studies: ResNet-20 on CIFAR-10,
ResNet-50 on ImageNet, and MobileNetV2 on ImageNet.

We demonstrate that ARQ consistently performs better than these baselines
across all the benchmarks and the input noise levels. In many cases, ARQ can
even reach, and sometimes even improve on the accuracy and robustness of the
original FP32 network, but with only$~{}1.5\%$ operations.

Contributions. The paper makes the following contributions:

- •
Approach: We present ARQ, the first approach for mixed-precision
quantization that optimizes for certified robustness of DNNs. It poses an optimization problem that maximizes the certified radius for a bounded resource usage cost (e.g., compute instructions, model size).
- •
Framework: ARQ’s algorithm incorporates randomized smoothing within the reinforcement learning loop, which enables it to find certifiably robust quantized networks.
- •
Results: Our experiments on three commonly used networks/datasets show that ARQ consistently performs better than the state-of-the-art quantization techniques.

## 2 Background

### 2.1 Mixed Precision Quantization

Neural network quantization is a model compression technique that can reduce a network’s size and compute cost. Quantization applies to float-valued weights and activations in the network and converts them to integer values of certain bit-widths.
Using the same bit-width for the entire network is sub-optimal because some layers are more amenable to quantization than others.

Mixed Precision Quantization assigns different bit-widths
per weight or activation in a network
and searches for the best combination of bit-widths.
A quantization policy $P$ is a sequence of bit-width assignments
to each layer in the network.
For a network of $L$ layers, where each layer has
$N$ bit-width options $\{b_{1},b_{2},\dots,b_{N}\}$ for both weights and activations,
there are $N^{2L}$ combinations of quantization policies.
We can then formulate the process of optimizing the quantization policy for a network
$\mathbf{N}$
as the following mathematical optimization problem:

$$ $P_{optimal}=\arg\max_{P\in\mathcal{P}}\text{Acc}(f_{P}(x),y)\quad\text{s.t. } \text{Cost}(f_{P})<C_{0}$ (1) $$

$$ $\text{Acc}(f(x),y)=\frac{1}{|X|}\sum_{(x,y)\in X}\mathbf{1}(f(x)=y)$ (2) $$

Here $\mathcal{P}$ denotes the space of all quantization policies and
$P_{optimal}\in\mathcal{P}$ is the optimal policy that maximizes $\text{Acc}(f_{P}(x))$ on dataset $X$, the accuracy of the quantized network $f_{P}(x)$.
$\text{Cost}(f_{P})$ is the resource usage of the network,
such as the model size, the number of compute bit operations or energy consumption,
and $C_{0}$ is a user-specified bound on the resource.

Reinforcement Learning Based Quantization. Wang et al. (); Lou et al. () have introduced Reinforcement Learning (RL) based approaches to search for quantization policies. One of the RL algorithms introduced is the Deep Deterministic Policy Gradient (DDPG) algorithm (Lillicrap et al., ) (see Appendix A.1 for details).
The DDPG agent iteratively interacts with the environment (the neural network) by observing the state $S_{k}$ (the configuration of the $k_{th}$ layer), taking an action $a_{k}$ (the quantization bit-width), and receiving a $Reward$ (the resulting accuracy).

### 2.2 Certified Neural Network Robustness

A classifier is considered certifiably robust
when its predictions are guaranteed to remain consistent within a neighborhood of input $x$.
Consider a classification problem from $\mathbb{R}^{m}$ to classes $\mathcal{Y}$.
Let $f:\mathbb{R}^{m}\to\mathcal{Y}$ be a neural network classifier.
We seek a smoothed classifier $g:\mathbb{R}^{m}\to\mathcal{Y}$,
whose prediction matches that from $f$ for any input $x$
and is constant within some neighborhood of $x$.
Randomized smoothing (Cohen et al., ; Yang et al., ; Zhang et al., ) provides a way to construct
such a smoothed classifier $g$ from the base classifier $f$.
When queried at $x$, $g$ returns the class that
$f$ is most likely to return when $x$ is perturbed by
Gaussian noise:

$$ $\displaystyle g(x):=\operatorname*{arg\,max}_{c\in\mathcal{Y}}\mathbb{P}(f(x+ \varepsilon)=c)\quad\text{where}\quad\varepsilon\sim\mathcal{N}(0,\sigma^{2}I)$ (3) $$

Cohen et al. ()
show that $g$’s prediction
is constant within an $l_{2}$ ball around any input $x$.
The radius of that ball, $R(x)$, is known as the certified radius.
$\varepsilon$ is the Gaussian noise added on the input,
sampled from Gaussian distribution of mean 0 0 and variance $\sigma^{2}I$
($I$ is the identity matrix).
$\sigma$ is the noise level, a hyperparameter of the smoothed classifier $g$
independent of the input $x$.
The certified accuracy of a classifier is defined as the probability that the classifier correctly predicts the true labels of samples $x$ for which the certified radius $R(x)$ exceeds a certain threshold $r$.
The clean accuracy is the certified accuracy when $r=0$.

###### Theorem 1 (From Cohen et al. ( 2019 ) )

Suppose $c_{A}\in\mathcal{Y}$, $\underline{p_{A}},\overline{p_{B}}\in[0,1]$. if

$$ $\mathbb{P}(f(x+\epsilon)=c_{A})\geq\underline{p_{A}}\geq\overline{p_{B}}\geq \max_{c\neq c_{A}}\mathbb{P}(f(x+\epsilon)=c),$ (4) $$

then $g(x+\delta)=c_{A}$ for all $\delta$ satisfying $\|\delta\|_{2}\leq\frac{\sigma}{2}(\Phi^{-1}(\underline{p_{A}})-\Phi^{-1}(
\overline{p_{B}}))$, where $\Phi^{-1}$ denotes the inverse of the standard Gaussian CDF.

Computing the exact probabilities $\underline{p_{A}},\overline{p_{B}}$ from Eqn. 4
is intractable in general.
For practical applications, RS certification utilizes sampling to estimate
$\underline{p_{A}}$ and $\overline{p_{B}}$ using the Clopper-Pearson method (Clopper & Pearson, ).
If using this procedure yields $\underline{p_{A}}>0.5$, then RS algorithm sets $\overline{p_{B}}=1-\underline{p_{A}}$ and computes the certified radius as

$$ $R(x)=\sigma\cdot\Phi^{-1}(\underline{p_{A}})$ (5) $$

via Theorem 1, else it returns ABSTAIN, i.e., it cannot prove the certified robustness.

