A Winning Hand: Compressing Deep Networks Can Improve Out-of-Distribution Robustness
Authors: James Diffenderfer
Brian R Bartoldson
Shreya Chaganti
Jize Zhang
Bhavya Kailkhura
Venue: NeurIPS 2021 Poster (2021)
Keywords: robustness
compression
pruning
binarization
lottery-ticket hypothesis

Abstract: Successful adoption of deep learning (DL) in the wild requires models to be: (1) compact, (2) accurate, and (3) robust to distributional shifts. Unfortunately, efforts towards simultaneously meeting these requirements have mostly been unsuccessful. This raises an important question: Is the inability to create Compact, Accurate, and Robust Deep neural networks (CARDs) fundamental? To answer this question, we perform a large-scale analysis of popular model compression techniques which uncovers several intriguing patterns. Notably, in contrast to traditional pruning approaches (e.g., fine tuning and gradual magnitude pruning), we find that ``lottery ticket-style'' approaches can surprisingly be used to produce CARDs, including binary-weight CARDs. Specifically, we are able to create extremely compact CARDs that, compared to their larger counterparts, have similar test accuracy and matching (or better) robustness---simply by pruning and (optionally) quantizing. Leveraging the compactness of CARDs, we develop a simple domain-adaptive test-time ensembling approach (CARD-Decks) that uses a gating module to dynamically select appropriate CARDs from the CARD-Deck based on their spectral-similarity with test samples. The proposed approach builds a "winning hand'' of CARDs that establishes a new state-of-the-art (on RobustBench) on CIFAR-10-C accuracies (i.e., 96.8% standard and 92.75% robust) and CIFAR-100-C accuracies (80.6% standard and 71.3% robust) with better memory usage than non-compressed baselines (pretrained CARDs and CARD-Decks available at https://github.com/RobustBench/robustbench). Finally, we provide theoretical support for our empirical findings. 

A Winning Hand: Compressing Deep Networks Can Improve Out-Of-Distribution Robustness
James Diffenderfer, Brian Bartoldson, Shreya Chaganti; Jize Zhang, Bhavya Kailkhura
Lawrence Livermore National Laboratory fdiffenderfer2, bartoldson, chaganti1, zhang64, kailzhural)0l1m1. gov
Abstract
Successful adoption of deep learning (DL) in the wild requires models to be: (1) compact, (2) accurate, and (3) robust to distributional shifts. Unfortunately. efforts towards simultaneously meeting these requirements have mostly been unsuccessful. This raises an important question: "Is the inability to create Compact, Accurate, and Robust Deep neural networks (CARDs) fundamental?" To answer this question, we perform a large-scale analysis of popular model compression techniques which uncovers several intriguing patterns. Notably, in contrast to traditional pruning approaches (e.g.. fine tuning and gradual magnitude pruning), we find that "lottery ticket-style" approaches can surprisingly be used to produce CARDs, including binary-weight CARDs. Specifically, we are able to create extremely compact CARDs that, compared to their larger counterparts, have similar test accuracy and matching (or better) robustness -imply by pruning and (optionally) quantizing. Leverag- ing the compactness of CARDs, we develop a simple domain-adaptive test-time ensembling approach (CARD- -Dcck that uses a gating module to dynamically select with test samples. The proposed approach builds "winning hand" of CARDs that establishes a new state-of-the-ar [8] on CIFAR-IO-C accuracies (i.e., 96.8% standard and 92.75% robust) and CIFAR-100-CC accuracies (i.e., 80.6% standard and 71.3% ro- bust) with better memory usage than non-compressed basclines (pretrained CARDs available at (8). Finally, provide theoretical support for our empirical findings.
appropriate CARDs from the CARD-Deck based on their spectral-similanee
Introduction
Deep Neural Networks (DNNs) have achieved unprecedented success in wide range of applications due their remarkably high accuracy [15]. However, this high performance stems from signif- icant growth in DNN model size; i.e., massive overparameterization. Furthermore, these highly overparameterized models are known to susceptible to the nut-of-distribution (OOD) shifts en- countered during their deployment in the wild [5). This resource-inefficiency and OOD brittleness of state-of-the-aar (SOTA) DNNs severely limits the potential applications DL can make an impact on.
For example, consider the "Mars rover mission" that uses laser-induced breakdown spectroscopy (LIBS) search for microbial life. It is well accepted that endowing the rover with DNNs analyze complex LIBS spectra could produce scientific breakthroughs [3. However, employing DNNs in such cireumstances is challenging: 1) as these devices are battery operated, the model has to be lightweight so it consumes less memory with reduced power consumption, and 2) the model must be able efficiently handle domain shifts spectra caused by environmental noise. These requirements are not specific only to the aforementioned use case but arise in any resource- -imited application using DL in the wild. The fact that SOTA DNNs do not satisfy compactness and OOD robustness requirements is holding us back from leveraging advances in DL to make scientific discoveries.
cqual contribution
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

