Defensive Tensorization: Randomized Tensor Parametrization for Robust Neural Networks
Authors: Adrian Bulat
Jean Kossaifi
Sourav Bhattacharya
Yannis Panagakis
Georgios Tzimiropoulos
Nicholas D.  Lane
Maja Pantic
Venue:  (2020)
Keywords: tensor decomposition
tensor factorization
randomization
robustness

Abstract: As deep neural networks become widely adopted for solving most problems in computer vision and audio-understanding, there are rising concerns about their potential vulnerability. In particular, they are very sensitive to adversarial attacks, which manipulate the input to alter models' predictions. Despite large bodies of work to address this issue, the problem remains open.  In this paper, we propose defensive tensorization, a novel adversarial defense technique that leverages a latent high order factorization of the network. Randomization is applied in the latent subspace, therefore resulting in dense reconstructed weights, without the sparsity or perturbations typically induced by the randomization.
Our approach can be easily integrated with any arbitrary neural architecture and combined with techniques like adversarial training. We empirically demonstrate the effectiveness of our approach on standard image classification benchmarks. We further validate the generalizability of our approach across domains and low-precision architectures by considering an audio classification task and binary networks. In all cases, we demonstrate superior performance compared to prior works in the target scenario.

Under review as a conference paper at ICLR 2020
DEFENSIVE TENSORIZATION: RANDOMIZED TENSOR PARAMETRIZATION FOR ROBUST NEURAL NETWORKS
Anonymous authors Paper under double-blind review
ABSTRACT
As deep neural networks become widely adopted for solving most problems in computer vision and undirstdndds,,,,nngg there are rising concerns about their potential vulnerability. In particular, they are very sensitive to adversarial attacks, which manipulate the input to alter models' predictions. Despite large bodies work to address this issue, the problem remains open. In this paper, we propose defensive tensorization, a novel adversarial defence technique that leverages a la- tent high order factorization of the network. Randomization is applied in the latent subspace, therefore resulting in dense reconstructed weights, without the sparsity perturbations typically induced by the randomization. Our approach easily integrated with any arbitrary neural architecture and combined with tech- niques like adversarial training. We empirically demonstrate the effectiveness of our approach on standard image classification benchmarks. We further validate the generalizability of our approach across domains and low-precision architectures by considering an audio classification task and binary networks. In all cases, we demonstrate superior performance compared to prior works the target scenario.
be
INTRODUCTION
Deep neural networks (DNNs) are powerful predictive models that achieve impressive accuracy
across wide range of artificial intelligence tasks, including image classification (He et al.) 2016
Krizhevsky & Hinton 2009) and speech recognition (Amodei et al.) 2016a Graves et al. 2013
Graves & Jaitly] 2014). The popularity of DNNs production-ready systems has raised serious
security concern as DNNs are found to be susceptible to wide range of adversarial attacks Madrr
[all]]201]]AAe Akhtar & Mian 2018: Dong et al.] 2018 Huang al.) 2017] Goodfellow et al. 2014]
Kurakin et al.] (0166), where small and imperceptible perturbations of the input data lead to incorrect predictions by the networks. These shortcomings pose an obstacle in wide-scale adoption of DNNs and expose an inherent weakness in their reliability. This is especially important when such models become part of security and safety related solutions (Amodei et al. 2016b)).
This susceptibility of DNNs to adversarial perturbations has led to large volume of work that attempts to design robust networks (Dhillon et al.) 2018 Lin et al.) 2019 Samangouei et al. 2018 Song al., 2017: Guo et al.) 2017). However, advances in designing robust DNNs have been tollowed with stronger perturbation schemes that defeat such defences (Athalye et al., 2018).
Most defenses that rely randomization, either apply randomized transformations to the input, e.g. (Xie et al. 2018), or randomization applied within the network, e.g., on the activations (Dhillon et 2018)) or the weights directly (Wang et al.) 2018). However, all these approaches typically introduce artificats (e.g. sparsity in the weights or activations) and can be defeated by carefully crafted attacks (Athalye a 2018 In addition, is preferable not rely on modifications of the inputs but have network that is inherently robust against attacks. In this paper, we take a different approach to randomization. We first parametrize the network using tensor factorization, effectively introducing a latent subspace spanning the weights. We then apply randomization in that latent subspace, enabling us to create models that are robust to adversarial attacks, without modifying directly the weights, activations or inputs. In summary, we make the following contributions:
We propose novel adversarial defence technique that relies latent randomized tensor parametrization of each layer in the network and can be seamlessly integrated within any net- work architecture.