###### Theorem 1 (From Cohen et al. ( 2019 ) )

## 3 ARQ Approach

### 3.1 Problem Statement

ARQ provides a mixed precision quantization method
that optimizes both the robustness and accuracy of the quantized smoothed classifier $g_{P}$
from a base classifier $f$.

Quantization Challenges.
To improve the robustness of the quantized smoothed classifier $g_{P}$,
one could naively replace the accuracy metric in the formulation of an existing MPQ method (Eqn. 1)
with an accuracy metric for the base classifier $f_{P}$ that uses Gaussian noise-perturbed inputs.
This approach does not significantly improve the robustness of the quantized smoothed classifier $g_{P}$, based on the following three observations:

- •
By taking one perturbed sample per data point,
this accuracy metric is highly affected by randomness
and does not capture the robustness of $g_{P}$ well.
- •
The accuracy of base classifier $f_{P}$ correlates directly with the average lower bound probability ($\underline{p_{A}}$) as stated in Eqn. 4. However, improving the quantized base classifier $f_{P}$’s accuracy on samples with $\underline{p_{A}}<0.5$ does not improve the quantized smoothed classifier $g_{P}$’s accuracy. Because for samples where $\underline{p_{A}}<0.5$, the certified radius is less than zero, indicating that the quantized smoothed classifier $g_{P}$ cannot provide any robustness guarantee for these samples. Consequently, these samples cannot be correctly classified by the quantized smoothed classifier $g_{P}$, regardless of the improvements made to the base classifiers on such inputs.
- •
Using accuracy as the optimization goal does not accurately reflect the robustness of the neural networks.
As $R=\sigma\cdot\Phi^{-1}(\underline{p_{A}})$, the radius $R$ of $g_{P}$ has a complicated relation to $\underline{p_{A}}$.
Therefore, optimizing only for the accuracy of the quantized base classifier $f_{P}$ may not accurately translate to improvements in the accuracy of the quantized smoothed classifier $g_{P}$. This results in a disproportionate focus on samples with smaller certified radii, while neglecting those with larger ones, due to the non-linear relationship between $R$ and $\underline{p_{A}}$.

##### ARQ Optimization Objective.

Instead, we propose using the certified radius of smoothed classifiers to directly guide the quantization method. It is more straightforward as it uses feedback directly from the smoothed classifiers instead of the base classifiers, and it can combine the goal of optimzing both the clean accuracy and the robustness of the smoothed classifiers.
We define the following optimization problem (compare Eqn. 1) to find the optimal quantization policy $P_{optimal}$:

$$ $P_{optimal}=\arg\max_{P\in\mathcal{P}}(\text{Average Certified Radius})\quad \text{s.t. }\text{Cost}(f_{P})<C_{0}$ (6) $$

where Average Certified Radius (ACR) is estimated as:

$$ $\text{ACR}=\frac{\sigma}{{|X|}}\sum_{(x,y)\in X}\Phi^{-1}(\underline{\mathbb{P }(f(x+\varepsilon)=y)})\quad\forall\varepsilon\sim\mathcal{N}(0,\sigma^{2}I)$ (7) $$

The $\underline{\mathbb{P}(f_{P}(x+\varepsilon)=y)}$ here represents the lower bound of probability that base classifier $f$ can correctly classify input $x$ under noise $\varepsilon$. This follows from the definition of the certified radius $R(x)=\sigma\cdot\Phi^{-1}(\underline{p_{A}})$ for a given input $x$ and $\mathbb{P}(f(x+\epsilon)=c_{A})\geq\underline{p_{A}}$ in Section 2.2. By averaging over inputs in the dataset $X$, we obtain the ACR, which provides a measure of the overall robustness of the classifier. Since the clean accuracy of smoothed classifiers is the percentage of samples with a certified radius greater than zero. By focusing on optimizing the Acerage Certified Radius, we can improve both the accuracy and robustness of the quantized smoothed classifiers.

Therefore, our final robustness-aware quantization problem formulation is:

$$ $\boxed{P_{optimal}=\arg\max_{P\in\mathcal{P}}\sum_{(x,y)\in X}\Phi^{-1}( \underline{\mathbb{P}(f_{P}(x+\varepsilon)=y)})\quad\text{s.t. }\text{Cost}(f_ {P})<C_{0}}$ (8) $$

However, it is challenging to use this formulation to search exhaustively across quantization policies because calculating the certified radius, specifically obtaining $\underline{\mathbb{P}(f_{P}(x+\varepsilon)=y)}$, is expensive – this probability is estimated using the Clopper-Pearson method (Clopper & Pearson, ), and the confidence level is related to the number of samples, and may require thousands of samples even for a single image (Cohen et al., ).
Instead, we employ a reinforcement learning (RL) agent to search for the optimal quantization policy $P_{optimal}$, which we describe next.

### 3.2 ARQ Search Algorithm

Figure: Algorithm 1 ARQ Search Algorithm

Algorithm 1 presents the pseudocode for the ARQ algorithm, which aims to determine the optimal quantization policy for a given DNN $f$.

We first certify the robustness of $g$, the smoothed version of $f$ with $n_{0}$ samples, and store the average certified radius of $g$ as $ACR_{orig}$ (line 2, 3).
During each iteration, our RL agent observes the $k_{th}$ layer’s configuration as state $S_{k}$ and uses the policy network $\mu(\cdot)$ learned from the previous iterations to determine an action $a_{k}$ (line 6).
For each layer, the agent selects two actions for the weights and the activations of that layer. The transition $(S_{k},a_{k},Reward,S_{k+1},d)$ is stored in the replay buffer $D$ for training the agent’s policy network (line 8). Here, $Reward$ is initially left blank, $S_{k+1}$ is the configuration of the next layer, and $d$ is the done signal indicating if it is the last layer.

After the RL agent proposes the actions for all layers, we first transform the continuous actions in list $A$ into discrete bit-widths and combine them into a quantization policy list $P_{t}$.
Then we evaluate the resource usage of the base classifier $f_{P}$, which is quantized through $P_{t}$.
If the proposed quantization policy $P_{t}$ exceeds the specified resource constraint $C_{0}$, we will sequentially decrease the bit-width of each layer until the constraint is finally satisfied (line 10).