This work is driven by two questions around this crucial problem. Q1. Can we show the existence of compact, accurate, and robust DNNs (CARDs)? QZ. If yes, can we apply existing robustness improvement techniques to CARDs to further amplify performance while maintaining compactness?
Notably, there have been some recent successes in addressing each of the challenges CARDs present in isolation. The authors in [24]]] 27 developed data augmentation methods for achieving high OOD robustness without sacrificing accuracy on the clean data. The authors in [12 g
developed pruning and quantization approaches for achieving high accuracy at extreme levels of model compression. However, efforts towards achieving model compactness, high accuracy, and OOD robustness simulta- neously have mostly been unsuccessful. For example, [26] and [32) recently showed that compressed DNNs achieve accuracies similar to the original networks' but are far more brittle when faced with OOD data. Perhaps unsurprisingly, the current solution in the robust DL community to improve the OOD robustness (and accuracy) to increase the model size (e.g., 25 16 (.
In this paper, we demonstrate that these negative results are a byproduct of inapt compression strategies, and the inability to create CARDs not fundamental (answering Q1 in the affirmative). Specifically, we perform a large-scale comparison by varying architectures, training methods, and pruning rates for a range of compression techniques. We find that in contrast to traditional pruning methods (e.g.. fine tuning [8] and gradual magnitude pruning [60], "lottery ticket-style" compression can surprisingly be used to create CARDs. In other words, we are able to create extremely compact (i.e., sparse and, optionally, binary) CARDs that are significantly more robust compared their larger and full-precision counterparts while having comparable test accuracy. Our results are in sharp contrast to the existing observation that compression is harmful to OOD) robustness. In fact, we show that compression capable of providing improved robustness.
approaches [2
We subsequently explore the possibility of using existing pouusteess-impooeemeec techniques in conjunction with compression strategies further improve the performance of CARDs. Empirically, we show the compatibility of CARDs with popular existing strategies, such as data augmentation and model size increase. We also propose a new robustnessimprooeeennt strategy that leverages the compactness of CARDs via ensembling this ensembling approach is referred to as domain- adaptive CARD-Deck and uses a gating module dynamically choose appropriate CARDs for each test sample such that the proposed adaptive ensembling approach builds a "winning hand" of CARDs that establishes new state-of-the-arr robustness (and accuracy) on the popular OOD benchmark datasets CIFAR-10-C and CIFAR- 100-C with a compact ensemble (answering Q2 in the affirmative).
of the chosen CARDs and test data is maximized. This
Broad implications of our findings are as follows. First, there exist sparse networks early in training (sometimes initialization) that can be trained to become CARDs (i.e., we extend the lottery ticket hypothesis 12] to robust neural networks via our CARD hypothesis). Second, within a random-weight neural network, there exist CARDs which (despite having untrained weights) perform comparably to more computationally expensive DNNs (i.c., we extend the strong lottery ticket hypothesis [41] to robust neural networks via our CARD hypothesis). Third, compression can be complementary with existing robustness-improiie strategies, which suggests that appropriate compression approaches should be considered whenever training models that may be deployed in the wild.
To summarize our main contributions:
Contrary to most prior results in the literature, we show that compression can improve robustness, providing evidence via extensive experiments on benchmark datasets, supporting our CARD hypothesis. Our experiments suggest "lottery ticket-style" pruning methods and a sufficiently overparameterized model are key factors for producing CARDs (Section 2.2).
As corruptions in benchmark datasets could be limited (or biased) to certain frequency ranges, we tested the ability of compression improve robustness to Fourier basis perturbations. This analysis corroborates findings on CIFAR-10/100-C and further highlights that models compressed via different methods have different robustness levels (Section 2.33
Leveraging the compactness of CARDs, we develop test-time adaptive ensembling method, called a domainn-daapto CARD-Deck, that utilizes CARDs trained with existing techniques for improving OOD robustness. Resulting models set new SOTA performance [8] on CIFAR-10-C and CIFAR- while maintaining compactness (Section 3
Finally, we provide theoretical support for the CARD hypothesis and the robustness of the domain-adaptiv CARD-Deck ensembling method (Section 4

---

2 Is the inability to create CARDs fundamental?
Recent studies of the effects of model compression on OOD robustness have been mostly negative. For instance, Hooker et al. [6 showed that gradual magnitude pruning [60] of ResNet-50 [99] trained on ImageNet
44
caused accuracy to decrease by much as 40% on corrupted images
from ImageNet-C [23 while performance on the non-corrupted validation images remained strong.
Liebenwein et al.
32
reported similar findings for different pruning approaches [43] applied to
a ResNett-20 model 19
tested on an analogously cortupted dataset, -EFAR-1O-C. Consistent with
these findings, Hendrycks et
[25] found that increasing model size tended to improve robustness P
Critically, these studies suggest that model compression may be at odds with the simultaneous achievement of high accuracy and OOD (natural corruption) robustness. However, it's possible that these negative results are byproduct of inapt compression strategies and/or insufficient overparame- terization of the network targeted for compression. As such, to motivate the scientific question of interest and our empirical/theoretice analyses, we propose the following alternative hypothesis.
CARD Hypothesis. Given a sufficiently overparameterized neural network, a suitable model compression (i.e., pruning and binarization) scheme can yield compact network with comparable (or higher) accuracy and robustness than the same network when it is trained without compression.
2.1
Model compression approaches
For comprehensive analysis of existing pruning methods, we introduce a framework inspired by those in 43 51 that covers maditional-throug--emees
pruning methodologies. Broadly, this framework places a pruning method into one of three categories: (a) traditional, (b) rewinding- based lottery ticket, and (c) initialization-bast based (strong) lottery ticket. Specific pruning methods considered in these respective categories are: (a) fine-tuning and gradual magnitude pruning, (b) weight rewinding and learning rate rewinding, and (c) edgepopup and biprop. Precise definitions of these pruning methods and discussion of differences are available in Appendix [..I
prunes models once at the end of normal training, then fine-tunes the models for given number of epochs recover accuracy lost due to pruning: while gradual magnitude pruming (GMP) [60] prunes models throughout training. Weight rewinding (LTH) [12] 13 iterative like GMP but fully trains the network, prunes, rewinds the unpruned weights (and learning rate schedule) to their values early in training, then fully trains the subnetwork before pruning again; learning rate rewinding (LRR) 43 is identical to LTH, except only the learning rate schedule is rewound, not the unpruned weights. Finally, edgepopup (EP) [41] does not weight-train the network but instead prunes a randomly initialized network, using training data to find weights whose removal improves accuracy (notably, EP can, and does here, operate signed initialization); biprop (BP) 99] proceeds similarly but incorporates a binarization scheme resulting in a binary-weigh network regardless of the initialization used. For all of these methods, make of global unstructured pruning, which allows for different pruning percentages at each layer of the network. For BP and EP, we additionally consider layerwise pruning, which prunes the same percentage across all layers. We use the hyperparameters specifically tuned for each approach; see Appendix B for additional details.
Briefly, fine-tuning (FT) 18
2.2 Accuracy-robustnes comparison of global pruning methods
To test the CARD hypothesis, we use: five models (VGG 12 46 and ResNet 19 style architectures of varying size), five sparsity levels (50%, 60%, 80%, 90%, 95%), and six model compression methods (FT, GMP, LTH, LRR, EP, BP). For each model, sparsity level, and compression method, five realizations are trained on the CIFAR-1 10 training set (28) Model accuracy and robustness are measured using top-1 1 accuracy the CIFAR- 10 and CIFAR- 10-C test sets, respectively. CIFAR-10 10- contains 15 different common corruptions from four categories: noise, blur, weather, and digital corruptions As a baseline, we train 5 realizations of each model without compression.
In Figure T we plot our experimental results. Accuracy and robustness values are averaged over the five realizations and plotted relative to the average non-compeeseed baseline performance. The y-axis measures relative difference in percentage points. The mean baseline accuracy and robustness for each architecture is listed as the reference accuracy in each plot. The first row of plots indicate
For additional discussion of this and more related work, please see Appendix
3