---

Under review as a conference paper at ICLR 2020
We thoroughly evaluate the robustness of our method against various adversarial attacks and show that it consistently and significantly improves over the current state-of-th of-t----t-ttt especially when combined with adversarial training.
We show that our method successfully hardens the models against these attacks for both quantized and real-valued nets.
We verify that our strategy works across domains, by experimenting on both image-based and audio-based classification.
2
RELATED WORK
In this Section, we review the related work on adversarial attacks (Section 2.1 and defences (Sec- tion 2.2p. followed by an overview of tensor methods for deep learning (Section 2.3
2.1 ADVERSARIAL. ATTACKS
First, review few of the most popular adversarial attacks alongside the current defense strategies employed. Given a data sample, c.g., an image X, an adversary will try to find a small perturba- tion, often imperceptible to human eye, but that, added to the input sample, will cause it to be misclassified by the target model, with high confidence. Mathematically, the attacked generates a perturbation A bounded in terms of some lp norm, i.e. || I typically with p = 2 or p The adversarial sample is obtained by adding the perturbation to the input sample Xadv X A.
Several ways of obtaining this adversarial perturbations have been proposed (Goodfellow et al. 2014 Athalyy et al. 2018 Carlini & Wagner 2017). Among them, black box attacks, consider the network as a box which the attacker has no information regarding its architecture or the gradients. White-box attacks the contrary, assume complete access the network architecture and all its parameters. Moreover, attacks can either be unlargeted, in which case the goal is simply make the network predict any wrong label, or targeted, which case the aim is force the network to predict specific label, independently from the input sample. Next, we introduce the main wbite-box attacks used in this paper.
Fast Gradient Sign Method (FGSM) is single-step, gradient based technique, introduced by Goodfellow et al. (2014) to generate -bounded adversarial perturbations as follows:
Xudo X + sgn(snn(( L(0, X))))
where 0 is the parameters of the target neural network. While the single gradient-step nature of FGSM makes it better for transferability attacks, this can also lead to suboptimal ascent direction.
Basic Iterative Method (BIM) and Projected Gradient Descend (PGD) aims to address the shortcoming of FGSM by running it for several iterations. Kurakin et al. (006)) propose BIM, in which the FGSM is run for for several iteration, clipping the values of the perturbation each step to be inside the bounds, Madry et al. (2017) further improve upon this by prepending BIM with random start and replacing clipping with projection onto the acceptable set:
x II = + a sgn (Vx C(0, X v))
where a is the step size and Y is projection operation forcing the generated adversarial sam- ples be in the l, ball S around X. A model resilient PGD attacks is considered to be reasonably resistant to all first order attacks (Madry el al. 2017).
2.2 ADVERSARIAL DEFENCES
Despite recent advances, developing robust neural networks remains an open, challenging prob- lem (Athalye et al. 2018). Current defense strategies typically attempt to either detect the adver- sarial samples and denoise them, or inject adversarial samples during training. The latter is known adversarial training (Goodfellow et al., 2014 Kurakin al. 2016, Madry et al., 2017) and is considered the most resilient defense technique. However, the above mentioned defences typically do not increase the robustness to black box attacks. In addition they typically be defeated using
2

---

Under review as a conference paper at ICLR 2020
two-step approaches (Tramer et al. 2017). Feature squeezing is another model hardening approach introduced by Xu et al. (2017). This technique proposes to reduce the complexity of the data rep- resentation which in turn causes the adversarial perturbations to disappear due to lower sensitivity. Guo et al. ( proposes a set of five transformation, namely image cropping and re-scaling, bit- depth reduction, JPEG compression, pixel dropping and image quilting, that applied to the image to increase the robustness to adversarial attacks of given model. However, even the combination of all these transformations was shown to be vulnerable to carefully tuned attacks (Athalye et al.) 20188. Samangouei et al. (2018) introduces the so-called Defense- Refense-GAN CAN technique. The main idea is to project the samples into the manifold of a generator before classifying them. Similarly, [Song] et al. (2017) uses a PixeICNN instead of generative model. Despite the variety of recently pro- posed defence strategies, (Athalye et al., (0188) the authors show that most of the existing defense techniques rely on one form of gradient obfuscation (gradients shattering, stochastic gradients and vanishing/epploding gradicnts), proposing both a method to detect such class of defences and to defeat them.
As opposed to all the aforementioned works which either manipulate the data samples (Samangouei ett al. 2018 Song et al. 2017 Guo et al. (017)) introduce stochasticity on the activations (Dhillon et al. 2018) or weights Wang et al. (2018) of each layer, we propose a novel defense strategy that leverages tensor factorization of the weights in order apply randomization in that latent space, before reconstructing the weights the weights. The approach is introduced in details in section 3
2.3 TENSOR METHODS IN DEEP LEARNING AND RANDOMIZED TENSOR DECOMPOSITION
Tensors are high dimensional generalizations of matrices (Kolda & Bader 2009). Recently, tensor decompositions have found a surge of applications in deep learning, mainly focusing on networks compression and acceleration. By parametrizing layers of neural networks using tensor decomposi- tion, even whole networks (Kossaifi et al. 2019a), the number of parameters can be reduced with little to no loss of performance, and in some cases the operations can be done more efficiently (Lebe- dev et al. 2015: Novikov et al. 2015 Kim al. 2016: Astrid & Lee 2017).
In some cases, tensor decompositions can exhibit high computational cost and possibly low con- vergence rates when applied to massive data. To accelerate computation, and enable them to scale, several randomized tensor decompositions have been developed. In this way, CP decomposition can be done by selecting randomly elements from the original tensor (Battaglino et al. 2018), or using randomization to solve the problem on one or several smaller tensors before projecting back the result to the original space (Erichson et al., 2017; Sidiropoulos et al. [2014] Vervhet et al.) [0144) Wang et al. (2015) proposed a fast yet provable randomized CP decomposition using FFT to perform tensor contraction. Randomization approaches have also be explored for fast approximation of other tensor decompositions, e.g., Tucker decomposition via sketching (T'sourakakis) 2010) Zhou et al.) 2014) and tensor ring using tensor random projections (Yuan et al., 2019).
These methods are orthogonal to our approach and can be combined with it. As opposed to the aforementioned works, which focus on compression or efficiency, we explore tensor factorization methods in the context of adversarial defense, proposing novel approach in which the weight tensor of each convolutional layer are parametrized using a randomized tensor decomposition that significantly hardens the model, increasing its robustness method is generic and can be applied to both real-valued networks and binary ones. In addition, it orthogonal the existing defence methods and can be combined with existing defenses such as adversarial training. The method is introduced in details in section 3
wide range of adversarial attacks. Our
3 DEFENSIVE TENSORIZATION
In this section, we introduce our method for the defense against adversarial attack. Our defense leverages a randomized higher-order factorization method, which is used as the basis for our de- fense. Typically, defensive methods relying randomization do by introducing sparsity in either the weights or the input activation tensors of the layers of the deep neural neural network. For instance, Dhillon et al.) (2018) sparsify the input tensor, by stochastically pruning some of the acti- vations and scaling up the remaining ones. [Wang et al. (2018) apply sparsification to the weights directly using dropout both during training and testing. However, all these approaches degrade per-
3