The function $\text{Quantize}(f,P_{t})$ represents the quantization on $f$ to $f_{P}$ with quantization policy $P_{t}$, where the floating-point weights and activations were mapped to integers.
We finetune $f_{P}$ for one epoch using $n_{1}$ inputs in dataset $X$ with Gaussian noise of size $\sigma$ to help it recover performance (line 11).
We smoothed $f_{P}$ into quantized smoothed classifier $g_{P}$ with $n$ (which is $\ll n_{0}$) samples, and certify the robustness of $g_{P}$ with Incremental Randomized Smoothing (IRS) to get the ACR of $g_{P}$ as $ACR_{P}$ (line 12, 13).
The RL agent’s reward for all actions, $Reward_{t}$, is set as $ACR_{P}-ACR_{orig}$, using the average certified radius of $g_{P}$ and $g$ to guide the learning of agent (line 14, 19).
After $N$ iterations, we obtain the optimal quantization policy $P_{\text{optimal}}$, with maximim average certified radius of the quantized smoothed classifier.

#### 3.2.1 Quantization Policy Search

Following the experience in previous work (He et al., ; Wang et al., ), we utilize Deep Deterministic Policy Gradient (DDPG) as our reinforcement learning agent to search the bit-widths.
For the state space of the agent, on the $k_{\text{th}}$ layer of the base classifier $f$, the state $S_{k}$ is:

$$ $S_{k}=(k,c_{\text{in}},c_{\text{out}},s_{\text{kernel}},s_{\text{stride}},s_{ \text{feat}},n_{\text{params}},i_{d},i_{wa},a_{k-1})$ (9) $$

where $c_{\text{in}}$ and $c_{\text{out}}$ are the number of input and output channels, $s_{\text{kernel}}$, $s_{\text{stride}}$ and $s_{\text{feat}}$ are the size of kernel, stride and the input feature map, $n_{\text{params}}$ is the number of parameters, $i_{d}$ is the indicator of whether the layer is a depthwise layer, $i_{wa}$ is the indicator of whether this is for weights or activations and $a_{k-1}$ is the action from previous layer. Since the first and last layers are important, we excluded them from quantization policy search and fix their quantization bit-widths to 8 bits.

We use a continuous action space with $a_{\text{min}}=0$ and $a_{\text{max}}=1$ to keep the relative order information among different actions in line 6 of Algorithm 1. Observing the state $S_{k}$ and using the policy network $\mu(\cdot)$, the action $a_{k}$ is selected for the $k_{th}$ layer, where $\epsilon\sim\mathcal{N}_{t}$ is a noise term added for exploration in truncated normal distribution.
We then round $a_{k}$ into discrete bit-width $b_{k}$:

$$ $b_{k}=\text{round}((b_{\text{min}}-0.5+a_{k}\times(b_{\text{max}}-b_{\text{min }}+1)),$ (10) $$

with $b_{\text{min}}$ and $b_{\text{max}}$ here denoting the min and max bit-width.

As described in line 8 and line 10 in Algorithm 1, the actions will first be combined into list $A$.

$$ $A=(a_{1},a_{2},\ldots,a_{k},a_{k+1},\ldots,a_{d})$ (11) $$

where $a_{d}$ is the final action the agent made for the last layer.
When all layers has been traversed by the agent, the list $A$ is transformed into discrete bit-width form policy $P_{t}$ fot the $t_{th}$ iteration.

$$ $P_{t}=(b_{1},b_{2},\ldots,b_{k},b_{k+1},\ldots,b_{d})$ (12) $$

$P_{t}$ is also limited by the resource constraint $C_{0}$. When the given $P_{t}$’s resource usage exceeds $C_{0}$, the bit-width will be decreased sequentially from back to front.

#### 3.2.2 Robustness-Aware Policy Search

Due to the high cost of certifying the robustness of the quantized smoothed classifier $g_{P}$, we perform the certification only when $d$ is true, which indicates all actions have been taken and the entire quantization policy $P_{t}$ come out. This avoids the frequent and expensive robust certification for each individual quantized layer. We define our reward function $Reward_{t}$ to be related to only the average certified radius of the smoothed classifiers (line 14):

$$ $Reward_{t}=ACR_{P}-ACR_{orig}$ (13) $$

where $ACR_{P}$ denotes the average certified radius gained by the quantized smoothed classifier $g_{P}$ through the current quantization policy $P_{t}$, and $ACR_{orig}$ denotes the average certified radius of the original smoothed classifier $g$, which is a function of $x$ as formulated in Eqn. 7.

The experiences in the form of transitions $(S_{k},\,a_{k},\,Reward_{t},\,S_{k+1},\,d)$ are stored in the replay buffer $D$ to update the Q-function, policy, and target network of the DDPG agent (line 19).

We use $Reward_{best}$ to compare with $Reward_{t}$ and find the optimal quantization policy $P_{optimal}$, for which the corresponding $g_{P_{optimal}}$ achieves the highest ACR.

Since our optimization goal is to maximize the average certified radius of $g_{P}$ across the entire policy $P_{t}$, we set the reward for all actions across different layers in one iteration to be the same value: the final reward $Reward_{t}$. This ensures the reward reflects the overall effectiveness of the quantization policy rather than individual layer actions, promoting a more comprehensive optimization.

#### 3.2.3 Implementation Details

Quantization. We use a linear quantization method, which maps the floating-point value to discrete integer values in the range $[-c,c]$ for weights and $[0,c]$ for activations. The quantization function $\text{Quantize}(\cdot)$ that quantizes floating-point weight value $v$ to $b$-bit integer value $q$ can be expressed as:

$$ $q=\text{round}(\text{clip}({v}/{s},-c,c))\times s$ (14) $$

where $v$ is the floating-point value, and $q$ is the quantized value.
$s=\frac{c}{2^{b-1}-1}$ is the scaling factor.
$c$ is found by optimizing the KL-divergence between $q$ and $v$.
In the network, each layer utilizes two distinct $c$ values for quantizing weights and activations.

IRS for Speedup in Certification. Due to the significant time consumption caused by both the number of iterations required for quantization policy search and the time-consuming process of certifying each iteration of the quantized neural networks, we employ Incremental Randomized Smoothing (IRS) (Ugare et al., ) to certify quantized smoothed classifiers more efficiently. It is known that IRS can have similar precision to re-running RS when verifying networks that have sufficient structural similarity. Our design of ARQ algorithm aims to promote this property.

