Sparsity Meets Robustness: Channel Pruning for the Feynman-Kac Formalism Principled Robust Deep Neural Nets
Authors: Thu Dinh*
Bao Wang*
Andrea L. Bertozzi
Stanley J. Osher
Jack Xin
Venue:  (2020)
Keywords: Sparse Network
Model Compression
Adversarial Training

Abstract: Deep neural nets (DNNs) compression is crucial for adaptation to mobile devices. Though many successful algorithms exist to compress naturally trained DNNs, developing efficient and stable compression algorithms for robustly trained DNNs remains widely open. In this paper, we focus on a co-design of efficient DNN compression algorithms and sparse neural architectures for robust and accurate deep learning. Such a co-design enables us to advance the goal of accommodating both sparsity and robustness. With this objective in mind, we leverage the relaxed augmented Lagrangian based algorithms to prune the weights of adversarially trained DNNs, at both structured and unstructured levels. Using a Feynman-Kac formalism principled robust and sparse DNNs, we can at least double the channel sparsity of the adversarially trained ResNet20 for CIFAR10 classification, meanwhile, improve the natural accuracy by 8.69\% and the robust accuracy under the benchmark 20 iterations of IFGSM attack by 5.42\%.

Under review as a conference paper at ICLR 2020
SPARSITY MEETS ROBUSTNESS: CHANNEL PRUNING FOR THE SYYMMAN-KAC FORMALISM PRINCIPLED ROBUST DEEP NEURAL NETS
Anonymous authors Paper under double-bling review
ABSTRACT
Deep neural nets (DNNs) compression crucial for adaptation mobile devices. Though many successful algorithms exist to compress naturally trained DNNs. developing efficient and stable compression algorithms for robustly trained DNNs remains widely open. In this paper, we focus on co-design of efficient DNN com- pression algorithms and sparse neural architectures for robust and accurate deep learning. Such co-design enables to advance the goal of accommodating both sparsity and robustness. With this objective in mind, we leverage the relaxed aug- mented Lagrangian based algorithms prune the weights of adversarially trained DNNs, at both structured and unstructured levels. Using a Feynman- formal- ism principled robust and sparse DNNs, can at least double the channel sparsity of the adversarially trained ResNet20 for CIFAR 10 classification, meanwhile, im- prove the natural accuracy by 8.69% and the robust accuracy under the benchmark 20 iterations of IFGSM attack by 5.42%.
INTRODUCTION
Robust deep neural nets (DNNs) compression is fundamental problem for secure AI applications in resource-constrainee environments such as biometric verification and facial login on mobile devices, and computer vision tasks for the internet of things (IoT) (Cheng et al. 2017: Yao al., 2017] Mohammadi et al., 2018). Though compression and robustness have been separately addressed in recent years, much less is studied when both players present and must be satisfied.
To date, many successful techniques have been developed to compress naturally trained DNNs, in- cluding neural architecture re-design searching (Howard et al., al.,2211 2017 [Zhan al. (018b), pruning
including structured (weights sparsification) (Han et al. 2015 Srinivas & Babu (015) and unstruc-
tured (channel-, filter-, layer-wise sparsification) (Yang al. 2019 He et 2017). quantization
(Zhou et al., 2017 Yin et al. 2019 Courbariaux et al. 2016). low-rank approximation (Denil et al.,
2013). knowledge distillation (Polino 2018)) and many more (Alvarez & Salzmann 2016 Liu
et al. 2015).
Percent
20.0%
Percent
20.0%
10.0%
10.0%
0.0%
0.0%
-0.25
0.00
0.25
0.25
0.25
Value
Value
NT
(b)
Figure Histograms of the ResNet20's weights.
The adversarially trained (AT) DNN is more robust than the naturally trained (NT) DNN to adver- sarial attacks (Madry et al.] 2018 Athalye et al. 2018). However, adversarial training (denoted as AT if no ambiguity arises, and the same for NT) also dramatically reduces the sparsity of the trained DNN's weights. As shown in Fig. I start from the same default initialization in PyTorch, the NT ResNet20's weights much sparser than that of the AT counterpart, for instance, the percent of

---

Under review as a conference paper at ICLR 2020
weights that have magnitude less than 10-3 for NT and AT ResNet20 are 8.66% and 3.64% (aver- aged over 10 trials), resp. This observation motivates us to consider the following two questions:
1. Can we re-design the neural architecture with minimal change on top of the existing one such that the new DNN has sparser weights and better robustness and accuracy than the existing one?
2. Can we develop efficient compression algorithms to compress the AT DNNs with minimal robustness and accuracy degradations?
We note that under the AT, the recently proposed Feynman- Kac formalism principled ResNet ensem- ble (Wang et al., (2019)) has much sparser weights than the standard ResNet, which gives a natural answer to the first question above. To answer the second question, laxed augmented Lagrangian based sparsification algorithms (Dinh & Xin) 2018) Yang et al. (219)) perform both structured and unstructured pruning for the AT DNNs. and channel pruning in this work.
leverage state-of-the-arr
We focus on unstructured
1.1 NOTATION
Throughout this paper we use bold upper-case letters A, denote matrices, bold lower-case letters 2, to denote vectors, and lower case letters I, and 3 to denote scalars. For vector
we use ||>|| = ||ح|| = V 2 +... z to represent its f2-norm; ||æ]|| = EL |2,| to represent its norm: and ||>||| E X(=;70) to represent its no-no.. For function f Rd - I. we use V-(-) to denote its gradient. Generally, w represents the set of all parameters of the network being discussed at iteration t, c.g. w = (wi, wh .... w where w the weight on the jth layer the network at the 1-th iteration. Similarly, u' (uf, ub ... u is a set of weights with the same dimension as w', whose value depends w and will be defined below. We use A(, laxd) to represent the d-dimensional Gaussian, and use notation (-)) to hide only absolute constants which do not depend any problem parameter.
-I1,,..,,z.
1.2 ORGANIZATION
This paper is organized in the following way: In section we list the most related work to this paper. In section B] we show that the weights of the recently proposed Feynman-Kan formalism principled ResNet ensemble are much sparser than that of the baseline ResNet, providing greater efficiency for compression. In section 4 present relaxed augmented Lagrangian- with theoretical analysis for both unstructured and channeling pruning of AT DNNs. The numerical results are presented in section [5] followed by concluding remarks. Technical proofs and more related results are provided in the appendix.
algorithms along
RELATED WORK
Compression of AT DNNs: Gui et al. (2019) considered low-rank form of the DNN weight matrix with to constraints on the matrix factors in the AT setting. Their training algorithm is a projected gradient descent (PGD) (Madry et al.) 2018) based on the worst adversary. In their paper, the sparsity matrix factors are unstructured and require additional memory.
Sparsity and Robustness: Guo et al. (2018) shows that there is relationship between the sparsity of weights in the DNN and its adversarial robustness. They showed that under certain conditions, sparsity can improve the DNN's adversarial robustness. The connection between sparsity and ro- bustness has also been studied recently by Ye et al. (2019), Rakin al. (2019), and et al. our paper, focus on designing efficient pruning algorithms integrated with sparse neural architec- tures to advance DNNs sparsity, accuracy, and robustness.
Keynman-Kac formalism principled Robust DNNs: Neural ordinary differential equations (ODEs) (Chen et al.) 2018) are a class of DNNs that use an ODE to describe the data flow of each input data. Instead of focusing (2019a) 2018a): Li & Shi (2077) use a transport equation (TE) to model the flow for the whole input distribution. In particular, from the TE viewpoint, Wang al. 2019a) modeled training ResNet (He
modeling the data flow of each individual input data, Wang et al.
2