---

Under review as a conference paper at ICLR 2020
formance by setting activations to zero, and, while rescaling the non-zero entries can mitigate the issue, increasing the sparsity (and therefore the efficiency of the defense) translates into large losses in performance. By contrast, we propose to rely latent parametrization of the layers using tensor decomposition. Intuitively, a latent subspace spanning the weights is learnt, along with a non-linear projection to and from that subspace. The sparsity inducing randomization is applied in the latent space. Upon projection, the resulting weights are dense and yet preserve the robustness against ad- versarial attacks. This allows us to built models that are both more robust to adversarial methods than existing works, while preserving high classification accuracy.
Notation:
Throughout the papers, we denote vectors (1dorder tensors) as small bold letters V. ma- trices (2 order tensors) as bold capital letters M and tensors, which generalize the concept of ma- trices for orders (number of dimensions) higher than 2, in capital calligraphic letters X. The n-mode product is defined, for a given tensor X' P.PoDDxx..X. and a matrix M E RRRxD,,
D.,, ", as the tensor
T = X' Xn M E R P D.,, 1 Rx Pr. xxxxx with: Tio.h, Ao. ER= -o .ha
Latent bigh-order parametrization of the network: We introduce tensor factorization in the con- text of deep neural networks. Note that this method is independent of the dimensionality of the input but we introduce here, without loss of generality, for the case of a dimensional kernel of 2D convolutions. Specifically, we consider a deep neural network composed of L layers con- volutional layers, interlaced with non-linearities 4,, / E [1 Lj. Let's consider a convolutional LJ. taking as input an activation tensor X₁ and parametrized by a weight tensor W E IR F,C.H.W where F, C, H. W correspond respectively to number of Filters (e.g. output chan- nels), input Channels, Height and Width of the convolutional kernel. The output of that layer, after applying non-linearity, will be t (X4 * Wt).
layer E [1
We introduce a latent parametrization of the weight kernel Wi by expressing it as a low-rank tensor, in this paper using a Tucker decompasition Kolda & Bader (2009). In other words we express Wi in latent subspace as a core tensor 9t- The mapping to and from this subspace is done via factor matrices Uf: Of U and U W; Gi xo U Uf X2 U X3 U.W
Randomizing in the latent subspace: In addition to the above deterministic decomposition, we introduce, for each layer, randomization term stochastically controlling the rank of the decompo- sition. To do so, we introduce diagonal sketching matrices MF, Mc, Iic,M MH and Mw, the diagonal entries of which are i.d. and follow a Bernoulli distribution parametrized by probability A E [0, 1]. Specifically, we samples random vectors X E IR, C E RC, X e TR. and X AW E RRW the entries of which are i.i.d. following Bernoulli distribution parametrized by probability 0. We can then define the sketching matrices as Mo = diag(A;) Mc = diag(Ac), M diag(Ar) and Mw diag(Aw).
This randomization is then applied not directly to the weight tensor W, but rather in the low-rank subspace, effectively randomizing the rank of the convolutional kernel:
Wi (G) x MF x x... X3 Mw) X (U,M)) x X3 (UN MW)
randomized core St
randomized factors Of OF OWW
This stochastic reduction of the rank be done without affecting performance thanks to the over- parametrization of deep networks, which, while crucial for learning (Du & Lee 2018) Soltanolkotabi
al. 2018). create large amounts of redundancies. In addition, since G1 Xo Mr X M))
Or X (TFM)MF)) and Mr, M,, Mi' and Mw are idempotent, eq. 3 can be simplified to:
Wi = (Gr Xo MF X ... X3 Mw) Xo Uf x ... X3 U. = G Xo Uf x... X3 U In other words, we sketch the core tensor, then project it back using the original factors. An impor- tant detail is that the randomization terms from the above equation, G = G X Mp x .... x N Mw never explicitly computed using actual tensor contractions. Instead, the elements sampled are directly selected from the core and the corresponding factors, which is much more computationally effective. For the binary case, we additionally apply the process from eq. (5) by plugging in eq. (4.
(4)
The randomization being done in the latent subspace, it induces no sparsity, unlike pruning or dropout based methods and the reconstructed weights are dense. Since the weights are learnt end- to-end with randomization on the latent cores, the network naturally learns not to rely on any single latent component for prediction, thus learning intrinsically more robust representations. The result is network that is naturally more robust to perturbations in the inputs.
4