## 4 Experimental Methodology

Networks and Datasets.
We evaluate ARQ on CIFAR-10 (Krizhevsky et al., ) and ImageNet (Deng et al., ) datasets.
We conduct all experiments on CIFAR-10 and ImageNet with 4-bit equivalent quantization,
We also perform ablation studies on CIFAR-10 dataset with various quantization levels.
The initial floating-point DNNs are trained with Gaussian noises of variance $\sigma^{2}$ on inputs.
We use ResNet-20 as the base classifier for CIFAR-10, and ResNet-50 and MobileNetV2 for ImageNet.
These models are chosen because they are the most commonly used classifiers in previous studies within the areas of quantization and robustness.

Experimental Setup. For the ResNets experiments, we use a 48-core Intel Xeon Silver 4214R CPU with two Nvidia RTX A5000 GPUs. For the MobileNetV2 experiments, we use an AMD EPYC 7763 CPU with four Nvidia A100 GPUs. ARQ is implemented in Python and uses PyTorch.

Hyperparameters.
We use Stochastic Gradient Descent (SGD) with a momentum of 0.9 and a weight decay of $10^{-4}$ for model training and fine-tuning following Cohen et al. ().
During the policy search, we fine-tune the CIFAR-10 base classifiers for one epoch with a learning rate of 0.01, and the ImageNet base classifiers on a 60,000-sample subset with a learning rate of 0.001.
For fine-tuning in evaluation, for CIFAR-10, we set an initial learning rate of 0.01 and scaled it by 0.1 at epoch 5.
For ImageNet, we set an initial learning rate of $10^{-3}$ and
used the ReduceLROnPlateau learning rate scheduler. Fine-tuning is limited to 10 epochs, and the batch sizes are 256 for CIFAR-10 and 128 for ImageNet.
A detailed description of our fine-tuning epoch choice is described in Appendix A.3.
For the optimization of the DDPG agent, following Wang et al. (), we use ADAM (Kingma & Ba, ) with $\beta_{1}=0.9$ and $\beta_{2}=0.999$. The learning rate is set to be $10^{-4}$ for the actor network and $10^{-3}$ for the critic network. During exploration, truncated normal noise with an initial standard deviation of 0.5, decaying at 0.99 per episode, is applied to the actions.

Metrics. We use the number of bitwise operations (BitOPs) constraint for all methods following Yao et al. ().
BitOPs for filter k can be represented as: $\text{BitOPs}(k)={b_{w}\cdot b_{a}\cdot|k|\cdot w_{k}\cdot h_{k}}/{s^{2}_{k}}$ where $b_{w}$ and $b_{a}$ are the bitwidths for weights
and activations, $|\cdot|$ denotes the number of parameters of the filter, $w_{k}$, $h_{k}$, $s_{k}$ are the spatial width, height, and stride of the filter.

Robustness Certification.
For the evaluation, we use confidence parameters $\alpha=0.001$ for the certification of the original smoothed classifier $g$.
Following the setting used by RS (Cohen et al., ) and IRS (Ugare et al., ). For policy search, we use 500 validation images, $n_{0}=10000$, and $n=500$ samples per image. For $\zeta_{x}$ estimation, we use $\alpha=0.001$ and $\alpha_{\zeta}=0.001$ on CIFAR-10, and $\alpha=0.01$ and $\alpha_{\zeta}=0.01$ on ImageNet.

Evaluation.
We compare ARQ with existing searching and learning-based mixed-precision quantization methods HAQ (Wang et al., ) and LIMPQ (Tang et al., ) and fixed-precision quantization method PACT (Choi et al., ). HAQ is a state-of-the-art RL-based method and LIMPQ is the state-of-the-art learning-based method.
To make the baseline methods work well, we added Gaussian noise for the inputs and used the accuracy metric on the perturbed inputs as described in Section 3.1 during the policy search process for these baselines. For certifying the original smooth classifier $g$ and quantized smooth classifier $g^{P}$, we used RS on 500 images each with $10^{6}$ samples.

ARQ code is available at: [https://anonymous.4open.science/r/ARQ-FE4B](https://anonymous.4open.science/r/ARQ-FE4B).

## 5 Experimental Results

We present our main evaluation results: (1) the robustness and clean accuracy on the CIFAR-10 and ImageNet datasets; (2) the runtime of ARQ’s search algorithm; and (3) selected ablation studies.

### 5.1 Robustness and Accuracy Evaluation on CIFAR-10

On CIFAR-10, we conducted our experiments using ResNet-20 as the base classifier, with $\sigma=\{0.25,0.5,1.0\}$ and various BitOPs constraint settings. Figure 1 compares ARQ and baselines.

Figure: (a) $\sigma=0.25$
Refer to caption: x1.png

ARQ achieved the best ACR for all experiments except on $\sigma=0.25$ and stricter BitOPs constraint setting, where the ACR drop compared to the best baseline is less than 0.001.
Figure 1(b) presents results on $\sigma=0.50$. Notably, ARQ’s 4-bit and 5-bit equivalent models outperformed the FP32 original model which was not achieved by any other methods.
Figure 1(c) presents results on $\sigma=1.00$. On 3-bit equivalent BitOPs constraint, ARQ had a 0.54% ACR drop while the best baseline had a 3.43% ACR drop. ARQ also outperformed the FP32 model with more than 1.5% operations.

Finally, Figure 1(d) shows the average clean accuracy drop achieved by the methods. ARQ’s drop is smaller (hence, clean accuracy is higher) than the other baselines. Except for the 4-bit equivalent BitOPs, ARQ outperformed all baselines.