---

Under review as a conference paper at ICLR 2020
al. 2016 as finding the optimal control of the following TE
du (a, t) G( mn))) Vu(æ, t) = 0, x E ERR u( 1) g(x), E Rdd u u( 0) Vs. x; ET, with T being the training set.
where G( wt)) encodes the architecture and weights of the underlying ResNet, u( 0) serves as the classifier, g (z) is the output activation of ResNet, and is the label of x,,
Wang et al. (2019a) interpreted adversarial vulnerability of ResNet arising from the irregularity of u(2, 0) of the above TE. To enhance u (z, 0)'s regularity, they added a diffusion term, 1 Au(x, t), which resulting in the convectionddiffusion equation (CDE). By the Feynman-Kaa Kac formula, u(x, 0) of the CDE can be approximated by the following two steps:
the governing equation
Modify ResNet by injecting Gaussian noise to each residual mapping.
Average the output of jointly trained modified ResNets, and denote En, ResNet.
Wang et al. (2019a) have noticed that EnResNet can improve both natural and robust accuracies of the AT DNNs. In this work, we leverage the sparsity advantage EnResNet to push the sparsity limit of the AT DNNs.
3 REGULARITY AND SPARSITY OF THE FEYNMAN-KA -AC FORMALISM PRINCIPLED ROBUST DNNS' WEIGHTS
From a partial differential equation (PDE) viewpoint, a diffusion term to the governing equation 11) not only smooths u( a(2:00 0), but can also enhance regularity of the velocity field G(æ, w(t)) Ladyženskaja et al., 1988). As a DNN counterpart, we expect that when we plot the weights of randomly select layer, the pattern of the former one will look smoother than the latter one. To validate this, we follow the same AT with the same parameters as that used in [Wang et al. 2019a to train EngResNett
EnResNet and ResNet
and ResNet20, resp. After the above two robust models are trained, we randomly select and plot the weights of a convolutional layer of ResNet20 whose shape is 64 x 64 3 x and plot the weights the same layer of the first ResNet20 in Eng ResNet20. As shown in 2 and (b), most of Eng ResNet20's weights are close to 0 and they are more reg- ularly distributed the sense that the neighboring weights are closer to each other than ResNer20's weights. The complete visualization of this randomly selected layer's 's weights is shown in the ap- pendix. As shown in Fig. (c) and (d). the weights of EngResNet22 are more concentrated at zero than that of ResNet20, and most of the Eng
weights are close to zero.
10 20 30 40 50 60
D 20 AU 30 60
0.04
0.03
10
10
20
30
0.10
0.05
20
0.01
20.0%
40
0.00
40
-0.01
60
-0.00
60
-0.03
0.0%
0.0%
(a) ResNet20 (AT)
(b) EngResNet20 (AT)
(c) ResNet20 (AT)
(d) Eng ResNet0 (AT)
Figure (a) and (b): weights visualization; (c) and (d): histogram of weights.
4
UNSTRUCTURED AND CHANNEL PRUNING WITH AT
4.1 ALGORITHMS
In this subsection, we introduce relaxed, augmented Lagrangian-based, pruning algorithms to spar- sify the AT DNNs. The algorithms of interest the Relaxed Variable-Spliting Method (RVSM) (Dinh & Xin 2018) for weight pruning (Algorithm []. and its variation, the Relaxed Group-wise
Splitting Method (RGSM) YYng et al.) 2019) for channel pruning (Algorithm (
Our approach is to apply the RVSM/RGSM algorithm together with robust PGD training to train and sparsify the model from scratch. Namely, at each iteration, we apply PGD attack generate
3

---

Under review as a conference paper at ICLR 2020
adversarial images x', which are then used in the forward-propagation process to generate predi- tions y'. The back- proppppopngttion process will then compute the appropriate loss function and apply RVSM/RGSM to update the model. Previous work on RVSM mainly focused on one-hidden layer setting; In this paper, we extend this result to the general setting. To the best of our knowledge, this is the first result that uses RVSM/RGSM in adversarial training scenario.
To explain our choice of algorithm, we discuss a classical algorithm to promote sparsity of the target weights, the alternating direction of multiplier method (ADMM) (Boyd al. 2011] Goldstein & -Osher 2009). In ADMM, instead of minimizing the original loss function ((w), we seek to minimize the E regularized loss function, f(w) + A/|ee/11. by considering the following augmented Lagrangian
[(w, u, x) = f(w) + A l|ull/2 + (z. w - u) + B w|w ull 1,320 O.
(2)
2
which can be easily solved by applying the following iterations
w +- arg mitl.r L u², z²) utt1= arg ming fuww++ u, =*) z141 < z' +++3((0(1-00 -
(3)
Although widely used in practice, ADMM has several drawbacks when it is used to regularize DNN's weights. First, one can improve the sparsity of the final Iearnd weights by replacing ||u/| with w wlll: but ||- llo is not differentiable, thus current theory of optimization does not apply (Wang et al. 2018b). Second, the update w'+1 arg min La (wn, u', 2²) is not reasonable step in practice, as one has to fully know how f(w) behaves. In most ADMM adaptation on DNN, this step replaced by a simple gradient descent. Third, the Lagrange multiplier term, (z, w u), seeks to close the gap between w' and u', and this in turn reduces sparsity of u'.
The RVSM we will implement is relaxation of ADMM. RVSM drops the Lagrangian multiplier, and replaces A//zu|12 with Al| [|/u/lo. lo. and resulting in the following relaxed augmented Lagrangian
3 Ls(w, u) = f(w) + A ||2//o + 2 |lw-ull
44)
The above relaxed augmented Lagrangian can be solved efficiently by the iteration in Algo- rithm 1. RVSM can resolve all the three issues associated with ADMM listed above in train- ing robust DNNs with sparse weights: First, by removing the linear term (z. w u). one has a closed form formula for the update of ut without requiring [/uallo to be differentiable. Explic- itly, n² H /227p(m')) (w=) (uff( (11((111>>/////1)) ". W'XX (11/)>/22//)>>> ). where H.)-) is the hard-
thresholding operator with parameter a. Second, the update of w" is gradient descent step itself, so the theoretical guarantees will not deviate from practice. Third, without the Lagrange multiplier term 2", there will be gap between w" and u' the limit (finally trained DNNs). However, the limit of u is much sparser than that in the case of ADMM. At the end of each training epoch, we re- place w by u' for the validation process. Numerical results in Section wiil show that the AT DNN with parameters ut usually outperforms the traditional ADMM in both accuracy and robustness.
Algorithm 2 RRGMM
Input: 8, \ı, d2. maFeppoc maDbatch Objective: f(w) = f(w) + X2 |Wl|G
Algorithm RVSM
Input: B, X, maIepoch. MaZbatch
Initialization: Initialize wa, define u
Initialization: w
for g = 1, ..... do
Define: ud H
/22/3/// (w
u Proxx, (2))
end for
fort= =0 ..., max spoch do
for 1= 0, 1, ..., Ma.epach do
for batch 1, 2, ..., maThatch do
for batch = 1, 2, ma.batch do
w++ - w' V f(w') mm(ww' 22)
wi+1 = w u 1 -u') u²)
u'-1 + arg min, L3 (u, w²) = H.
/ 22/3 (w')
for g 2, G do
end for end for
u+11 = Proxx, (w))
end for
end for
end for
4