---

Under review as a conference paper at ICLR 2020
4 EXPERIMENTAL SETTING
In this section, we detail the experimental setting used for the experiments for image-based classifi- cation and audio- based classification.
4.1 DATASETS
We conducted experiments two widely used databases for image-based classification and audio- based classification, respectively:
CIFAR-10 (Krizhevsky & Hinton 2009) is widely used image classification dataset consisting of 60, 000 images of size 32 x 32px in 10 classes, equally represented. The dataset is divided into 50, 000 images for training and 10, 000 for testing. We did not use any partieular data augmentation, beside random horizontal flipping.
Speech Command (Warden 2018) is audio recognition dataset comprised of 105, 000 1-second utterances of words from large number of users spanning over a small vocabulary. The objective recognize among ten spoken words: yes, no, up, down, left, right, on, off. stop, go, addition to recognizing words outside the vocabulary as unknown, and detecting silence. The dataset is balanced and all audio recordings are captured with a sampling frequency of 16 KHz. We use 80%-1005 10% splits for training, validation and testing respectively.
4.2 IMPLEMENTATION DETAILS
Training the model All our CIFAR- (Krizhessky Hinton 2009) experiments were conducted using a ResNet-18 18 (He et al. 2016) architecture. The network trained for 350 epochs using SGD with momentum (0.9) and a starting learning rate 0.1 that was dropped at epoch 150 and 250 by factor of 0.1. The weight decay set le - 6. In order to accelerate the training process the models with A < were initialized from a pretrained model that was trained without stochasticity (0 1). The binary counterpart models were trained following the method proposed by |aategarii et al. (0166) using the same optimizer and learning scheduler as for the real-valued ones. For the ex- periments conducted on the Speech Command dataset build the SoundNet5 (Aytar al. 2016) architecture containing 5 convolutional layers /in channell,,, out cht_hnnness, kernel, stride, paddingJ:
[1. 16, (1 64), (1 x 2), (0 x 32)], [16, 32, (1 x 32), (1 x 2), (0 16)], [32, 64, (1 16), (1 2), (0 8)], (64, 1 128 (), (1 2), (0) 128, 256, (1 4), (, (1 x 2). (0x2) 2) and linear ones: [512, 256) and (256, 12). Each convolutional layer was followed by max-pooling operation. We trained all of the audio models using Adam (Kingma & Ba 2014) for 50 epochs with an initial learning rate set to 0.01 that was dropped by 0.1x 11xxx at epoch 25 and 35. The binarization and re-parametrization follows the same procedure for CIFAR-10.
Attacking the model For FGSM, we the attack for various values of e = 21, 2, 8, 16, 32, 64, 128} (for image range [0 255)) across
Attack
Method
Ours
Type
Baseline
the entire validation/testing set aver- aging the results over 10 runs. On the Speech Command dataset, since the raw data is in the range [-1, 1]. we scaled the value of accordingly, running it for the following values
0.95
0.9
0.8
Clean
95.3
94.5
93.0
90.1
(no attack)
FGSM
2
48.7 7
84.9
86.8
83.4
22.5
65.4
69.9
71.5
16
12.7
54.0
56.0
60.3
== (0.08, 0.032, 0.063). For the
23.0
60.2
69.5
71.8
iterative methods BIM and PGD, we
BIM
0.0
26.6
33.1
45.5
follow Kurakin et al. (2016) (Sog ct al. (017) setting the step size to
16
0.0
27.0
33.0
42.4
I and the number of iterations to
PGD
2
22.9
64.4
72.3
76.2
8
0.0
27.0
28.1
42.9
|min(c- + 1.25c)
16
0.0
22.4
27.4
34.3
assume that the attacker has access to everything (e.g. the architecture of the network, its
Threat Model:
Table 1: Real-valued network performance on CIFAR-10 for FGSM, BIM and PGD attacks with
16).

---

Under review as a conference paper at ICLR 2020
FGSM
PGD
100
8- 0.9
adv. train.
Accuracy (%)
8
adv. train. training
8 D.B
40
8- 0.95 baseline
Figure 1: FGSM (left) and PGD (right) attacks on the CIFAR-10 image classification dataset for various values of with and without adversarial training. Notice that our method alone surpasses strong adversarial training defence. When combined together the robustness increased even further. Results are averaged over 10 runs.
weights, inputs, outputs, training process and gradients, etc) except the random seed used for sam- pling the Bernoulli random variables.
All of our models were implemented using Py (Paszke et al. 2017) and trained on single Ti- tan X GPU. The latent, randomized tensor factorization was implemented using Tensorly (Kossaifi ct al. 2019b). For the adversarial attacks we used the FoolBox (Rauber et al. (017) package.
RESULTS
In this section, we empirically demonstrate the robustness property of our proposed method against adversarial examples by extensively evaluating it on CIFAR-10 and comparing it against existing state-of-the-aa defense techniques. Moreover, we show that our approach can be combined with adversarial training based techniques leading further robustness gains. All the experiments are run using the experimental setup described in Section 4
Robustness adversarial attacks: When evaluated using the FGSM attack on the CIFAR-10 dataset our method is significanti more robust than the baseline approach, especially for high values of e (see Table D and Fig. D. Furthermore, the results presented in Table [ show that for lower values of 0 O.S, our network significantly decreases the typical high attack success-rate achieved by strong iterative attack algorithms such as BIM and PGD.
Comparison to the State-of-the-Art To better understand the performance of method, compare against existing state-of-the-an defense techniques such as: DQ (Lin et al. 2019) in which the authors attempt reduce the propagation of the adversarial attacks inside the network by controlling the Lipschitz constant, features squeezing (Xu et al.) (2017) that simple reduces the dimensionality of the search space by controlling the color bit depth of each pixel while applying spatial smoothing and finally, adversarial training in two variants: R+FGSM as proposed in (Lin) al. 2019) and PGD (Madry et al., 2017). Where the later (i.e. adversarial training) considered to be one of the strongest defence techniques developed. For feature-squeezing we used 5 bits for image color reduction combined with
median filter. For adversarial training as (Madry) et al. 2017 Kurakin et al.) 2016) we sample the number of steps (for PGD) and randomly. As results from Table 2 show, our method consistently outperforms existing defense strategies for various attacks (FGSM. BIM, PGD), across different values of {2, 8, 16). Furthermore, when combined with adversarial training our method can further increase its resilience to attacks.
Defending against omniscient attackers Another interesting question is whether our defense strat- egy would still work against an omniscient attacker, i.e., an attacker with access to the full un- first generate
randomized weights. We trained network for 0 0.9. Then, during training, an adversarial example using the full, un-randomized weights (i.e. = 1) and test it using the stochasticity (i.e. 0.9). As be seen in Table network is still robust against these