---

accuracy (top-1 accuracy on CIFAR- 10 relative to baseline) while the second row indicate robustness (top-1 accuracy on CIFAR-IO relative to baseline). At each sparsity level, error bars extend the minimum and maximum relative percentage point difference across all realizations.
Convé
Conv6
Conv6
Vgg19
Resnet18
-19 @0
Percentagg of Weights Prured
Parcentage of Waighes Fruned
Parcercage of Weights Fruned
Percentage Weights Prunes
Percertage of Veights Pruned
Daseline iCenson
Stopp (Gibba))
Edpesspup (Gabba)
Time Turinunnn
Gredual Hagerbude Pruning
Leamiing Rate Rewirding
Conv4
Convis
ConvB
Vgg19
Resnet18
Reaatve Comuteed
Aartrancc 12.64) Parcoriage of Wogfts Fruned
Accu 5P%
Accuston 72
Felerance
Parentags of Weglhts frured
Parcornage of Woigls Fruned
Paccerfage of Weight Prunod
Pareriagg /Meggis Pruned
Figure I: Suitable pruning approaches can improve robustness over dense models: Comparing the Top-1 accuracy of pruned models relative to the average of dense baseline models CIFAR-10 and CIFAR- demonstrates that CARDs exist and can be produced using LRR, LTH, BP, or EP.
Our results for traditional methods, i.e., Fine-Tuunin and Gradual Magnitude Pruning, are consistent with previous works 26 32 as the robustness of models pruned using these methods degrades relative to the dense models', particularly in higher pruning regimes. However, we find that rewinding and initialization based pruning approaches consistently produce notable gains in robustness relative to dense baselines while matching (and sometimes surpassing) the accuracy of the dense baseline. In particular, the rewinding class of methods provide a consistent, moderate improvement to both accuracy and robustness while the initialization class provides more substantial gains in robustness even when the accuracy is slightly below the baseline accuracy. The significance of overparameteri zation finding highly compact CARDs using initialization methods evident for all architecture types, as the robustness of these models in higher pruning regimes improves at increasing levels of parameterization for a given architecture class. However, even in models with fewer parameters, we find that initialization methods are able to provide notable robustness gains.
Additional experiments involving initialization methods provided in Appendix C Specifically, a comparison of the performance EP and BP using layerwise and global pruning is performed in Section C.I and comparison of full-precision and binary-weight EP models in Section C.2 Empirical results in Section C.2 indicate that robustness gains provided by EP- and BP-pruned models may be feature of initialization pruning methods and not solely due to weight-binarizationn
2.3 Viewing the effect of compression on OOD robustness through a spectral lens
As CIFAR-10-C corruptions are limited to certain frequency ranges and combinations 55 it is of interest to validate if the robustness effects of different pruning methods observed in Section 2.2 hold on a broader ranges of frequencies. To this end, we perform a reqquency-domall analysis by utilizing the Fourier sensitivity method [55], which we briefly summarize below.
Given a model and test dataset, each image in the test dataset is perturbed using additive noise the form of 2D Fourier basis matrices, denoted by U2g E didxxd Specifically, for an image X and a 2D Fourier basis matrix Us, a perturbed image is computed by X1,, = X + reU,,g, where r is chosen uniformly at random from (-1, and 0 is used to scale the norm of the perturbation. Note that each channel of the image is perturbed independently. Given a set of test images, each Fourier basis matrix can be used to generate a perturbed test set of images on which the test error for the model is measured, Plotting the error rates as a function of frequencies (i. yields the Fourier error heatmap of model visualization of the sensitivity of model different frequency perturbations in the Fourier domain. Informally, the center of the heat map contains perturbations corresponding to the lowest frequencies and the edges correspond to the highest frequencies.
We generate heatmaps for models corresponding to each pruning method as well as layerwise pruned models using EP and BP. The norm of the perturbation, E, is varied over the set {3, 4, 6) to represent