---

Under review as a conference paper at ICLR 2020
RGSM is method that generalizes RVSM structured pruning, in particular, channel pruning. Let w = (w..... wg...., WG be the grouped weights of convolutional layers of a DNN, where is the total number of groups. Let I be the indices of in group g. The group Lasso (GLasso) penalty
and group-& penalty (Yuan & Lin 2007) are defined as
||w =
k 1l2
| =
1 l12
(5)
and the corresponding Proximal (projection) operators are
Proxet.A(Wgg) == -gg( max(] X, 0),
Prox (wg) :- Wyy ww, /
(6)
where sgn(w,) / w 112- The RGSM method is described in Algorithm 2 which improves
on adding group Lasso penalty directly in the objective function (Wen et al. 2016 for natural DNN training Yang et al. 2019).
4.2 THEORETICAL GUARANTEES
We propose convergence analysis of the RVSM algorithm to minimize the Lagrangian sider the following empirical adversarial risk minimization (EARM)
Con-
min JEH 71
max 2.
L(F(a,, w),
(7)
where the classifier F(, w) is a function in the hypothesis class H. c.g. ResNet and its ensembles, parametrized by w. Here, ((F(xx, w), y1) is the appropriate loss function associated with F on the data-label pair (æt y/). e.g. cross-entropy for classification and root mean square error for regression problem. Since our model is trained using PGD AT, let
f(w) ( max L(F(2', w).
(8)
where x' is obtained by applying the PGD attack the clean data x (Wang al. 2019a Goodfellow et al. 2014a Madry et al. 2018 Na et al. 2018). In nutshell, f(w) is the population adversarial loss the network parameterized by w (1, u2, ... w.s). Before proceeding, we first make the following assumption:
Let w1, W....., was be the weights in the M layers of the given DNN, then there exists a positive constant such that for all t,
Assumption 1.
VV((, w Vf(, w', ( ))l s LIlwst1 will, for j 1,,, M.
Assumption T is a weaker version of that made by Wang al. (019b): Sinha al. (2018) which
the empirical adversarial loss function is smooth in both the input æ and the parameters w. Here we only require the population adversarial loss f be smooth in each layer of the DNN in the region of iterations. An important consequence of Assumption
[6, (. ((,),, (V))) w/ w w/ O,...) + 100
1 -w,ll" (10)
7 suppose also that the RVSM algorithm is initiated with small stepsize y such that 3+L- Then the Lagrangian La(w', u²) decreases monotonically and converges sub-sequentialyy to a limit point (w0 u).
Theorem 1. Under the Assumption
The proof of Theorem 1 is provided in the Appendix. From the descent property of (o ut), classical results from optimization (Nesterov) 2014) can used to show that after T = ((1/2) iterations, we have Va u²) O(e), for some E (0,T). The term ||ua|oo promotes sparsity 2
and _ | - ual helps keep w close to u. Since u. H 22 (w), follows that tp will have lots
of very small (and thus negligible) components. This result justifies the sparsity in the limit
5

---

Under review as a conference paper at ICLR 2020
5 NUMERICAL RESULTS
In this section, we verify the following advantages of the proposed algorithms:
RVSM/RGSM is efficient for unstructureed/channee--wiss pruning for the AT DNNs.
After pruning by RVSM and RGSM, EnResNet's weights are significantly sparser than the base- line ResNet's, and more accurate in classifying both natural and adversarial images.
These two merits lead to the fact that synergistic integration of RVSM/RGSM with the Feynman- Kac formula principled EnResNet enables sparsity to meet robustness.
We perform AT by PGD integrated with RVSM, RGSM, or other sparsification algorithms on-the- fly. For all the experiments below, we rum 200 epochs of the PGD (10 iterations of the iterative fast gradient sign method (IFGSM with 2/255 and 8/255, and an initial random perturbation of magnitude c). The initial learning rate of 0.1 decays by a factor of 10 at the 80th, 120th, and 160th epochs, and the RVSM/RGSM/ADDM sparsification takes place in the back- proppgaattt stage. We split the training data into 45K/5K for training and validation, and the model with the best validation accuracy is used for testing. We test the trained models on the clean images and attack them by FGSM, IFGSM20 and C&W W with the same parameters as that used in (Wang et al. 2019a Zhang al. 2019 Madry et al., 2018). We denote the accuracy on the clean images and under the FGSM, 1FGSM20 (Goodiellow et al. 2014b)) C&W (Carlini & Wagner 2016). and NAttack (Li et al. 2019)
attacks as A1, A2. A3, A4. and As, resp. brief introduction of these attacks is available in the appendix. We use both sparsity and channel sparsity to measure the performance of the pruning algorithms, where the sparsity defined to be the percentage of zero weights; the channel sparsity is the percentage of channels whose weights' l norm is less than 1E- 15.
5.1 MODEL COMPRESSION FOR AT RESNET AND ENRESNETS
First, we show that RVSM is efficient to sparsify ResNet and EnResNet. Table I shows the accu- racies of ResNer20 and EnsRe20 under the unstructured sparsification with different sparsity controlling parameter B. We see that after the unstructured pruning by RVSM, Eng has much sparser weights than ResNet20. Moreover, the sparsified En, is remarkably more ac- curate and robust than ResNet20. For instance, when 3 = 0.5, EnyResSet20's weights are 16.42% sparser than ResNet20's (56.34% vs. 39.92%). Meanwhile, ResNes0 boost the natural and robust accuracies of ResNet20 from 74.08%, 50.64%, 46.67%, and 57.24% to 78.47%, 56.13%. 49.54%, and 65.57% resp. We perform a few independent trials, and the random effects is small.
Table 1: Accuracy and sparsity of ResNet20 and ResNe200 under different attacks and 8 with 1E- 6. (Unit: %, n/a: do not perform sparsification. Same for all the following tables.)
ResNet20
Eny ResNet20
A
A
Ag
A
Sparsity
A
A
As
A
Sparsity
n/a
76.07
51.24
47.25
59.30
0
80.34
57.11
50.02
66.77
0
0.01
70.26
46.68
43.79
55.59
80.91
72.81
51.98
46.62
63.10
89.86
0.1
73.45
49.48
45.79
57.72
56.88
77.78
55.48
49.26
65.56
70.55
0.5
74.08
50.64
46.67
57.24
39.92
78.47
56.13
49.54
65.57
56.34
Second, verify the effectiveness of RGSM in channel pruning. We lists the accuracy and chan- nel sparsity of ResNet20, Rese200,, and Res,ee0 Table 2 Without any sparsification, ResNee20 improves the four type of accuracies by 4.27% (76.07% vs. 80.34%), 5.87% (51.24% vs. 57. 1%). 2.77% (47.25% vs. 50.02%), and 7.47% (59.30% vs. 66.77%). resp. When we set 1, X 5e 2. and X le 5, after channel pruning both natural and robust accuracies of ResNer20 and Nes remain close to the unsparsified models, but Nere20's weights 33, 33.48% (41.48% vs. 8%) sparser than that of ResNet20's. When increase the channel sparsity level by increasing \ to le 1, both the accuracy and channel sparsity gaps between ResNet20 and
For NAttack, we the default
in httpp::/gg.cbb..commmccc///