---

Under review as a conference paper at ICLR 2020
FGSM
PGD
Method
clean
c= 2/2/8/16
c= 2/8/16
Normal
95.4
18.7/22.6/12.9
22.9/0/0
DQ (Lin et al.
2019)
95.9
68/53/42
62/4/0
Feature squeczing Xu et al.
2017
94.1
61//55/27
64/2/0
Adv. training+R FGSM (Lin
2019
91.6
81/52 /38
84/43/11
Adv. training PGD (Madry et al.
2017
86.6
74/ /31
76/44/20
Ours (0 = 0.8)
90.1
83.4/71.5/600
76.2/42.9/34.3
Ours (0 = 0.95) + Adv. training PGD
89.5
86.5/81.4/70.11
84.9/75.4/555
Table 2:
Comparison against various defense methods against FGSM and PGD with {2, 8, 16} the CIFARIO dataset. Notice that method, especially when combined with ad- versarial training, significantly outperforms other state-of-the-an methods.
attacks, despite the attacker having full access to the weights. Similar behaviour can be observed for other values A. Note that this is an extreme scenario and in general, the weights could be stored separately (and safely) with the network getting, at each time, the randomly reconstructed weights.
6 ABLATION STUDIES
To further validate our findings we test out approach on two different scenarios: on fully binarized networks (Sec- tion 6. and audio classification task (Section 6.2).
FGSM
PGD
BIM
2
91.1
82.5
81.9
85.4
74.1
80.4
16
82.4
53.9
80.1
6.1 ATTACKING BINARY NEURAL NETWORKS
With the growing popularity of deep learning based meth- ods and the constant need of incorporating such ap- proaches on mobile devices, network quantization has emerged as potential fariware-friendll solution, which squeezes the original network by reducing the number of bits required to represent the model parameters. In its most extreme form, binarization, the weights and fea- tures are represented using single bit (Courbariaux et al. Rastegari et al.) 2016, Bulat & Tzimiropoulos The typical approach quantizes the network using the sign function (Courbariaux et al., however this introduces high quantization errors that hinder the learning process. To allevi- ate this, real-valued scaling factor is introduced by Rastegari al. (2016). In this work binarize the network following Rastegari et al. (0116):
Table 3: Robustness against attacker with access the un-randomized weights. FGSM, BIM and PGD attacks with E {2,8, 16) are computed using the full (un-randomized) weights (i.e. 0 1) and used against the same net- work with the same weights but with = 0.9.
2016
2017
2015,
I W (sgn(Z) (Z) K sgn(WW) @ Koa,
where I E Rexwin xhi and W E cxxxw denote the input and respectively the weight of the L-th convolutional layer, a E Rex x11 represent the weight scaling factor and K. E RR. 1 x Wost the input scaling factor. Both a and are computed analytically as proposed by Rastegari al. (0016).
While it was previously thought that such binarized networks are more resilient to adversarial at- tacks (Khalil et al., 2018 Liu al. 2018 Galloway al. (017)) than their real-valued counterpart, in this work we confirm the recent findings of (Lin et al. 2019) by showing that in fact it is the oppo- site, i.e., binary networks are more susceptible adversarial attacks. Typically, during the training phase the derivative of the quantization function (sgn) is approximated using STE (e.g., an identity function clipped [-1, in this case). The same estimator can be used during the attacking phase and it often leads to a high rate of success of the attacks. Interestingly, the results in Table show that we can go one step further by approximating the derivative of the sgn function using tanh(x)) and tanh(0.77 75 z)) respectively. The use of these approximations make the binary networks become more sensitive to the attacks. When evaluated on a binary network on the CIFAR-10 dataset, in accordance with the behaviour found on real-valued models, method shows significant improve- ments across the entire range of values and attacks tested (see Table and Fig. [T. We note that for the binary case, since such networks have lower representational capacity, set 0 0.99.

---

Under review as a conference paper at ICLR 2020
Attack
Method
Baseline
Type
Identity
tanh(z)
tanh(O.752)
Ours (0 = 0.99)
Clean
83.7
83.7
83.7
80.0
(no attack)
FGSM
36.6
34.5
34.1
76.9
6.9
6.1
5.8
65.0
16
4.3
3.4
3.0
58.7
2
37.0
34.7
35.1
66.3
BIM
8
0.0
0.0
0.0
46.4
16
0.0
0.0
0.0
44.0
41.7
38.7
39.8
67.5
PGD
0.1
0.0
47.9
16
0.0
0.0
0.0
41.5
Table 4: Binary network performance CIFAR-10 for FGSM, BIM and PGD attacks with
{2, 8, 16]. Our approach is significantly more robust, especially against iterative attacks.
6.2 DEFENSIVE TENSORIZATION FOR AUDIO CLASSIFICATION
To further demonstrate the generalizability of our approach, we next consider adversarial attacks on the audio domain. In-line with the latest success in audio recognition, we consider an end-to-end audio model following SoundNet (Aytar al. 2016) architecture, that operates directly the raw audio signal, without requiring any feature extractions (e.g.. MFCC or log mel-spectrogramm We found that the end-to-end models show higher degree of vulnerability to the adversarial attacks, e.g.. around 6% absolute degradation compared to the model operating on log mel-spectrogram. In case of the small vocabulary audio recognition task, we only consider FGSM attack and summarize our findings in Table (5) With higher degree of stochasticity (i.c. 0 0.9), both the real and the binarized model exhibit much higher resilience to the adversarial attacks.
Defensive Tensorization
Quantization
Baseline
0
0.99
0.95
= 0.9
No attack
93.8
92.0
89.6
88.1
Real
0.008
33.0
49.6
58.2
61.0
0.032
14.9
33.0
40.2
44.2
0.063
7.6
23.8
31.8
35.7
No attack
88.0
89.0
83.5
83.2
Binary
0.008
12.2
50.1
54.4
56.0
0.032
3.0
31.5
35.6
40.2
0.063
0.2
26.7
30.3
30.5
Table 5: Performance on Speech Command for FGSM attacks with E {0.008, 0.032, 0.063)
using both binary and real-valued models. Notice that our approach is significantly more robust.
7 CONCLUSION
In this paper, we propose defensive tensorization, novel adversarial defence technique that lever- ages latent high order factorization of the network. Randomization applied in the latent subspace, therefore resulting in dense reconstructed weights, without the sparsity or perturbations typically in- duced by the randomization. We empirically demonstrate that our approach makes the network significantly more robust adversarial attacks. Contrarily to widely spread belief, observe that binary networks are more sensitive to adversarial attacks than their real-valued counter-pan part. We show that method significantly improves robustness in the face of adversarial attacks for both bi- nary and real-valued networks. We demonstrate this empirically through thorough experimentation on image and audio classification.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 1114400-4430, 2018.
Dario Amodei, Sundaram Ananthanarayanan, Rishita Anubhai, Jingliang Bai, Eric Battenberg, Carl Case, Jared Casper, Bryan Catanzaro, Qiang Cheng, Guoliang Chen, et al. Deep speech 2: End-to- end speech recognition in english and mandarin. In International conference on machine learning, pp. 173-182 182, 2016a.
Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Con- crete problems in ai safety. arXiv preprint 160.005600 2016b.
Marcella Astrid and Seung-Ik Lee. Cp-decomposition with tensor power method for convolutional neural networks compression. CoRR, abs/ 2017.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv: arXiv:1802.00 1802.002000. 2018.
Yusuf Aytar, Carl Vondrick, and Antonio Torralba. Soundnet: Learning sound representations from unlabeled video. In Advances in Neural Information Processing Systems, 2016.
Casey Battaglino, Grey Ballard, and Tamara G Kolda. A practical randomized ep tensor decompo- sition. SIAM Journal on Matrix Analysis and Applications, 39(2):876-901, 2018.
Adrian Bulat and Georgios Tzimiropoulos. Binarized convolutional landmark localizers for human pose estimation and face alignment with limited resources. In ICCV, 2017.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pp. 39-57. IEFF, 2017
Matthieu Courbariaux, Yoshua Bengio, and Peenre David. Binaryconnect: Training deep neural networks with binary weights during propagations. In NIPS, 2015.
Matthieu Courbariaux, Itay Hubara, Daniel Soudry, Ran EI- Yaniv, and Yoshua Bengio. Binarized neural networks: Training deep neural networks with weights and activations constrained to+ or-1. arXiv, 2016.
Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. Stochastic activation pruning for robust adversarial de- fense. arXiv preprint 1803.v 2018
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9185-9193, 2018.
Simon S Du and Jason D Lee. On the power of over wverparaametrization in neural networks with quadratic activation. In ICML,
N Benjamin Erichson, Krithika Manohar, Steven L Brunton, and J Nathan Kutz. Randomized cp tensor decomposition. arXiv preprint arXiv:1703.09074 2017.
Angus Galloway, Graham W Taylor, and Medhat Moussa. Attacking binarized neural networks. arXiv preprint arXiv: 171400049, 2017.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
A. Graves, A. Mohamed, and G. Hinton. Speech recognition with deep recurrent neural networks. In 2013 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 6645- 6649, May 2013. doi: 10.1 109/