---

low, medium, and high levels of perturbation severity. As reference, we include heatmaps for the dense compcospress)d) baseline model. Fourier heatmaps for the Conv8 architecture 80% prune percentage are provided in Figure while additional heatmaps can be found in Section D
Edgepooup
Edgepopup
Biproo layersite
Biprop
88
32
Figure 2: Visualizing the response of compressed models to perturbations different frequen- cies: The top three rows are Fourier heatmaps for Conv8 trained on CIFAR- 10 with 80% of weights pruned. The bottom three rows are difference to the baseline with blue regions indicating lower error rate than baseline. Init. methods provide up to 50 percentage point improvement in some instances.
Figure illustrates that initialization pruning methods reduce the error rate across nearly the full spectrum of Fourier perturbations relative the dense model. Additionally, initialization pruming methods using layerwise pruming present a different response, eтror rate, at certain frequency corruptions when compared heatmaps of global initialization pruning methods. The difference heatmaps show that rewinding methods offer mild to moderate improvements across much of the frequency spectrum with LRR outperforming LTT in a few regions of the heatmap. The difference heatmaps also highlight that traditional methods degrade the robustness to more Fourier perturba- tions than other compression methods and result in an increased error of 10 percentage points (relative to the dense baseline) in some cases. These findings further suggest that the robustness of compressed model is dependent on the compression method used or the resulting structure of sparsity. In Appendix E we provide additional heatmaps to examine the impact on robustness when varying the number rewinding steps used by rewinding methods.
To summarize, we have empirically verified our CARD hypothesis by demonstrating that "lottery ticket- style" compression methods can produce compact models with accuracy and robustness comparable to (or higher than) their dense counterparts.
3 Creating winning hand of CARDs
Having demonstrated that certain model compression techniques are capable of producing CARDs, we explore using existing techniques for improving model robustness in conjunction with compression strategies to produce CARDs that further improve robustness. We consider three popular existing strategies for improving model robustness and, further, propose a test-time adaptive ensembling strategy, called domain-adaptive CARD-Deck, that leverages these strategies to maintain compactness and efficiency while improving accuracy and robustness over individual CARDs.

---

3.1 Popular strategies for improving model robustness
Data augmentation. A popular approach for improving robustness involves data augmentations. We consider two augmentation techniques that are (at the time of writing) leading methods on Robust- Bench [8. The first is AugMix [24] which can provide improved robustness without compromising accuracy by randomly sampling different augmentations, applying them to training image, then "mixing" " the resulting augmented image with the original. The second method independently adds Gaussian noise N(u = 0, a 0.1) to all the pixels with probability 0.5 (27].
Larger models. Another popular strategy for improving OOD robustness (and accuracy) in the robust DL community is to increase the model size (e.g., [2] 16, 8 D. Hence, we also consider this strategy to investigate if the performance of CARDs can be amplified by compressing larger models.
Model Ensembling. It is natural to consider exploiting CARD compactness to amplify accuracy and robustness by ensembling [40] CARDs. For example, an ensemble of two to six CARDs pruned to 95% sparsity only uses 10% to 30% of the parameter count required by a single dense model.
3.2 Playing the right CARD to improve accuracy-robustnes performance
Ensembling CARDs trained with hate-of-theear data augmentation techniques has the potential to provide additional robustness gains. We call such ensembles CARD-Decks and propose two strategies: (I) aagnoiic CARD-Decks and (2) Nomain-adaptin ensemble consists of CARDs that have been trained on the same dataset under different augmentation schemes. The domain-adaptive CARD-Deck utilizes spectral-simillarity metric select subset of CARDs from the CARD -eck that should be used to make predictions based on the current test data. We first define this metric then provide formal definitions for both CARD-Deck methods.
CARD-Decks. In both strategies, the
A spectral-similaris metric. Let Teroin E RD D denote the N unaugmented training im- ages of dimension Di D2, A {ax [ak]k=1 denote set of m different augmentation schemes, and (z) denote a sampling of P images from x where augmentation a E A has been applied to Motivated by our analysis using Fourier heatmaps, we propose a spectral-similariis met- ric to compare representatives from augmented versions of the training sets, (Ftraii)))) to the test data. First, we define F()) as a map that computes the ID radially-averaged power spectrum for images of dimension Di x D2 then takes the reciprocal of each component. Our spectral-similarity metric is a map das D2 x RD DDxx + R defined by daa(X, Y) minigig P [((F(x))/11F(())
found that the ID power spectra for different augmentation types were more separable in the higher frequencies of the power spectrum leading to the use of the reciprocal in the definition of F(-).
TV ا (FXX)) In practice,
A "winning hand" of CARDs by test-time ensembling.
Ann-CARD-Decl ensemble is composed where a# one of the m augmentation schemes from
of n CARDs given by f Deck = (f [fxx ) A and the superscript in fox denotes that this CARD was trained used data from the distribution Sop (Ztrain). Our domain-agnostic n-CARD-Decce averages the prediction of all n CARDs in the deck. Supposing that the output of each CARD in Deck is softmax vectors, then the output of the domain-agnoste n-CARD-Deck can be expressed as 2. EE=1 fd (IItett. In our BARD-Deck, a gating module uses the spectral-similartty metric das determine which augmentation method is most similar to batch of M test images Ptest E R RDxx D.x provided to the ensemble. When an augmentation scheme, say a E A, identified as the most similar to the incoming test data, the domain-adaptive CARD-Deck utilizes only the CARDs that were trained using the data from the distribution (atrrin))) The set of the most similar augmentations is given by a" e arg minge A dss (Strran))),) Ttest). We note that a* is likely to be singleton set indicating that a single augmentation scheme most similar. If the adapivee CARD-Deck contains multiple CARDs trained using the same data augmentation scheme, prediction averaging is used on these CARDs and returned as the CARD-Dece prediction. Given a* and letting I(a) = {k : as E a). the output of the domain-adaptive CARD-Deck can be expressed as [ı(ي"]] EkeT(e-) for (Ztest). ). As computing the
scheme is independent of CARD evaluation, the domain addaive CARD-Deck provides reduced inference time over the domain-agnostii CARD-Deck by only evaluating the CARDs design.
necessary for prediction. Figure provides an illustration of the