### 5.2 Robustness and Accuracy Evaluation on ImageNet

**Table 1: Experiments on ImageNet. The ACR denotes the average certified radius, Acc denotes the clean accuracy of the smoothed classifiers, and GBitOPs denotes the number of bit operations of the models, measured in gigabits.**
|  | Method | $\sigma=0.25$ | $\sigma=0.50$ | $\sigma=1.00$ |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACR | Acc | GBitOPs | ACR | Acc | GBitOPs | ACR | Acc | GBitOPs |  |  |
| ResNet-50 | FP 32 | 0.488 | 69.4 | 4244.3 | 0.743 | 62.4 | 4244.3 | 0.914 | 45.4 | 4244.3 |
| \cdashline2-11 | ARQ | 0.472 | 70.8 | 63.32 | 0.724 | 61.2 | 63.50 | 0.916 | 46.0 | 63.50 |
| \cdashline2-11 | LIMPQ | 0.458 | 68.6 | 63.55 | 0.700 | 58.2 | 63.55 | 0.871 | 44.4 | 63.55 |
|  | HAQ | 0.460 | 69.0 | 63.56 | 0.715 | 60.8 | 64.15 | 0.880 | 44.8 | 63.55 |
|  | PACT | 0.460 | 69.0 | 63.56 | 0.715 | 61.0 | 63.56 | 0.884 | 45.4 | 63.56 |
| MobileNet-V2 | FP 32 | 0.457 | 67.0 | 308.24 | 0.668 | 57.0 | 308.24 | 0.846 | 44.4 | 308.24 |
| \cdashline2-11 | ARQ | 0.385 | 62.0 | 4.60 | 0.576 | 54.0 | 4.60 | 0.774 | 41.6 | 4.60 |
| \cdashline2-11 | LIMPQ | 0.347 | 58.4 | 4.62 | 0.540 | 50.6 | 4.62 | 0.703 | 40.2 | 4.62 |
|  | HAQ | 0.341 | 56.0 | 4.60 | 0.573 | 53.4 | 4.60 | 0.683 | 39.8 | 4.61 |
|  | PACT | 0.376 | 60.2 | 4.62 | 0.564 | 52.4 | 4.62 | 0.757 | 40.2 | 4.62 |

Table 1 shows the results of the experiments on ImageNet. We selected a $1.5\%$ BitOPs constraint as in CIFAR-10 experiments, it demonstrated that ARQ can achieve the accuracy and robustness of FP32 models.
ARQ outperformed all other quantization methods in all settings we consider. These results show that our approach with ACR objective is able to improve *both* the clean accuracy and robustness.
For ResNet-50, ACR of the ARQ-generated network is comparable to the ACR of the original FP32 model. The clean accuracy for $\sigma=0.25$ and $\sigma=1$ is even slightly higher than the accuracy of the original network.
As a result of the limited fine-tuning, for MobileNetV2, the clean accuracy and ACR are reduced compared to the FP32 model, but both are significantly higher than the alternative quantization methods.
Since low $\sigma$ certifies small radii with high accuracy but not large radii, while high $\sigma$ certifies larger radii but with lower accuracy for smaller radii, the clean accuracy drops as $\sigma$ increases. This observation is consistent with that in RS (Cohen et al., ).

Note, the other mixed-precision quantization methods could hardly outperform the fixed-precision quantization method PACT (Choi et al., ) on ImageNet, while ARQ significantly outperformed PACT on both networks and even the original FP32 model at $\sigma=1.00$ on ResNet-50.

### 5.3 Execution Time of ARQ Search and Other Methods

**Table 2: The total time for ARQ and other quantization search approaches (in hours).**
| Benchmark | Total time | Policy Search | Eval |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| ARQ | HAQ | LIMPQ | ARQ | HAQ | LIMPQ |  |  |
| ResNet-50 | 104.75 | 75.51 | 56.60 | 71.89 | 42.65 | 23.74 | 32.86 |
| MobileNetV2 | 85.44 | 46.98 | 31.96 | 67.83 | 29.37 | 14.35 | 17.61 |
| ResNet-20 | 3.30 | 2.78 | 0.56 | 2.83 | 2.31 | 0.09 | 0.47 |

Table 2 presents the time consumption for different methods.
We selected $\sigma=0.5$ as it represents the median value among the tested values in the experiments.
The total time includes the policy search, fine-tuning, and evaluation.
The Eval time includes the time for fine-tuning and evaluation of the quantized smooth classifiers.
Although ARQ consumes more time than other methods, it is a one-time cost, and the previous section showed that it produces the most robust models.

### 5.4 Ablation Studies

**Table 3: Impact of the reward function on ResNet-20 for CIFAR-10 with $\sigma=0.5$. The method here refers to the different approaches for the reward function.**
| Method | GBitOps | ACR | Radius r |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 0.0 | 0.25 | 0.50 | 0.75 | 1.00 | 1.25 | 1.50 | 1.75 |  |  |  |
| FP 32 | 42.04 | 0.539 | 68.2 | 56.0 | 44.6 | 33.8 | 21.8 | 14.4 | 7.2 | 3.8 |
| \hdashlineARQ | 0.354 | 0.530 | 67.2 | 54.6 | 43.2 | 32.6 | 22.2 | 14.2 | 7.4 | 4.4 |
| \hdashlineVal | 0.363 | 0.518 | 66.4 | 53.4 | 43.0 | 32.8 | 21.6 | 13.0 | 7.4 | 4.0 |
| Certified Acc | 0.362 | 0.525 | 65.8 | 55.6 | 43.8 | 31.8 | 21.6 | 13.0 | 7.4 | 4.0 |

Reward Function Choice.
We investigate the sensitivity of the policy search to the quality of the reward function. In ARQ, we used the ACR as a reward to the RL agent. But here is an intuitive question, what if we use the certified accuracy of the quantized smooth classifier $g_{P}$ as the reward? As we mentioned in Section 2.2, certified accuracy is the probability that the quantized smoothed classifier $g_{P}$ correctly predicts samples $x$ with certified radius $R(x)$ exceeds the given threshold $r$.
Table 3 shows the result of the ablation study conducted with two 3-bit equivalent quantized ResNet-20 models on CIFAR-10 and $\sigma=0.5$. Method "Val" and "Certified Acc" refer to using the validation accuracy of $f$ and the certified accuracy of $g$ on $r=0.5$. We observe that "Certified Acc" gains better-certified accuracy on $r=0.25$ and $0.5$ but loses for the rest of the radii and ACR.