---

Under review as a conference paper at ICLR 2020
Alex Graves and Navdeep Jaitly. Towards end-to-end speech recognition with recurrent neural net- works. In Eric Xing and Tony Jebara (eds.), Proceedings of the 31st International Conference on Machine Learning, volume 32 of Proceedings of Machine Learning Research, pp. 1764-1772, Bejing, China, 22-24 Jun 2014. PMLR. URL http: httt::://proceedingg. ml r.psss//v32 graves html
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. arXiv preprint 17Xiv:/711.00//7 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Sandy Huang, Nicolas Papernot, Ian Goodfellow, Yan Duan, and Pieter Abbeel. Adversarial attacks neural network policies. arXiv preprint arXiv:/ 2017.
Elias B Khalil, Amrita Gupta, and Bistra Dilkina. Combinatorial attacks binarized neural net- works, arXiv preprint Xrviv: 1810.03538, 2018.
Yong-Deok Kim, Eunhyeok Park, Sungjoo Yoo, Taelim Choi, Lu Yang, and Dongjun Shin. Com- pression of deep convolutional neural networks for fast and low power mobile applications. ICLR, 05 2016.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint wrXiv::412.69866 6980, 2014.
Tamara G. Kolda and Brett W. Bader. Tensor decompositions and applications. SIAM REVIEW, 51 (3):455-500, 2009.
Jean Kossaifi, Adrian Bulat, Georgios Tzimiropoulos, and Maja Pantic. T-net: Parametrizing fully convolutional nets with single high-order tensor. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 7822-7831, 2019a.
Jean Kossaifi, Yannis Panagakis, Anima Anandkumar, and Maja Pantic. Tensorly: Tensor learning in python. The Journal of Machine Learning Research, 20(1 (1225995, 2019b.
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Tech- nical report, Citeseer, 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprini 1607,000 02233,, 2016.
Vadim Lebedev, Yaroslav Ganin, Maksim Rakhuba, Ivan V. Oseledets, and Victor S. Lempitsky. Speeding-up up convolutional neural networks using fine-tuned cp-decomposition. In ICLR, 2015."
Lin, Chuang Gan, and Song Han. Defensive quantization: When efficiency meets robustness. arXiv preprint arXiv: 1904. 00444, 2019.
Xuanqing Liu, Yao Li. Chongruo Wu, and Cho-Jui Hsich. Ady-bnn: Improved adversarial defense through robust bayesian neural network. arXiv preprint arXiv:1810.0122 2018
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.
Alexander Novikov, Dmitry Podoprikhin, Anton Osokin, and Dmitry Vetrov. Tensorizing neural networks. In Proceedings the 28th International Conference on Neural Information Processing Systems, NIPS' 15, pp. 442 450, 2015.
Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in PyTorch. In NIPS Autodiff Workshop, 2017.
Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. Xnor-net: Imagenet classification using binary convolutional neural networks. In ECCV, 2016.
10