---

Gating Function
Beturn augmertation from sumertatioo,,
A +0,4,, ,ir e sugrentation
argmin dh (S,, Merattt)..eee
p(w, (xper>
Fivaee My
Averaging CARDs
Input
Evakate each CAlD CARD-Dect Deck trained most simlar sugnentation, e" ther aarage pradictions:
Output
Xtest
p(W, 1|Rrer
Y
=
CARD
Feaeh Wey
Figure 3: Selecting "winning hand" using a domain-adaptive CARD-Decks CARDs are grouped based on the data augmentation scheme used during training. At test time, gating function identifies the augmentation scheme, a' with data most similar to the test data. The CARDs trained using a" are used and the average prediction is returned as the output.
3.3 Experimental results
experiment with four models of increasing size (ResNeXt-29, ResNet-18, ResNet-50, WideResNet-18-22 three data augmentation methods (clean, AugMix. Gaussian), two sparsity levels (90%, 95%), and six compression methods (LTH, LRR, EP (layerwise and global), BP (layerwise and global)). For each model, sparsity level, data augmentaion method, and compression method, three realizations are trained on CIFAR-10 (28 and robustness is measured using CIFAR-1O-C. Model compactness is measured by calculating the memory usage [4]] Similar experiments performed for CIFAR-100 100 and CIFAR-100-C. however only WideResNet-I82. and four model compression methods (LTH, LRR, EP (global), BP (global)) used. As baseline, three realizations of each model are trained without compression for each data augmentation method. Visualizations of key results provided in this section and detailed ablation studies in Appendix F
In addition to measuring the performance of CARDs for each configuration (i.e. model, data augmen- tation, compression method, sparsity level), we also formed Nomain-agnoste and domain-adapy adaptive n-CARD-Decke size n E {2, 4, 6) comprised of models using the same compression method and sparsity level. For each n-CARD-Decck half of the CARDs were trained using AugMix and the other half were trained using the Gaussian augmentation. To facilitate computation of the spectral-similarity metric in domain- domain-adaptive CARD-Decks, for each augmentation method {AugMix Gaussion) we statically created a KD-Tree containing FXX)/IF((X) for all X periments, we took P = 5000 and these KD-Trees were generated once and saved (separate from inference process). At test time, batches M 100 test images were used in the spectral -immlarty metric to determine which augmentation method best represented the corrupted test data.
). In our ex-
Test-time ensembling can provide a "winning hand". Figure 4 provides a visualization of the performance (accuracy, robustness, and memory usage) of several CARDs and CARD-Decks well as dense baselines and the previous SOTA model. This figure highlights our findings that both CARD-Deck methods, canniin and adaptive, are capable of improving the performance beyond the dense baselines while maintaining reduced memory usage. Notably, we found a single LRR CARD (a WideResNet- 18 96% sparsity) trained with AugMix can attain 91.24% CIFAR-10-4 accuracy, outperforming dense ResNeXt-29 trained with AugMix (a state-of ffate-of-thh-ar among methods that not require non-CIFAR- 10 training data) by more than percentage points simply by pruning a larger model, i.e., WideResNet-Il 18. Our best performing 6-CARD-Ded -Deck using LRR WideResNet- 18 models (53.58 MB) sets a new state-of-the-art for CIFAR-10 and CIFAR-10-C accuracies of 96.8% and 92.75%, respectively. In contrast, the previous best method 66] achieves accuracies (94.93%.

---

72
Red (CARD)
LRK,AR2
Red (CARD)
Rad (CARD Deck)
Raid (CARD Deck)
Robustness (CIFAR-1O4 10-1 Top Acc.)
92
Init (CARD-Desk))
Baslet-50
Robustness (CIFUR-100-C 1 Acc.
Irat (CA/ID-Deck)
Prior SOTA
Prior SOTA
90
66
Den A.
CanAz
Risitetl-29
an,
88
64
62
86
60
84
93
95 Accuracy (CIFAR-10 Top 1 Acc.)
97
70
72
76
78
Accuracy (CIFAR-100 Top 1 Acc.)
(a) CIFAR-IO-C
(b) CIFAR-100-C
Figure 4: Accuracy robustness, and memory trends. CARDs and CARD-Decks reduce memory usage (as indicated by the area of each circle) while achieving comparable or improved accuracy (x-axis) and robustness (y-axis). Annotation indicates (Compression Method, Data Augmentation, ResNet- 18 Width) with A for AugMix, G for Gaussian, and AG for both (used by CARD-Decks
92.17%) using increased memory (ResNet-50 with 94.12 MB), extra data (a super resolution network was pre-trained with non-CIFAR-10 data), and computationally expensive adversarial training procedure. More impressively, our computationally lighter binary-weight CARD-Decks provide comparable accuracy and robustness the dense baseline with memory usage as low 1.67 MB. Similar trends hold on CIFAR- where rewinding Nomain-adaplee
set new
SOTA performance (80.6%, 71.3%) compared the previous best (78.90%, 65. 14%) [24]. Note that the binary-weight CARD -Decks provide almost 5 percentage point robustness gain over the previous best at only 9% the memory usage. Note that the performance of EP and BP CARD-Decks can be further improved by leveraging more computationally expensive training procedures, e.g., tuning batchnorm parameters or searching for EP and BP CARDs in pretrained neural nets.
To summarize, CARD-Decks can maintain compactness while leveraging additional robustness im- provement techniques, LRR CARD-Decks set new SOTA on CIFAR-IO-C and CIFAR- 1-0-C in terms of accuracy and robustness, binary-weight CARD-Decks can provide up to 105x reduction in memory while providing comparable accuracy and robustness, and the domain- addatiee CARD-Decks used here are ~22x faster than the Nomain-agnoston inference. Additionally, for 2-CARD-Decks our domain-adaplln method provides an average robustness gain of 1-2 percentage points over the domain-agnostic method (see Appendix
HARD-Decks only half of the CARDs are used
4 Theoretical justifications
This section provides (1) theoretical results that provide support for the CARD hypothesis beyond what we demonstrated empirically and (2) robustness analysis for domain-adaptive CARD-Deck strategy.
4.1 Function approximation view of CARDs
By leveraging cxisting theoretical analyses of the Strong and Multi-Prie Lottery Ticket Hypotheses 39 38, 91. we can provide thcoretical support for the CARD hypothesis. While we were able to empirically produce CARDs within the same architecture used by the dense model, prove theoretical results supporting the CARD hypothesis using existing techniques requires that the compressed network be searched for within architecture larger than the architecture used for the dense model. An informal version of this result for binary-weight CARDs is provided here relevant to models produced by joint pruning and binarization compression strategies such multi-prize tickets 9