**Table 4: The effect of incremental RS (IRS) vs rerunning RS on CIFAR-10.**
| Method | $\sigma=0.25$ | $\sigma=0.50$ | $\sigma=1.00$ |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACR | Acc | GBitOPs | ACR | Acc | GBitOPs | ACR | Acc | GBitOPs |  |
| FP 32 | 0.435 | 76.4 | 42.04 | 0.539 | 68.2 | 42.04 | 0.553 | 50.8 | 42.04 |
| \hdashlineARQ(-IRS) | 0.418 | 76.0 | 0.362 | 0.530 | 67.2 | 0.354 | 0.550 | 49.6 | 0.354 |
| \hdashlineARQ-RS | 0.414 | 75.8 | 0.362 | 0.526 | 67.2 | 0.359 | 0.537 | 49.2 | 0.359 |

The Effect of IRS.
Table 4 shows the results of using RS instead of IRS to obtain $ACR_{p}$ and $Reward_{t}$. In our experiments, IRS is 1.32x faster than RS, consistent with the results from IRS (Ugare et al., ). The method "RS" refers to using the same time for certification in the policy search process as the IRS. We observe that using IRS does not reduce the quality of the quantization policy (and in many cases improves it), justifying its use in ARQ’s search loop as the candidate quantized networks are similar enough to benefit from incremental robustness proving.

Other Ablation Studies. Appendix A.2 presents quantization policies across different $\sigma$s. Appendix A.3 presents the effect of the number of epochs in fine-tuning.

## 6 Related Work

Mixed-Precision Quantization.
To optimize the balance between the accuracy and efficiency of DNNs, many mixed-precision quantization methods have been presented.
Dong et al. (); Louizos et al. (); Chen et al. (); Tang et al. () employed appropriate proxy metrics that indicate model sensitivity to quantization to generate quantization policies.
Some other researchers formulated quantization policy optimization as a search problem and addressed it using a Markov Decision Process through reinforcement learning (Wang et al., ; Lou et al., ; Elthakeb et al., ) and a differentiable search process employed Neural Architecture Search algorithms (Wu et al., ; Guo et al., ).
As Table 1 shows, ARQ outperformed HAQ (Wang et al., ) and LIMPQ (Tang et al., ), which are state-of-the-art mixed-precision quantization methods.

**Table 5: Comparison of various robustness-aware model reduction methods. Model Reduction Method: P – Pruning; Q – Quantization; MPQ – Mixed-Precision Quantization. Stage: T – Training; PT – Post-training (tuning). Scale: Largest supported data-set.**
| Approach | Properties |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Empirical<br>robustness | RS | Other determ.<br>approach | Approx.<br>Method | Stage | Scale |  |
| ARQ (this work) |  | ✓ |  | MPQ | PT | ImageNet |
| \hdashlineATMC  Gui et al. () | $\checkmark$ |  |  | Q | T | CIFAR-100 |
| DQ Lin et al. () | $\checkmark$ |  |  | Q | T | CIFAR-10 |
| GRQR  Alizadeh et al. () | $\checkmark$ |  |  | Q | PT | ImageNet |
| ICR  Lin et al. () |  | $\checkmark$ |  | Q | T | Caltech-101 |
| QIBP  Lechner et al. () |  |  | $\checkmark$ | Q | T | CIFAR-10 |
| ARMC  Ye et al. () | $\checkmark$ |  |  | P | T | CIFAR-10 |
| QUANOS Panda () | $\checkmark$ |  |  | MPQ | PT | CIFAR-100 |
| Stochastic-Shield  Qendro et al. () | $\checkmark$ |  |  | Q | PT | CIFAR-10 |
| HYDRA Sehwag et al. () | $\checkmark$ | $\checkmark^{*}$ | $\checkmark^{*}$ | P | PT | ImageNet |
| TCR Sehwag et al. () | $\checkmark$ |  |  | P | PT | CIFAR-10 |
| DNR Kundu et al. () | $\checkmark$ |  |  | P | T | Tiny-ImageNet |
| HMBDT  Giacobbe et al. () |  |  | $\checkmark$ | Q | PT | MNIST |
| TCMR Weng et al. () |  |  | $\checkmark$ | Q | PT | CIFAR-10 |

Robustness of Quantized Models.
As illustrated in Table 5, ARQ stands out by being the only approach that combines mixed-precision quantization with post-training optimization to achieve certified robustness on large-scale datasets like ImageNet. This distinguishes our work from other approaches that either focus only on pruning (which removes over 90% of the weights) and often target smaller datasets. Although ICR (Lin et al., ) has explored quantization methods with RS, ARQ focuses on post-training optimization instead of quantization-aware training and we demonstrated it can scale to ImageNet. HYDRA (Sehwag et al., ) analyzes pruning methods with RS but only scales to CIFAR-10 for RS and is hard to transfer to quantization methods.

Several methods were introduced to address the complementary challenge of training DNNs on security-critical and resource-limited applications. Gui et al. () integrated various existing compression techniques into a unified optimization framework.
Lin et al. () and Alizadeh et al. () presented how controlling the magnitude of adversarial gradients can be used to construct a defensive quantization method. Finally, empirical robustness approaches can improve best-effort robustness only to some kinds of adversarial inputs (Raghunathan et al., ; Li et al., ).
Ugare et al. (; ) focuses on fast incremental certification with deterministic techniques but not on optimizing the DNN.

## 7 Conclusion and Limitations

Conclusion. We introduce ARQ, the first mixed-precision quantization framework that optimizes both DNN’s accuracy and certified robustness by limiting the computational resource budget. By using direct feedback from the ACR of the quantized smoothed classifier, ARQ more effectively searches for the optimal quantization policy. Our experiments demonstrate that ARQ consistently outperforms state-of-the-art quantization methods, often reaching or improving the accuracy and robustness of the original FP32 networks with down to 0.84% operations. ARQ significantly reduces the computational resource requirements of randomized smoothing, making it possible to deploy it in resource-constrained environments while providing certifiable robustness guarantees.

Limitations. We showed that ARQ can achieve well-quantized DNNs that match or even surpass the accuracy and robustness of the original DNNs with floating-point weights.
However, these properties are still dependent on the training of the original network, which should be trained with Gaussian augmentation to ensure the quantized network performs well.
Deploying DNNs with mixed-precision inference can be more challenging compared to the fixed-precision methods, however, recent works aim to address this issue (Sharma et al., ).
The current implementation of ARQ has been evaluated solely on image classification tasks.
In the future, we plan to investigate how ARQ performs on other complex tasks such as object detection and natural language processing.

### Reproducibility Statement

We provide the source code and configuration details necessary to reproduce our experimental results. Detailed descriptions of the hyperparameters used in our experiments are provided in Section 4, and the pseudocode for ARQ algorithms is described comprehensively in Section 3.2. The code is available at the anonymous GitHub link provided at the end of Section 4.