---

Under review as a conference paper at ICLR 2020
EngResNee220 are enlarged. EnyResNett20 can future improve both natural and robust accuracies top of EnyResNe220. For instance, at ~ 55% (53.36% vs. 56.74%) channel sparsity. Eng ResNet20 can improve the four types of accuracy of EngResNet20 by 4.66% (80.53% 75.87%), 2.73% (57.38% vs. 54.65%), 2.86% (50.63% vs. 47. 47.77%), and 1.1 11 % (66.52% vs. 65.41 %),, resp.
Table Accuracy and sparsity different EnResNet20. (Ch. Sp.: Channel Sparsity)
Net
A
A
A
A3
A4
As
Ch. Sp.
ResNet20
n/a
n/a
n/a
76.07
51.24
47.25
59.30
45,88
0
5.E-02
1.E-05
75.91
51.52
47.14
58.77
45.02
8.00
1.E-01
1.E-05
71.84
48.23
45.21
57.09
43.84
25.33
EngResNet20
n/a
n/a
n/a
80.34
57.11
50.02
66.77
49.35
5.E-02
1.E-05
78.28
56.53
49.58
66.56
49.11
41.48
1.E-01
1.E-05
75.87
54.65
47.77
65.41
46.77
56.74
EngResNet20 n/a
n/a
81.41
58.21
51.60
66.48
50.21
1.E-02
1.E-05
81,46
58.34
51.35
66.84
50.07
19.76
2.E-02
1.E-05
80.53
57.38
50.63
66.52
48.23
53.36
Third, we show that an ensemble of small ResNets via the Feynman-Kac formalism performs better than larger ResNet of roughly the same size in accuracy, robustness, and sparsity. We AT EnyResNet20 (~~ 0.54M parameters) and ResNet38 (~ 0.56M parameters) with and without channel pruning- As shown Table 3] under different sets of parameters, after RGSM pruning, EnyResNer20 always has much more channel sparsity than ResNer38, also much more accurate and robust. For instance, when we set 3 L, λ = 5e - 2, and 0 = 1e 5, the AT ResNet38 and EnzResNet20 with channel pruning have channel sparsity 17.67% and 41.48%, resp. Mcanwhile, EnyResNet20 outperforms ResNet38 in the four types accuracy by 0.36% (78.28% vs. 77.92%), 3.02% (56.53% 53.51%), 0.23% (49.58% vs. 49.35%), and 6.34% (66.56% 60.32%). resp. When we increase Å1. the channel sparsity of two nets increase.. As shown in Fig. EngResNet20's channel sparsity growth much faster than ResNet38's, and we plot the corresponding four types of accuracies of the channel sparsified nets in Fig.
Table 3: Performance of En, Net20 and ResNet38 under RVSM.
Net
A
22
A
A
A3
A
Ch. Sp.
EnaResNet20
n/a
n/a
n/a
80.34
57.11
50.02
66.77
ResNet38
n/a
n/a
n/a
78.03
54.09
49.81
61.72
En.ResNet20
5,E-02
1.E-05
78.28
56,53
49.58
66.56
41.48
ResNet38
5.E-02
1.E-05
77.92
53.51
49.35
60.32
17.67
EngResNet20
1.E-01
1.E-05
76.30
54.65
47.77
65.41
56.74
ResNet38
1.E-01
1.E-05
72.95
49.78
46.48
57.92
43.80
82
58
60
80
56
Res,eeset220
Sparsity
40
ResNet38
78
ResNeeo
54
En, R..RResee22
76
ResNet38
52
ResMet33
20
0.02
0.04
0.06
0.02
0.04
0.06
0
50.5
70
0.02
0.04
0.06
X,
50
65
c 49.5
4
Sparsity of EnsReseet20 and ResNet38 under different parameters
Figure 3:
49
En ResNet22
60
ResNee2
ResNet38
48.5
ResNer38
0.02
0.04
0.06
0.02
0.04
0.06
A
Yy. (5 runs)
Figure Accuracy of Eng ResNet20 and ResNet38 under different parameters A1. (5 runs)