---

Theorem 1. Given a compooeeeeed network F with depth & and width w with bounded weights that achieves a desired target accuracy and robustness, a random binary network of depth 24 and width O ((ew)/2/e) + Ew log(tw/ /8) contains with probability (1 -5) a hinary-weightte CARD that approximates the target non-compressed network with error at most e, for any E, > O.
We note that Theorem follows immediately from Theorem 2 in [9] and, thereby, refer the reader to Theorem 2 in [9] for a formal statement $ This result provides a level of confidence with which one can expect to find binary-weight CARD that is an e-approximation of a target (i.e. trained and non-compressed) network. For full-precision weight CARDs, tighter bounds on the depth and width of fully-connected network with ReLU activations containing CARD that is E-approximation of a target network follow from Theorem 3 in [8] which also utilizes a more relaxed hypothesis set. Hence, theoretical results supporting the existence of both full-precision and binary-weight CARDs, with high probability, provided that sufficiently overparameterized network is used.
I Leveraging these theoretical results, we provide a corollary on the approximation capabilities of CARD-Deck. We denote by F(e, w) a fully-connected neural network with ReLU activations where & denotes the depth of the network and w = [wo, wi...., we] E M is a vector where component i f? denotes the width of layer in F and wo denotes the input dimension of F.
Corollary (CCARD-Deckl Approximation Theorem). Let E > 0, 5 > 0, n 2 1, and X [A1,...,.0 Xn] satisfying Σx= A 1 and A 0. for all & E [n], be given. Let F {FFi wx)) be deck of non-compressed fully-connected networks with ReLU activations. the input space X and each network in the collection F satisfies the hypotheses of Theorem 3 in 138] (Theorem 2 in (2), then with probability (1 - 8)th there exists a deck of n full- full-precision (binary-weight) CARDs denoted fDeck- = {fk Vi=z of depth and width specified by Theorem 3 in (38] (Theorem 2 in (9) such that
Σ fxff(a)) Σ (a) Ss.
sup TEA
(1)
proof of Corollary is provided in Appendix G Note that the target con-compressed networks in Corollary CorollaryBccould be trained on data sampled from augmented distributions, such as augmented distributions using the AugMix and Gaussian methods, provided that the weights of the resulting networks satisfy the hypothesis required from the existing results in [38 9 Additionally, the
appropriate choice of À in Corollary 2
can yield donain-agnostic or domain-adaptive CARD-
4.2 Robustness analysis of CARD-Deck
To provide the theoretical justification behind our CARD- -Dec approach over single classifier, we first define a robustness measure for given classifier ensemble trained on a set of augmentations w.r.t. a corruption set encountered at the test- time. We assume that each test sample may encounter a specific corruption type e from given OOD set and be transformed to a corrupted test sample x,. Let us assume l is learnt using a learning algorithm I, using the augmented training data S. sampled from distribution Da: thus, we have Beck = (f T.(S.)la E N4) where N4 (1,..., A). Let us denote by Sa an empirical distribution w.r.t. sampled dataset Sa-
Definition 1 (Average OOD Robustness). Lei Deck = [1 E NA] denote CARD -ARD- trained using an augmentation set S = {Sa ~ Dala E NAJ. We define the average distrribbtti robustness for a CARD-Deck w.r.t. corruption set DC (Delc E NO) as
IAI [C|
Rob(DC Deckk) = ΣV c=1==
Rob(De,
where Rob(De: EF [inf (o d(z'., xx)] with z'. being a perturbed version of Te- d corresponds to distance metric, and wi denotes the probability of f fDock gating module selecting the classifier f to make prediction on test data coming from corruption type c.
This definition refers to the expectation of the distance to the closest misclassified corrupted sample for given test sample. Note that this is a stronger notion of robustness then the generalization error corresponding to corrupted data distribution. Having this definition, our goal is to provide lower bound on the average OOD robustness of Deeck and show that the use of domain-adaptio classifier
Following the acceptance of this paper, improved bounds the depth and width have been established 47