---

Under review as a conference paper at ICLR 2020
Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox vO. 8.0: A python toolbox to bench- mark the robustness machine learning models. arXiv preprint arXiv:1707.04133 5, 2017.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv: 1000.00000000 1805.06605, 2018.
Nicholas D Sidiropoulos, Evangelos E Papalexakis, and Christos Faloutsos. Parallel randomly com- pressed cubes: A scalable distributed architecture for big tensor decomposition. IEEE Signal Processing Magazine, (155:777-70, 2014.
Mahdi Soltanolkotabi, Adel Javanmard, and Jason D Lec. Theoretical insights into the optimization landscape of werr-parameterized shallow neural networks. IEEE Transactions Information Theory, 2018
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv: 10766, 2017.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint (tfi::770.00777 2017.
Charalampos E Tsourakakis. Mach: Fast randomized tensor decompositions. In Proceedings the 2010 SIAM International Conference on Data Mining, pp. 689-700. SIAM, 2010.
Nico Vervliet, Otto Debals, Laurent Sorber, and Lieven De Lathauwer. Breaking the curse of di- mensionality using decompositions of incomplete tensors: Tensor-based scientific computing in big data analysis. IEEE Signal Processing Magazine, 31(5):71-79, 2014.
Siyue Wang, Xiao Wang, Pu Zhao, Wujie Wen, David Kaeli, Peter Chin, and Xue Lin. Defensive dropout for hardening deep neural networks under adversarial attacks. In Proceedings of the International Conference Computer-Aided Design, pp. 71. ACM, 2018.
Yining Wang. Hsiao- Yu Tung, Alexander J Smola, and Anima Anandkumar. Fast and guaranteed tensor decomposition via sketching. In Advances in Neural Information Processing Systems, pp. 991-999, 2015.
Pete Warden. Speech Commands: A Dataset for Limited- e-prints, art. 180.:11804.0329,, Apr 2018.
Limited-Vocabulary Vocabulary Speech Recognition. arXiv
Cihang Xie, Jianyu Wang. Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through randomization. In International Conference on Learning Representations, 2018.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01 155, 2017.
Longhao Yuan, Chao Li, Jianting Cao, and Qibin Zhao. Randomized tensor ring decomposition and its application to large-scale data reconstruction. arXiv preprint arXiv: 1901v:9001.00000 2019.
Guoxu Zhou, Andrzej Cichocki, and Shengli Xie. Decomposition of big tensors with low multilinear rank. arXiv preprint arXiv: 1412. 2014.

---

Under review as a conference paper at ICLR 2020
A APPENDIX
Algorithm for defensive tensorization We summarize in Algorithm, the steps for inference using our proposed defensive tensorization.
Algorithm Defensive tensorization
1: Input sample Ag-
2: for each layer do
3: Sample random vector Xr, Aw Bernouilli (0)
4: Create sketch matrices Mp diag(Xp)." ( Mw diag( Aw)
5: Sketch the latent Core ف = 9i Xu Mr x ... X3 Mw
6: Reconstruct Wi using Equation (3)
Randomized dense reconstruction > Convolve 2 with the randomized reconstruction and apply c
7: Xi+1 <- (W * X4)
8: return X
Low-dimensional visualization of loss landscape: To visually assess the impact of both our randomization scheme and adversarial training on the optimization landscape, we visualise the eval- uation of the loss in fixed neighbourhood around unseen data point. Specifically, given model and a data point z, we visualize the loss function learned by the model in the close proximity x. visualise the loss in 2-dimensional space, by selecting the two relevant axis: the
For clarity, direction of the gradient at x (x-axis) and a randomly chosen direction, orthogonal to the direction of gradient (y-axis). Next, mesh-grid is constructed by sampling uniformly points along these two directions for the range [-0.5, 0.5]. Then a contour plot is constructed by evaluating the losses for all points the mesh-grid. Examples of loss-surfaces are shown in Fig. 2 3 and
Effect on the optimization landscape: Intuitively, the randomization (which is done in the latent subspace of the decomposition, not on the weights themselves), changes the loss function, each pass, making it hard to converge to a fixed attack due to the presence of many spurious minimums. This can seen by looking the landscape of the loss function around an arbitrary sample in Fig. For the adversarial case, the landscape is inline with the finding of Madry et al. (2017), where the authors show the adversarial training smooths the loss space around O. This is even more noticeable for the method that combines our approach with adversarial training (see Fig.
04
0.
0.
02
-0.2
-02
-02
-3A
-0.4
-04
-0.4
-04
-32
000
02
-0.4
-02
0/0
02
04
-02 0.0 002 044
Figure 2: Contour plot of the loss surface of the real model evaluated on the loc neighbourhood of CIFAR- 10 image for 0 {1, 0.95, 0.9, 0.8) (from left to right). The direction of the gradient was computed for and a ramdom, orthogonal direction. These were kept fixed for the subsequent plots 0 0.95, 0.9 and 0.8. The red circle denotes the 32 neighbourhood.
12

---

Under review as a conference paper at ICLR 2020
00
-02
-02
-02
10.4 -0.
-22 05
-22 60
0.
04
-54
04
Figure 3: Contour plot of the loss surface of the real model evaluated on the loc neighbourhood of a CIFAR-10 image for {1, 0.95, 0.9, 0.8} (from left to right). For each plot (i.e. each value of 0), we recomputed the direction of the gradient. The red circle denotes the 32 neighbourhood.
0.4
0.4
0.1
0.2
12
-0.2
-0.2
-0.0
-0.4
-0.4
Figure 4: Contour plot of the loss surface of our model, adversarially trained model for various values of evaluated on the lox neighbourhood an unseen CIFAR- 10 image. The same direction was used for all three plots. The red circle denotes the 32 neighbourhood.
13