---

Under review as a conference paper at ICLR 2020
Table 4: Contrasting ADMM versus RVSM for the AT ResNet20.
Unstructured Pruning
Channel Pruning
A1
A2
Aa
A4
Sp.
A
A2
Ag
A4
Ch. Sp.
RVSM ADMM
70.26
46.68
43.79
55.59
80.91
71.84
48.23
45.21
57.09
25.33
71.55
47.37
44.30
55.79
10.92
63.99
42.06
39.75
51.90
4.44
5.2 RVSM/RGSM VERSUS ADMM
In this subsection, we will compare RVSM, RGSM, and ADMM (Zhang et al. 2018 for unstruc- tured and channel pruning for the AT ResNet20, and will show that RVSM and RGSM iterations can promote much higher sparsity with less natural and robust accuracies degradations than ADMM. We list both natural/robust accuracies and sparsities of ResNet20 after ADMM, RVSM, and RGSM pruning in Table 4 For unstructured pruning, ADMM retains slightly better natural (~ 1.3%) and robust (~~ 0.7%, 0.5%, and 0.2% under FGSM, IFGSM20 and C& W attacks) accuracies. How- ever. RVSM gives much better sparsity (80.91% vs. 10.89%). In the channel pruning scenario, RVSM significantly outperforms ADMM all criterion including natural and robust accuracies and channel sparsity,
the accuracy gets improved by at least 5.19% and boost the channel sparsity from 4.44% to 25.33%. Part of the reason for ADMM's inefficiency in sparsifying DNN's weights is due to the fact that the ADMM iterations try to close the gap between the weights w and the auxiliary variables u², , so the final result has lot of weights with small magnitude, but not small enough to be regarded zero (having norm less than le-15). The RVSM does not seek to close this gap, instead it replaces the weight w by u', which is sparse, after each epoch. This results in much sparser final result, shown in Figure 5 ADMM does result in lot of channels with small norms; but to completely prune these off, RVSM does better job. Here, the channel norm is defined to be the l norm of the weights in each channel of the DNN (Wen al. 2016).
Count
Count
100
100
#zeros: 171
#zeros: 171
8.0
0.5
1.0
1
2
Ch. norm
Ch. norm 1e-7
(a) RVSM
(b) RVSM (Zoom in)
Count
Count
100
50
#zeros: 30
# #zeros: 30
8.0
0.5 Ch. norm
1.0
2
Ch. norm 1e-7
(d) ADMM (Zoom in) Figure 5: Channel norms the AT ResNet20 under RVSM and ADMM.
(c) ADMM
5.3 BEYOND RESNET ENSEMBLE AND BEYOND CIFAR10
5.4 BEYOND RESNET ENSEMBLE
In this part, we show that the idea of average over noise injected ResNet generalizes to other types of DNNs. that is. the natural and robust accuracies of DNNs can be improved by averaging over noise injections. As proof concept, we remove the skipping connections in ResNet20 and
We the code from: g tht.. com/ Kaiqi
8

---

Under review as a conference paper at ICLR 2020
EnzResNee20, in this case, the model longer involves TE and CDE. As shown in Table removing the skip connection degrades the performance significantly. especially for EnyResNet20 (all the four accuracies of the AT EnyResNet20 reduces more than the AT ResNet20's). These results confirm that skip connection is crucial, without it the TE model assumption breaks down, and the utility of EnResNets reduces. However, the ensemble of noise injected DNNs still improves the performance remarkably.
Table 5: Accuracies of ResNet20 and EnyResNe120 with and without skip connections.
Net
Type
A
A₂
A3
A
ResNer20
Base Net
76.07
51.24
47.25
59.30
Without skip connection
75.45
51.03
47.22
58.44
EnzResNet20
Base net
80.34
57.11
50.02
66.77
Without skip connection
79.12
55.76
49.92
66.26
Next, let consider the sparsity, robustness, and accuracies of ResNet20 and EngResNet20 without any skip connection, when they are AT using weights sparsification by either RVSM or RGSM. For RVSM pruning, we set
5E and À 1E 6; for RGSM channel pruning, we set 3 = 5E 2, A1 = 5E 2. and A = 1E 5. We list the corresponding results in Table We see that under both RVSM and RGSM pruning, Eny ResNet20 is remarkably more accurate on both clean and adversarial images, and significantly sparser than ResNet20. When we compare the results in Table [ with that in Tables [ [ we conclude that once we remove the skip connections, the sparsity, robustness, and accuracy degrades dramatically.
Table 6: Sparsity and accuracies of ResNer20 and RnyResNe120 without skip connection under different pruning algorithms.
Net
Pruning Algorithm
A
Aa
As
A4
Sp.
Ch. Sp.
ResNet20
RVSM
73.72
50.46
46.98
58.28
0.05
0.15
connection)
RGSM
74.63
50.44
46.86
58.05
1.64
9.04
En>ResNet20
RVSM RGSM
76.95
55.17
49.28
58.35
10.87
9.48
(no skip connection)
78.51
56.55
49.71
67.08
7.95
15.48
5.5 BEYOND CIFARIO
Besides CIFAR10, further show the advantage of EnResNet RVSM/RGSM in compressing and improving accuracylrobustness of the AT DNNs for CIFAR100 classification. We list the natural and robust accuracies and channel sparsities of the AT ResNet20 and ResReset with different RGSM parameters (n/a stands for do not perform channel pruning) in Table 7 For A = 0.05, RGSM almost preserves the performance of the DNNs without channel pruning, while improving channel sparsity by 7.11% for ResNet20, and 16.89% for En 0.1, the channel sparsity becomes 18.37% for ResNet20 and 39.2399 29%
As we increase λ to for EngResNe120. Without any channel pruning, RenRes improves natural accuracy by 4.66% (50.68% vs. 46.02%), and robust accuracies by 5.25% (30.2% vs. 24.77%), 3.02% (26.25% vs. 23, 23.23%), and 7.64% (40.06%
32.42%), resp., under the FGSM. 2FGSM20 and C&W attacks. Even in very high channel sparsity scenario (Λ₁ = 0.05), Eng ResNet2 still dramatically increase A,, Ag, A3. and A, by 2.90%, 4.31%, 1.89% and 5.86% resp. These results similar to the obtained the CIFAR 10 in Table 2 These results further confirm that RGSM together with the Feynman- Kac formalism principled ResNets ensemble can significantly improve both natural/robust accuracy and sparsity on top of the baseline ResNets.
6 CONCLUDING REMARKS
The Feynman- Kac formalism principled AT EnResNet's weights are much sparser than the baseline ResNet's. Together with the relaxed augmented Lagrangian based unstruetureddccannel pruning

---

Under review as a conference paper at ICLR 2020
Table 7: Accuracy and sparsity of different Ensembles of ResNet20's the CIFAR100.
Net
3
A
A
A2
A3
A
Ch. Sp.
ResNe120
n/a
n/a
n/a
46.02
24.77
23.23
32.42
5.E-02
1.E-05
45.74
25.34
23.55
33.53
7.11
1.E-01
1.E-05
44.34
24.46
23.12
32.38
18.37
En-ResNet20
n/a
n/a
n/a
50.68
30.2
26.25
40.06
5.F-02
1.F-05
50.56
30.33
26.23
39.85
16.89
1.F-01
1.E-05
47.24
28.77
25.01
38.24
39.23
algorithms, we can compress the AT DNNS much more efficiently, meanwhile significantly improves both natural and robust accuracies of the compressed model. As future directions, propose to quantize EnResNets and to integrate neural ODE into our framework.
10