---

ensemble achieves a better OOD robustness compared to the case where we use just single classifier T To understand this quantity better, we derive the following decomposition (see Appendix G
Rob(D , Prack
Σ w
[oo((S.,
[ob(DD., f²) Rob(SS. [')] ||obbDD,, f") Rob(DD., f()]]]
(a)
(b)
This shows that the average OOD robustness can be bounded from below in terms of the following three error terms for a /lassiiiercoorrutiionn pair weighted by their selection probabilities: (a) empirical robustness, (b) generalization gap, and (c) out-of cofo-iitributionsshitt bound the average OOD robustness, we need to bound both the generalization gap and the OOD-shift Next, we provide a bound on the OOD-shift penalty that is independent of the classifier f and is only related to the closeness of the augmented data distribution and corrupted data distribution. The closeness is defined in terms of Wasserstein distance ((,-) (see Definition
This implies that in order to
2 in Appendix G
Theorem 3 (Average OOD-Shift Bound), For any CARD-Deck. the average OOD-shift (i.e., ADS Ee,e Rob(De, f*) - Rob(Da: f()ll) can be bounded as follows ADS S
Σ ΣAA 1= Σ _ w Da).
Proof. This result can be proved by applying Theorem in 45 to ADS.
Key insights. Theorem 3 provides some key insights into the OOD robustness of classifiers trained on augmented datasets. First, unlike the generalization gap, the OOD-shift does not converge to zero with more augmentation data. This imposes a fundamental limit on the OOD robustness in terms of the distance between augmented train data distribution and corrupted test data distribution. Second, having diverse augmentations is critical to improving the OOD robustness. Also, it highlights that existing solutions trained with single augmentation scheme might just be getting lucky overfitting to the corrupted test data. Finally, the commin-addative is provably better than using single classifier because it can achieve the minimum conditional pairs.
with a suitable gating function
Wasserstein distance (or best achievable OOD robustness) over given
5 Limitations and future directions
In this paper, we showed that model compression and high robustness (and accuracy) are not necessarily conflicting objectives. We found that compression, if done properly (e.g.. using "lottery ticket-style" objectives), can improve the OOD robustness compared to a non-compressed model. Leveraging this finding, we proposed simple -adatiiv ensemble of CARDs that outperformed existing SOTA terms of the clean accuracy and the OOD robustness (at fraction of the original memory usage). Our results are consistent with past results in that we also show that the use of test accuracy alone to evaluate the quality/deployability of a compressed model in the wild is not sufficient-on one needs to adopt harder metries such as OOD robustness. However, opposed to the existing works in this direction, we present a construction that satisfies these "harder" requirements.
There are still many interesting questions that remain to be explored. First, while we were able to produce CARDs remains unclear (i) why only certain pruning strategies were able to produce them and (ii) why introducing compression can improve "effective robustness" [49] (e.g. Conv and VGG19 BP and EP models in Figure [I). Second, the spectral relationship of train and test data (as considered in this work) is not the only interaction determining the performance of a compressed model. It will be worthwhile to take a more holistic approach that also takes spectral behavior of the compressed model (e.g., using intermediate features) into account, which could possibly benefit from using CARDs compressed via different strategies when building "winning hand". Third, we only derived an upper bound on the amount of overparameterization needed to approximate target dense network in our theoretical analysis; it will also be interesting to explore a lower bound (a necessary condition) the same which may indicate scenarios where the proposed approach will not work (e.g., underparameterized NNs). Fourth, "lottery ticket-style" models in theory can be found more efficiently, which was not our focus but is valuable future direction. Finally, achieving the theoretical memory savings obtained from CARDs (reported in this paper) would require their implementation on specialized hardware. We hope that results will help researchers better understand the limits of compressed neural nets, and motivate future work on CARDs and their applications to areas where DL struggles currently due to its parameter- parameter-inefficienny inefficiency and OOD brittleness.
10

---

Acknowledgements
We would like thank the reviewers for their valuable discussion during the rebuttal period that resulted in improved clarity and presentation of our research. This work was performed under the auspices of the U.S. Department of Energy by the Lawrence Livermore National Laboratory under Contract No. DE-AC52-07NA27344 and LLNL LDRD Program Project No. 20-ER-014 (LLNL-CONF-82380))
References
[1] Subutai Ahmad and Luiz Scheinkman. How can we be so dense? the benefits of using highly sparse representations. arXiv preprint arXiv:1903. 1257, 2019.
[2] Cenk Baykal, Lucas Liebenwein, Igor Gilitschenski, Dan Feldman, and Daniela Rus. Sipping neural networks: Sensitivity-informee provable pruning of neural networks. arXiv preprint arXiv:1910.05422, 2019.
[3] Kshitij Bhardwaj and Maya Gokhale. Semi-supervised on-device neural network adaptation for remote and portable laser-induced breakdown spectroscopy. arXiv preprint arXiv:2104.03493 2021.
[4] Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models few-shot learners. arXiv preprint arXiv:2005. /4165, 2020.
[5] Saikiran Bulusu, Bhavya Kailkhura, Bo Li, Pramod K Varshney, and Dawn Song. Anomalous example detection in deep learning: A survey. IEEE Access, 8: 8:13330013222 2020.
[6] Dan A Calian, Florian Stimberg, Olivia Wiles, Sylvestre-Alvise Rebuffi, Andras Gyorgy, Timothy Mann, and Sven Gowal. Defending against image corruptions through adversarial augmentations. arXiv preprint arXiv:2104.01088: 2021.
[7] Matthieu Courbariaux, Yoshua Bengio, and Jean-Pierre David, Binaryconnect: Training deep neural networks with binary weights during propagations. In Advances in neural information processing systems, pages 1123-3131, 2015.
[8] Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670, 2020.
[9] James Diffenderfer and Bhavya Kailkhura. Multi-prize lottery ticket hypothesis: Finding accurate binary neural networks by pruning randomly weighted network. International Conference on Learning Representations, 2021.
[10] Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware mini- mization for efficiently improving generalization. arXiv preprint arXiv:2010.01412, 2020.
[11] Jonathan Frankle. Openlth: A framework for lottery tickets and beyond, 2020. URL https /ggthab..com/aaceookrreeecc.
[12] Jonathan Frankle and Michael Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks. arXiv preprint arXiv: 03635, 2018.
[13] Jonathan Frankle, Gintare Karolina Dziugaite, Daniel Roy, and Michael Carbin. Linear mode connectivity and the lottery ticket hypothesis. International Conference on Machine Learning, pages 3259-3269. PMLR, 2020.
[14] Trevor Gale, Erich Elsen, and Sara Hooker. The state of sparsity in deep neural networks. arXiv preprint arXiv: 1902::1902.0990 09574, 2019.
[15] Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1.
MIT press Cambridge, 2016.
[16] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
[17] Song Han, Huizi Mao, and William J Dally. Deep compression: Compressing deep neural net- works with pruning, trained quantization and huffman coding. arXiv preprint arXiv: 2015.
11