Reviews:
[{"review_id": "r1l0cn0k9H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors propose a randomization-based tensorization framework towards robust network learning. The high-level idea of this work is to reparameterize the network parameters W of each layer with low-rank tensors, where the factor matrices are injected with randomization through randomly sampled sketching matrices. Since the randomization is is done within a subspace than directly on the weight matrix itself, the authors claim that this brings certain advantages such as less sparsity.\n\nStrengths:\n+ Well-written paper with good clarity and technical correctness.\n+ Interesting idea with novelty.\n+ Good ablation study with clear performance improvement from the proposed framework.\n+ Good applications with binarized networks and audio classification.\n\nWeaknesses:\n- Insufficient and badly conducted comparative study with recent SOTAs.\n- Insufficient experiment with larger datasets (such as CIFAR-100) or enough variety of datasets (such as SVHN).\n- No direct experiment verification that supports the advantage of randomization in a subspace\n- No discussions on the training complexities and the extendability to large-scale datasets/networks, such as ImageNet/ResNet-101.\n- Missing citation and comparison to the following two SOTAs:\n1. Xie et al., Feature Denoising for Improving Adversarial Robustness, CVPR19\n2. Mustafa et al., Adversarial Defense by Restricting the Hidden Space of Deep Neural Networks, ICCV19\n\nComments:\nI consider the idea of this paper novel and interesting. Considering tensor factorization with randomization for network robustness makes a lot of sense but overall the experiments of this paper are not well-conducted towards comparative studies with other SOTAs, although ablation study shows the considerably improved robustness from the proposed method. The main concerns of this paper lie in several aspects:\n1. It seems that the authors did not report their comparison to recent SOTAs (such as Lin et al, 2019) comprehensively enough, nor were the benchmark measures (missing several other attacks, especially black box ones), datasets and backbones fully aligned. It is unclear how much the architecture of a backbone can impact the fairness of comparison. There is also no apples to apples comparison to directly verify the advantage of this work over non-subspace-based randomization method.\n2. The authors failed to cite and compare to recent two SOTAs (listed above) which conduct large-scale experiments with bigger models. And there is no discussion about the extendability/generalizability of the proposed method to these data and models. Therefore, the contributions of this work somehow become less convincing.\n\nMinor typos:\nIn page 4 \"Randomizing in the latent subspace\": \n\\lambda^F \\in R^O --> \\lambda_F \\in R^F\nM_O = diag(\\lambda_F) --> M_F = diag(\\lambda_F)\nplease unify subscripts/superscripts for all \\lambda.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "Hyl2dMt0YB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper tackles the problem of designing neural network architectures that are robust to adversarial attacks. Several defense techniques against adversarial attacks have been proposed, mainly adversarial training (train on perturbed inputs) and introducing random perturbation to the weights or activations of the network. The paper claims that one limitation of the second approach is that it introduces artifacts (e.g. sparsity). The authors propose a simple but original idea to address this issue: parameterize the network's weight matrices as low rank tensors (in the Tucker format) and randomize the weights by sketching the core tensor of the Tucker decomposition (in effect, the sketching amounts to randomly setting fibers of the core tensor to 0). \n\nI think this paper can be relevant to the community but I am not confident that this is an important contribution. The idea is interesting and addresses the problem of sparsity artifacts in randomized defense strategies, but it does not appear clearly why using tensor decomposition techniques is a sound approach for designing robust networks (besides overcoming sparsity artifacts). I believe there may be more fundamental (theoretical, principled) arguments to motivate the approach, but this is not explored in the paper: the idea is interesting but not supported by much theoretical insight. Yes, using Tucker decomposition allows one to have randomized but still dense weights. Is it the only reason to use tensor decomposition? Why not do the same with a simple low rank matrix for example?\n\nThe experimental section is developed but I find the experimental setting not clearly described (e.g., what is the metric? is it the accuracy over adversarial examples?). Maybe this is because I am not familiar with the adversarial defense literature. \n\nIn conclusion, I am a bit on the fence for this paper. The idea is interesting and definitely worth exploring but to me a more thorough discussion and analysis of why tensor decomposition techniques are relevant is missing. Still, the approach is original and this paper may spark future work further exploring these questions, so I recommend acceptance.\n\n* Comments / Questions *\n\n- Paragraph \"Latent high-order parametrization of the network\". If I understand correctly, the core tensor G in the decomposition as the same size of W, so at this stage W is not parameterized as a low rank tensor (W is actually over-parmeterized). This is only when the stochastic vectors \\lambda are introduced that the Tucker rank of W is implicitly reduced. This could be clarified.\n\n- Is stochasticity preserved at test time (unlike when using dropout but like in Wang, et al. (2018))?\n\n- What is the metric used in Table 1 to compare the models?\n\n- Would it make sense to explore other tensor decomposition models (e.g. CP, tensor train, tensor ring, ...)? Are there any particular reasoning motivating the choice of Tucker?\n\n\n", "extra_scores": {"experience_assessment": "I do not know much about this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I did not assess the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory."}, "extra_text": {}}, {"review_id": "BylqtktpFS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors propose  to use randomized tensor factorization in the weight space as a defense to adversarial attack, which builds upon the existing works on using randomization on the weights or activation as a defense methods.\n\nPros:\n1. The idea of using randomized tensor factorization for dense is novel\n2. It seems that this defense is robust to large perturbation (epsilon), and the accuracy on clean data is high when combined with PGD adv.training.\n\nCons:\n1.  I don't understand why using randomization in the latent space of the weights can retain the classification accuracy on clean data. The authors say that this is because both the weights and the activations are not sparse. But I don't understand the relation between sparsity and accuracy. Can the author can provide some evidence on this (probably from the previous acceleration literatures). Besides, I think an accuracy of 90.1 on CIFAR10 (Tab.2) is not high.\n2. As in the review written by Anthony Wittmer, the author should include experiments to check the obfuscated gradient issue.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I did not assess the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: Three reviewers have assessed this submission and were moderately positive about it . However, the reviewers have also raised a number of concerns. Initially, they complained about substandard experimentation which has been resolved to some degree after rebuttal (rev. believe more can be done in terms of unifying them, investigating backbones, attack methods, and experimental settings in light of recent papers).

A somewhat bigger criticism concerns the theoretical part: 
1. Rev. remained unclear why using tensor decomposition techniques is a sound approach for designing robust network.
2. AC and rev. also noted during discussions that using low rank constraints (and other mechanisms) and i.e. encouraging smoothness (one important mechanism among many in robustness to attacks) have been extensively investigated in the literature, yet, the proposed idea makes scarce if any theoretical connection to such important theoretical tools.

Some references (not exhaustive) that may help authors further study the above aspects are:
Certified Adversarial Robustness via Randomized Smoothing, Cohen et al.
Local Gradients Smoothing: Defense against localized adversarial attacks, Naseer et al.
Limitations of the Lipschitz constant as adefense against adversarial examples, Huster et al.
Learning Low-Rank Representations, Huster et al.

On balance, AC feels that despite the enthusiasm, this paper is not ready yet for the publication in ICLR as the key theory behind the proposed idea is missing. Thus, this submission falls marginally short of acceptance in ICLR 2020. However, the authors are encouraged to build up a compelling theory and resubmit to another venue (currently the paper feels like a solid workshop idea that needs to be investigated further).
Decision: Reject