---

Under review as a conference paper at ICLR 2020
REFERENCES
Jose M Alvarez and Mathieu Salzmann. Learning the number of neurons in deep networks. In Advances in Neural Information Processing Systems, pp. 2270-2278, 2016.
A. Athalye, N. Carlini, and D. Wagner. Obfuscated gradients give false sense of security: Cireum- venting defenses to adversarial examples. arXiv preprint arXiv:1802.00420 2018.
Boyd, N. Parikh, E. Chu, B. Peleato, Eckstein, et al. Distributed optimization and statistical learning via the alternating direction method of multipliers. Foundations and Trends in Machine learning, 3(1):1-122 1222 2011.
N. Carlini and D.A. Wagner. Towards evaluating the robustness of neural networks. IEEE European Symposium Security and Privacy, pp. 39-57, 2016.
T. Chen, Y. Rubanova, J. Bettencourt, and D. Duvenaud. Neural ordinary differential equations. In Advances in neural information processing systems, pp. 6571 3571-6583, 2018
Y. Cheng, D. Wang. P. Zhou, and Zhang. A survey of model compression and acceleration for deep neural networks. arXiv preprint arXiv: 2017.
M. Courbariaux, I. Hubara, D. Soudry, R. El-Yaniv, and Y. Bengio. Binarynet: Training deep neural networks with weights and activations constrained +1 or -1. ArXiv, abs/1602.02830, 2016.
M. Denil, B. Shakibi, L. Dinh, M. Ranzato, and N. de Freitas. Predicting parameters in deep learning. In Proceedings of the 26th International Conference on Neural Information Process- ing Systems Volume NIPS' 13, pp. 2148 2156, USA, 2013. Curran Associates Inc. URL http: / d1. acm. org/ wwt.t//aaaaaattaaaaaaaaaaaaaaaaa wtt.:iittaiion..nnooio...ooo fmm 29997922 2999852
T. Dinh and J. Xin. Convergence of relaxed variable splitting method for learning sparse neural networks via l1 lo. and transformed-4, penalties. arXiv preprint arXiv:1812.05719, 2018
T. Goldstein and S. Osher. The split bregman method for 11-regularized problems. SIAM journal imaging sciences, 2(2):323-343, 2009.
I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. CoRR, abs/1412.6572,, 2014a.
I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and hamessiin adversarial examples. arXiv preprint arXivv1411.6675, 2014b.
Gui, H. Wang, C. Yu, H. Yang, Z. Wang, and J. Liu, Adversarially trained model compression: When robustness meets efficiency. arXiv preprint 19X2vv1902.0000 033383338,... 2019.
Y. Guo, C. Zhang, C. Zhang, and Y. Chen. Sparse dnns with improved adversarial robustness. In Advances in neural information processing systems, pp. 242-251, 2018.
Han, J. Pool, Tran, and W. Dally. Learning both weights and connections for efficient neural network. In Advances in neural information processing systems, pp. 1135-11433 2015.
K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Y. He, X. Zhang, and J. Sun. Channel pruning for accelerating very deep neural networks. In The IEEE International Conference on Computer Vision (ICCV), Oct 2017.
A. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv: 1r.Xiv:7004.000 704604 2017.
O. Ladyženskaja, V. Solonnikov, and N. Ural'ceva. Linear and quasi-linear equations of parabolic type, volume 23. American Mathematical Soc., 1988.
Y. Li, L. Li, L. Wang, T. Zhang, and B. Gong. Nattack: Learning the distributions of adver- sarial examples for an improved black-box attack on deep neural networks. arXiv preprint arXiv: 2019.
11

---

Under review as a conference paper at ICLR 2020
Z. Li and Z. Shi. Deep residual learning and pdes manifold. arXiv preprint 170.:11708.05115, 2017.
B. Liu, M. Wang, H. Foroosh, M. Tappen, and M. Pensky. Sparse convolutional neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 506-814, 2015.
A. Madry, A. Makelov, Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant adversarial attacks. In International Conference Learning Representations, 2018. URL https::///// /tttpp::///perevviii wttp:/wwwnneeo/t/nnnnee/eeem
net ftrmmmrrrmmmmm
M. Mohammadi, A. Al-Fuqaha, S. Sorour, and M. Guizani. Deep learning for iot big data and streaming analytics: survey. IEEE Communications Surveys & Titooials, 20(4),22,3,2660, 2018.
T. Na, Ko, and S. Mukhopadhyay. Cascade adversarial machine learning regularized with a unified embedding. In International Conference Learning Representations, 2018. URL https:
7/ //openreview bnnenreview.net/EEeee wwt/eeeettte htt///orrmmmmo um?id waw.iddyydBBaaaaeeeeaaa
Y. Nesterov. Introductory Lectures on Convex Optimization: A Basic Course. Springer Publishing Company, Incorporated, edition, 2014. ISBN 1461346916, 978 7781461346913,
A. Polino, R. Pascanu, and D. Alistarh. Model compression via distillation and quantization. arXiv preprint arXiv:1802. 2018.
A. Rakin, Z. He, L. Yang, Y. Wang, L. Wang, and D. Fan. Robust sparse regularization: Simultane- ously optimizing neural network robustness and compactness. arXiv preprint arXiv:1905.13077 2019.
A. Sinha, H. Namkoong, and J. Duchi. Certifiable distributional robustness with principled ad- versarial training. In International Conference on Learning Representations, 2018. URL
https://openrett
net. forum Torum?1d=:Hk6pqq/0
Srinivas and R. V. Babu. Data-free parameter pruning for deep neural networks. arXiv preprint 1rXiv:1507.06149 2015.
B. Wang, X. Luo, Li, W. Zhu, Z. Shi, and Osher. Deep neural nets with interpolating function as output activation. In Advances in Neural Information Processing Systems, pp. 743-753, 2018a.
B. Wang, Yuan, Z. Shi, and Osher. ResNet ensemble via the Feynman- formalism to improve natural and robust acurcies. In Advances in Neural Information Processing Systems, 2019a.
Y. Wang. J. Zeng, and W. Yin. Global Convergence of ADMM in Nonconvex Nonsmooth Optimiza- tion. Journal of Scientific Computing, online, 2018b. doi: 10.1007/110115-018007771.
Y. Wang, X. Ma, J. Bailey, J. Yi, B. Zhou, and Q Gu. On the convergence and robustness of adversarial training. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.). Proceedings of the 36th International Conference Learning Research, pp. 6586-6595, Long Beach, California, USA, 09-15 Jun 2019b. PMLR. URL httt::t:://oceeee/ee
Machine Learning, volume 97 of Proceedings of Machine
m.r. wwwpppess/v... 2t2es//v9/wwagg1999 html
W. Wen, C. Wu, Y. Wang. Y. Chen, and H. Li. Learning structured sparsity in deep neural networks. In Advances in neural information processing systems, pp. 2074-2082, 2016.
B. Yang, J. Lyu, S. Zhang, Y-Y Qi, and J. Xin. Channel pruming for deep neural networks via a relaxed group-wise splitting method. In Proc. of 2nd International Conference on for Industries (AI41), Laguna Hills, CA, 2019.
S. Yao, Y. Zhao, A. Zhang, L. Su, and T. Abdelzaher. Deepiot: Compressing deep neural network structures for sensing systems with a compressor-crite framework. In Proceedings of the 15th ACM Conference Embedded Network Sensor Systems, pp. 4. ACM, 2017.
12