## Appendix A Appendix

### A.1 The Deep Deterministic Policy Gradient (DDPG) algorithm

DDPG learns a Q-function and a policy concurrently. It uses off-policy data and the Bellman equation to learn the Q-function, and then uses the Q-function to learn the policy.

Algorithm 2 (Achiam, ) shows the DDPG algorithm. In some RL search-based mixed-precision quantization methods, DDPG is utilized to search for the optimal quantization policy. The environment is usually set to be the DNN itself, state $s$ is usually set to be the configuration of one layer in the DNN, the action $a$ is the continuous value that can be transformed into the bit-width for the layer, and $r$ is the reward set to be the accuracy of the DNN and computed only after all actions have been taken. The reward for all actions in one episode is set to the final accuracy gained. The agent updates only when all actions have been taken and the reward is obtained. The experiences are stored in replay buffer $D$ and randomly sampled in batch $B$ for updating the Q-function, policy network, and the target network of the agent.

Figure: Algorithm 2 Deep Deterministic Policy Gradient

### A.2 Ablation Study: The quantization policies for different layers

Figure: Figure 2: Quantization policy among different $\sigma$s for ResNet-50 on ImageNet. The x-axis represents the layer index, and the y-axis represents the bit-width selection in the quantization policy for each specific layer. The $\bullet$ symbol represents the bit-widths for weights, and the $\times$ symbol represents the bit-widths for activations.
Refer to caption: x5.png

Figure 2 illustrates the significance of generating different quantization policies for different values of $\sigma$. The quantization policy for $\sigma=0.25$ is more aggressive in the first half of the layers and more conservative in the later layers. This pattern is different from that of $\sigma=0.5$ and $\sigma=1.0$, where the policy tends to make more adjustments in the first half and remains stable in the latter half.

### A.3 Ablation Study: The effect of the number of epochs in fine-tuning

Due to the limitation of computational resources, we only conducted fine-tuning for 10 epochs in our experiments. Table 6 shows the results of further fine-tuning for a total of 90 epochs. The trends in ACR and clean accuracy followed the same pattern as observed during the initial 10 epochs, demonstrating the effectiveness of our work.

**Table 6: Experiments for ResNet-20 on CIFAR-10. The Epochs here indicates the number of epochs used for fine-tuning. The rest of Formats are similar to Table 1**
| Method | GBitOPs | $\text{Epochs}=90$ | $\text{Epochs}=10$ |  |  |
| --- | --- | --- | --- | --- | --- |
| ACR | Acc | ACR | Acc |  |  |
| ARQ | 0.354 | 0.545 | 67.6 | 0.530 | 67.2 |
| \hdashlineLIMPQ | 0.361 | 0.535 | 67.0 | 0.514 | 65.0 |
| HAQ | 0.365 | 0.534 | 66.8 | 0.518 | 66.4 |
| PACT | 0.362 | 0.524 | 66.6 | 0.508 | 65.8 |

## Peer Reviews

confidence: 2
contribution: 4
initial_rating: 8
presentation: 4
questions: How might the ARQ framework be adapted for sequence models or transformers, particularly regarding the interaction between attention mechanisms and mixed-precision quantization?
What modifications to the incremental randomized smoothing approach might be necessary to support other certification methods while maintaining computational efficiency?
How does the framework handle the transition between different precision levels during inference, and what are the implications for hardware implementation?
Could the reinforcement learning approach be extended to dynamically adjust precision levels during inference based on input characteristics?
soundness: 4
strengths: The use of average certified radius as an optimization objective is particularly novel, allowing simultaneous optimization of accuracy and robustness.
The quality of the research is evident in the comprehensive experimental validation across multiple architectures and datasets. The authors provide ablation studies and comparative analysis which gives valuable insights into the framework's behavior and advantages. The achievement of matching or exceeding full-precision performance with drastically reduced computational requirements is particularly impressive.
summary: The paper introduces ARQ (Accurate and Robust Quantization), a framework that addresses the critical challenge of deploying deep neural networks in resource-constrained environments while maintaining both accuracy and robustness. The framework's key innovation lies in its novel approach to mixed-precision quantization that directly optimizes for certified robustness, making it the first of its kind in the field. Through a sophisticated combination of reinforcement learning and randomized smoothing, ARQ achieves remarkable efficiency gains while preserving or even improving model performance compared to full-precision networks.
weaknesses: While the paper's contributions are substantial, there are areas that could benefit from further exploration. The current focus on convolutional neural networks and image classification, while well-executed, leaves open questions about generalization to other architectures and tasks. This limitation is acknowledged by the authors, but additional discussion of potential adaptation strategies would be valuable.
The paper would benefit from more detailed analysis of memory usage patterns during training, though the runtime analysis provided in Table 2 is helpful. Additionally, while the framework's theoretical foundations are strong, more discussion of practical hardware implementation considerations for mixed-precision inference would strengthen the work's immediate applicability.

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 2
questions: 1. What is the definition of robustness for MPQ?
2. What is certified robustness?
3. In your paper, you argue that traditional quantization methods have primarily concentrated on maintaining neural network accuracy, this is not accurate. The goal of MPQ is to study how to reduce the network's parameters, namely, obtaining the trade-off between accuracy and complexity. They have at least two objectives to learn.
4. Why use reinforcement learning?
5. In your paper, you state two objectives, i.e.,  accuracy, and robustness. Why not consider complexity? Maybe you don't understand the MPQ.
soundness: 2
strengths: The paper is easy to read.
summary: The paper introduces ARQ, a novel mixed-precision quantization framework for executing deep neural networks (DNNs) on resource-constrained platforms while maintaining accuracy and certified robustness. ARQ employs reinforcement learning to find quantization policies that preserve a DNN's accuracy, enhance its robustness, and reduce computational costs, effectively utilizing random smoothing for guidance. The framework supports mixed-precision quantization, allowing different bit-widths for weights in each layer, providing fine-grained control over quantization policies. ARQ is the first to optimize for certified robustness in DNNs and includes random smoothing within its reinforcement learning loop. Experimental results on CIFAR-10 and ImageNet datasets demonstrate that ARQ outperforms state-of-the-art quantization techniques, often matching or exceeding the performance of original FP32 networks with significantly reduced operations. The paper acknowledges ARQ's limitations, such as dependence on the training of the original network and challenges in deploying mixed-precision inference, and suggests future work on applying ARQ to tasks beyond image classification.
weaknesses: 1.	The performance of ARQ is heavily reliant on the quality of the training of the original DNN. If the original network is not properly trained or lacks Gaussian augmentation, the quantized network may not meet expected performance.
2.	ARQ has only been evaluated on image classification tasks. Its performance and effectiveness on other types of tasks have not been validated.
3.	While ARQ performs well in the experiments, its generalizability across different network architectures and datasets remains an open question and requires further research for validation.
4.	The performance of ARQ may be sensitive to hyperparameter choices, which could require additional tuning efforts to ensure optimal performance across different networks and datasets.
5. The presentation of the paper is poor. For examples, the statement of robustness is not clear, adversarial inputs or what? If it is adversarial inputs, why not provide the details for adversarial methods? PGD or FGSM? 
6. The method is not novel, and too complex. The results are also not convincing.
7. The main limitations are experiments, i.e., more datasets (COCO2017, VOC), more larger networks (e.g., VIT, GPT-2, Efficientnet), more tasks (detection, segmentation, VQA), and more validation for robustness.
8. Why not compare with more competitors[1-3]? 
[1] SDQ: Stochastic Differentiable Quantization with Mixed Precision
[2] EMQ: Evolving Training-free Proxies for Automated Mixed Precision Quantization
[3] OMPQ: Orthogonal Mixed Precision Quantization