---

Under review as a conference paper at ICLR 2020
S. Ye. K. Xu, S. Liu, H. Cheng, J. Lambrechts, H. Zhang. A. Zhou, K. Ma, Y. Wang, and X. Lin. Second rethinking of network pruning in the adversarial setting, arXiv preprint 1903. 12561, 2019.
Yin, S. Zhang, J. Lyu, S. Osher, Y. Qi, and Xin. Blended coarse gradient descent for full quantization of deep neural networks. Research in the Mathematical Sciences, 6(1):14, Ja, Jan 2019. ISSN 2197-9847. doi: 10. 0011077/44067--188007777
URL /oKL/ttta///ei..or//11...
640687-018-0177-
M. Yuan and Y. Lin. Model selection and estimation in regression with grouped variables. Journal of the Royal Statistical Society, Seriey B, 68(1):49-67, 2007.
H. Zhang, Y. Yu, J. Jiao, E. Xing, Ghaoui, and M. Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv: 1901.0853,,., 2019.
Zhang, S Ye. K Zhang. Tang, W Wen, M Fardad, and Y Wang. A systematic dnn weight pruning framework using alternating direction method of multipliers. arXiv preprint Jul 2018a. [ttppttss///rxxt http://www....or///////////// 1ta.b///184...533 03294
X. Zhang, Zhou, M. Lin, and Sun. Shufflenet: An extremely efficient convolutional neural network for mobile devices. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 6848-6856, 2018b.
A. Zhou, A. Yao, Y. Guo, L. Xu, and Y. Chen. Incremental network quantization: Towards lossless cnns with low-precision weights. arXiv preprint arXiv: (a0p::102.004444 2017.
13

---

Under review as a conference paper at ICLR 2020
A PROOF OF THEOREM
By the arg min update of u', , t Ls(w , It remains show La (w*+1, u²) S Ls(w", u²). To this end, show
Ls(w]+), ws...., w's u²) S Cs(wf, usy.... whs u²)
the conclusion then follows by repeated argument. Notice the only change occurs in the first layer wi. For simplicity notation, only for the following chain of inequality, let w = (wij.., wwr) and wi+1 = =wott w
w(s)) Then for a fixed u == u², we have
Co(w't) +1 u) Lo(w", u)
=f(w"t)) - f(w')) + 8
2 (1 u112 1/we - 21l²)
S <(V((w)), w0't1_1 ww' + 11 w0 w01112+ B
2 (11e0
ull2 11 =e(1²)
(w" wit1 , ,
w²) B(w0*
u, w - 200
1 11 -w'12++ 3 (1 - -ell² - -11w² - -ull²)
1
9
(w"
w 1+1 ,,",,""+ -00+1
'+1
w") +
+ 2 1 - 222
7
B
1w0
ul
lwe' - u1l²
B(w0 u, w w0)
@ w0l1"
2
2
2
3
1)
+
1/ r+1
2
2
Thus, when 17 S
2 B+L
we have L u) s L u)) Apply the above argument repeatedly,
we arrive at
1+1 ... Ca(w 1-1 11 S La(w u²) S Cz(w wo
w M-11 whs: : u²) S... S L u²)
This implies Ca(w" u²) decreases monotonically. Since Ls(w", u²) 2 O. (w" u²) must converge sub-sequentially limit point (w, u.) This completes the proof.
B ADVERSARIAL ATTACKS USED IN THIS WORK
We focus on the Co norm based untargeted attack. For given image-label pair (x, y}. given ML model F(x, w), and the associated loss L(x, y) = L (F
Fast gradient sign method (FGSM) searches an adversarial, ø', within an too -ball as
x' x e sign (V Lo,
Iterative FGSM (IFGSM M (Goodfellow al. 2014b) iterates FGSM and clip the range as
z (m)
Clipa..
( (m-1) + sign V (m- L(x (v)) w/ x x. = 1, M.
C& W attack (Carlini & Wagner 2016) searches the minimal perturbation (0) attack
min ||| loo subject to F(w, 8) t, - - [0, 11d, for Vt +
NAttack (Li al.
2019 is effective gradient-free attack.
14

---

Under review as a conference paper at ICLR 2020
C MORE VISUALIZATIONS OF THE DNNs' WEIGHTS
In section we showed some visualization results for part of the weights of a randomly selected convolutional layer of the AT ResNet20 and EngResNet22. The complete visualization results of this selected layer are shown in Figs. and 7 resp., for ResNet20 and En,ResNe120, These plots further verifies that:
The magnitude of the weights of the adversarially trained EngResNet20 is significantly smaller than that of the robustly trained ResNet20.
The overall pattern the weights of the adversarially trained EnyResNet20 more regular than that of the robustly trained ResNer20.
0
10
20
30 40
50
60
0.20
0
10
20
30
40 50
60
10
20
30
40
50
60
0.10
0.15
0.15
10
20
0.10
20
0.05
20
0.10
30
0.05
0.00
30
0.05
40
0.00
40
40
0.00
-0.05
50
-0.05
60
60
-0.10
60
0.10
0.10
(a)
(b)
(c)
0
10
20
30
40
50
60
0.20
0
10
20
30
40
50 60
0.15
10
20
30
40
50 60
0.15
10
0.10
10
10
0.10
0.05
20
30
0.00
0.05
30
0.00
30
0.05
0.00
50
-0.05
50
00.05
50
0.10
0.05
00100
60
-0.1
0..0
(d)
(e)
(f)
0.15
0
20
40
60
0.20
0.15
0.10
10
0.15
10
0.10
20
0.05
0.10
20
0.05
30
30
0.05
30
0.00
40
40
-0.05
50
50
00.5
0.05
60
00.0
0.10
(h)
Figure 6: Weights of a randomly selected convolutional layer of the PGD AT ResNet20.
15