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 3
questions: Please refer to the weakness for questions.
soundness: 2
strengths: ARQ has better accuracy and robustness, i.e., ACR, than other compared methods.
summary: This paper introduces a mixed-precision quantization framework ARQ which optimizes both DNN’s accuracy and certified robustness under computational resource constraint. ARQ employs reinforcement learning to optimize quantization policies and leverage incremental randomized smoothing (IRS) within the reinforcement learning loop, allowing it to efficiently guide the search for quantization policies that maximize the average certified radius (ACR) of the DNN.
weaknesses: 1. The authors didn’t compare ARQ with any robustness-aware quantization methods as listed in Table5.
2. The authorsdidn’t compare with other advanced fixed-precision or mixed-precision quantization algorithms, such as LSQ[1], LSQ+[2], or HAWQ[3][4].
3. Although ARQ has better accuracy and robustness, it consumes much longer time than other methods as shown in Table2. What is the impact of search time on the final accuracy.
4. The authors only use BitOps as the constraints. What about the model size?  
5. The techniques proposed in the paper seem incremental. The authors need to provide more explanation on the novelty of the method.

[1] Esser S K, McKinstry J L, Bablani D, et al. Learned step size quantization[J]. arXiv preprint arXiv:1902.08153, 2019.
[2] Bhalgat Y, Lee J, Nagel M, et al. Lsq+: Improving low-bit quantization through learnable offsets and better initialization[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops. 2020: 696-697.
[3] Dong Z, Yao Z, Arfeen D, et al. Hawq-v2: Hessian aware trace-weighted quantization of neural networks[J]. Advances in neural information processing systems, 2020, 33: 18518-18529.
[4] Yao Z, Dong Z, Zheng Z, et al. Hawq-v3: Dyadic neural network quantization[C]//International Conference on Machine Learning. PMLR, 2021: 11875-11886.

---

confidence: 5
contribution: 3
initial_rating: 5
presentation: 4
questions: See the weaknesses above.
soundness: 3
strengths: 1. Strong motivation: Modern quantization techniques, even though they show less quality drop on specific models and tasks, show large quality drop on adversarial inputs which means reduced robustness of quantized network. This work targets the problem of making quantization technique which makes truly optimized network with high robustness that can widely adopted on the overall models.
2. Well explained background.
3. Novelty of methodology: Although ARQ adopts most of its robustness concept from existing works, its own optimization objective of mixed precision quantization is unique since many existing works haven’t explored the robustness in terms of utilizing diverse bit-width in a model.
summary: This paper introduces ARQ, a mixed-precision quantization framework for deep neural networks that focuses on robustness of quantization technique. ARQ incorporates robustness certification techniques directly into the quantization process, addressing the limitations of conventional methods that solely focus on accuracy. It leverages randomized smoothing to estimate the certified radius, which reflects the network's resilience to input perturbations. ARQ frames the quantization problem as a reinforcement learning task, where an agent searches for optimal bit-width assignments for each layer, maximizing the average certified radius while adhering to resource constraints.
weaknesses: 1. Weak baseline: Beyond robustness aware mixed precision quantization, there are several methods [1,2,3] that shows much less accuracy degradation on both ResNets and Mobilenets in Imagenet scale. What is the comparative advantage of ARQ compared to these methods even with accuracy degradation? For thorough comparison, shouldn't the authors include comparisons with various types of mixed precision quantization method?
2. Comparison with existing robustness aware MPQ: Within robustness aware quantization, the current metrics cannot justify the benefit of ARQ in the aspect of robustness compared to existing robustness aware MPQ (in Table5).
3. Algorithm: Lack of explanation of several terms in Algorithm1 makes bad readability, i.e., FullRobustCertify, IncrementalRobustCertify.

[1] Huang, Xijie, et al. "SDQ: Stochastic differentiable quantization with mixed precision." International Conference on Machine Learning. PMLR, 2022.

[2] Kim, Han-Byul, et al. "MetaMix: Meta-state Precision Searcher for Mixed-precision Activation Quantization." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 38. No. 12. 2024.

[3] Shin, Juncheol, et al. "NIPQ: Noise proxy-based integrated pseudo-quantization." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

Meta-review: This paper introduces ARQ, a mixed-precision quantization (MPQ) framework that optimizes accuracy and certified robustness for deep neural networks (DNNs) under resource constraints. ARQ employs reinforcement learning to determine optimal bit-width assignments across layers, with incremental randomized smoothing guiding the optimization process to maximize the average certified radius (ACR). The framework demonstrates strong results, matching or exceeding the performance of full-precision models while significantly reducing computational requirements. Reviewers commend ARQ's motivation, clear presentation, and novel focus on robustness in MPQ, particularly the integration of robustness certification into the quantization process. However, concerns are raised regarding limited experimental validation beyond image classification tasks, weak comparisons with advanced MPQ methods, and the lack of evaluations on more diverse datasets, architectures, and tasks. Additionally, the reliance on reinforcement learning and the absence of clarity on specific algorithmic details are criticized. While the contributions are notable, the incremental nature of the method and insufficient comparisons with state-of-the-art techniques leave the paper below the acceptance threshold for most reviewers.

Decision: Reject