---

Under review as a conference paper at ICLR 2020
0
10
20
30
40
50
60
0.04
0
10
20
30
40
50
60
10
20
30
40
50
60
0.04
0.03
0.02
0.03
10
10
10
0,02
0.02
0.01
0.01
20
0.01
30
30
30
0.00
0.00
40
0.01
0.01
50
0.02
50
00.01
50
0.02
60
0.03
60
0.03
0.04
(a)
(b)
(c)
0
10
20
30
40 50 60
0
10
20
30
40
50
60
10
20
30
40
50 60
0.03
0.02
0.07
10
0.03
20
0.01
20
20
0.02
0.00
0.00
30
0.01
40
00.01
40
40
0.00
50
-0.01
50
0.01
0.02
60
60
60
0.02
0.03
-0.02
(d)
(f)
0
10
20
30
40 50 60
0
10
20
30
40
50 60
10
20
30
40
50 60
0
0.03
0.02
0.04
0.02
0.01
10
20
0.01
20
20
0.02
0.00
30
10
0.01
40
-0.01
40
0.00
0.00
00.02
50
-0.02
60
-0.03
60
0.03
60
g
(h)
(i)
Figure Weights of the PGD RnsResee the same layer as that shown Fig.
16


Reviews:
[{"review_id": "SJloP0M1cr", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary: This paper presents an observation that Feynman-Kac formalism principled ResNet ensemble [1] yields sparser network weights compared to those of standard Resnet.  Based on this observation, the authors combine the ensemble model with Lagrangian based sparsification methods to obtain sparse and robust models. \n\nPros:\n- Obtaining sparse and robust networks is an important and challenging problem that could be of interest to a large audience.\n- The paper provides an interesting observation that EnResNet [1] yields sparser network weights compared to standard ResNet, and further leverage it to obtain sparse and robust models. \n\nCons:\n- The paper has limited novelty. It has already been shown in the original EnResNet paper [1] that EnResNet is more robust to adversarial attacks. Thus the only additional contribution of this paper is the observation that EnResnet is more sparse than standard ResNet, and combination of EnResnet with sparsification methods.  \n- The paper is not well justified on why one should use sparsifying techniques such as RVSM, RGSM with the Feynman-Kac formula principled EnResnet. The authors state that this enables sparsity to meet robustness; however, in all experimental results, the robustness actually decreases with the increase in sparsity which is opposite to the claims made in the paper. \n- The authors only report robustness on white-box gradient-based attacks. Thus it is not clear whether the method will generalize to black-box/gradient-free attack approaches such as NAttack [2].\n\nMinor comments:\n\n- Why didn’t you report the accuracy on the clean examples? This is important in showing that the method generalizes well to clean examples while maintaining robustness.\n- Why use only 20 iterations to evaluate the attack? Will the model maintain its robustness with the increase in the iteration and epsilon? \n- Figures are not referenced anywhere in the text.\n- It would be better to put the results on CIFAR100 in the main paper rather than in the appendix.\n- Page 2, “lower cases”  -> “lower case”.\n- Page 2, “Related Works” -> “Related work”, it’s better to have it as a separate section.\n\nOverall, while the paper provides an interesting observation, it has limited contributions due to lack of novelty. Further, inadequate experimental validation makes it difficult to see if the claims made in the paper are actually true. Thus I believe that this paper requires substantial improvements in order to be accepted to top-tier publication venues such as ICLR.\n\nReferences:\n[1] Bao et al. 2018, https://arxiv.org/abs/1811.10745 \n[2] Yadong et al. 2019, https://arxiv.org/abs/1905.00441", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HklqNcvkqB", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents an algorithm to train neural networks combining sparsity and adversarial training. \nOn the sparsity inducing regularization, the paper proposes using proximal methods. \n\nOn the positive side:\n- The goal is of interest when it comes to real-world applications.  \n- There is an interesting analysis of the weights and how pruning / AT affects them. \n\n\nOn the negative side:\n\n- In my opinion, the introduction messes unstructured and structured. Weight sparsification is associated with structured while I do believe is unstructured. \n\n\n- Related work does not seem very comprehensive. The paper claims novelty on using RGSM to improve performance. How is this different from the formulation used in \"Learning the Number of Neurons in Deep Networks, Alvarez and Salzmann NIPS 2016\".\n\n\n\nExperimental settings:\n- One thing that got my attention is the threshold for pruning weights (1e-15). I think that is not a fair value. There are related works suggesting no loss in accuracy if the threshold is ~1e-5 (y. Sparse convolutional neural networks CVPR2015). I do believe the numbers would change drastically. \n\n- The comparison between ADMM and the proximal is unfair if using that threshold. The proximal has an implicit thresholding Eq. 6. \n\n- What is the goal for the ensembles of the small networks? where are the numbers?\n\n\nMinor stuff:\n- In sparsity and robustness, there are some works missing (as a typo). \n- On the method, there are two parts where I am confused. What is the aim for including all-around Eq. 4? The same with the theoretical guarantees. ", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "BkxlcbZ0KH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThis paper focuses on the study of sparse neural architectures and efficient DNN compression algorithms for the robust and accurate deep learning. The authors apply relaxed augmented Lagrangian based sparsification algorithms to perform both unstructured and channel pruning for the AT DNNs. By combing with the sparsity merit of EnResNet, their sparsification algorithms further boost the sparsity limit of the AT DNNs, leading to much better robustness and accuracy. Their approach demonstrates superior natural and robust accuracies under several benchmark attacks.\n\nStrengths:\n1 The authors practically apply the RVSM/RGSM algorithms to the AT using robust PGD training, resulting in significantly enhanced sparsity of DNNs, and achieving promising robust accuracies against various adversarial attacks.   \n2 The authors provide the theoretical analysis showing the convergence of the RVSM algorithm.\n\nWeaknesses:\n1 The main contribution of paper is to adapt the RVSM/RGSM algorithms to the AT of DNNs to sparsify the deep model. However, both RVSM and RGSM have already been used as sparsification algorithms for DNNs, and the Feynman-Kac formalism principled DNNs has also been investigated for the purpose of sparsification, thus the contribution is largely reduced and the novelty appear to be limited.\n\n2 For the experiments, the effectiveness of RVSM/RGSM are verified on the variants of ResNet and EnResNet, and there are insufficient comparisons with other cutting-edge compression/sparsification methods to show the advantage of the proposed method.\n\nQuestion:\n1 The author claim that ADMM produce a lot of small weights that cannot be regarded as zero since the norm is large than 1e-15. Is the ‘1e-15’ threshold too small to regard a value as zero?", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I made a quick assessment of this paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I did not assess the derivations or theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper is rejected based on unanimous reviews.
Decision: Reject