---

[18] Song Han, Jeff Pool, John Tran, and William J Dally. Learning both weights and connections for efficient neural networks. arXiv preprint arXiv:7506026226 2015.
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015.
[20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks, 2016.
[21] Yihui He, Xiangyu Zhang, and Jian Sun. Channel pruning for accelerating very deep neural networks. In Proceedings of the IEEE International Conference on Computer Vision, pages 1389-1397, 2017.
[22] Yihui He, Ji Lin, Zhijian Liu, Hanrui Wang, Li-Jia Li, and Song Han. Ame: Automl for model compression and acceleration on mobile devices. In Proceedings of the European Conference on Computer Vision (ECCV), pages 784-800, 2018.
[23] Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv: 1903. 12261, 2019.
[24] Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method improve robustness and uncertainty.
arXiv preprint 191.iv:9122.022 2019
[25] Dan Hendrycks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Zhu, Samyak Parajuli, Mike Guo, et al. The many faces of robustness: A critical analysis of out-of-distribution generalization. arXiv preprint arXiv:2006. 16241, 2020.
[26] Sara Hooker, Aaron Courville, Gregory Clark, Yann Dauphin, and Andrea Frome. What do compressed deep neural networks forget? arXiv preprint arXiv: 1.05248, 2019.
[27] Klim Kireev, Maksym Andriushchenko, and Nicolas Flammarion. On the effectiveness of adversarial training against common corruptions. arXiv preprint arXiv:2 103.02325, 2021.
[28] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[29] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25:1097- 1105, 2012.
[30] Yann LeCun, John S Denker, and Sara A Solla. Optimal brain damage. In Advances in neural information processing systems, pages 598-605, 1990.
[31] Hao Li, Asim Kadav, Igor Durdanovic, Hanan Samet, and Hans Peter Graf. Pruning filters for efficient convnets. arXiv preprint arXiv: /608v./608.088 /60.660080., 2016.
[32] Lucas Liebenwein, Cenk Baykal, Brandon Carter, David Gifford, and Daniela Rus. Lost in pruning: The effects of pruning neural networks beyond test accuracy. arXiv preprint arXiv:2103.03014 2021.
[33] Xiaofan Lin, Cong Zhao, and Wei Pan. Towards accurate binary convolutional neural network. In Advances in Neural Information Processing Systems, pages 345-353, 2017.
[34] Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. Rethinking the value of network pruning. arXiv preprint arXiv: 1810.05270. 2018.
[35] Christos Louizos, Max Welling, and Diederik P Kingma. Learning sparse neural networks through 1_0 regularization. arXiv preprint 17Xiv: 2017.
[36] Dmitry Molchanov, Arsenii Ashukha, and Dmitry Vetrov. Variational dropout sparsifies deep neural networks. In International Conference on Machine Learning, pages 2017.
PMLR,
[37] Sharan Narang, Erich Elsen, Gregory Diamos, and Shubho Sengupta. Exploring sparsity in recurrent neural networks. arXiv preprint arX1v:100..05119, 20177
[38] Laurent Orseau, Marcus Hutter, and Omar Rivasplata. Logarithmic pruming is all you need, In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 2925-2934. Curran Associates, Inc., 2020.
[39] Ankit Pensia, Shashank Rajput, Alliot Nagle, Harit Vishwakarma, and Dimitris Papailiopoulos. Optimal lottery tickets via subsetsum: Logarithmic paramtterizaaionn is sufficient, 2021.
12

---

[40] Robi Polikar. Ensemble learning. In Ensemble machine learning, pages 1-34. Springer, 2012.
[41] Vivek Ramanujan, Mitchell Wortsman, Aniruddha Kembhavi, Ali Farhadi, and Mohammad Rastegari. What's hidden in randomly weighted neural network? In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognition, pages 1 11893-11900 1990,, 2020.
[42] Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. Xetr-net: Imagenet classification using binary convolutional neural networks. In European conference on computer vision, pages 525-542. Springer, 2016.
[43] Alex Renda, Jonathan Frankle, and Michael Carbin. Comparing rewinding and fine-tuning in neural network pruning, 2020.
[44] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journall of computer vision, 1 115(3):111-252 2015.
[45] Vikash Schwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateck Mittal. Improving adversarial robustness using proxy distributions. arXiv preprint arXiv:2104.094 2021.
[46] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv 1409.1556, 09 2014.
[47] Kartik Sreenivasan, Shashank Rajput, Jy yong Sohn, and Dimitris Papailiopoulos. Finding everything within random binary networks, 2021.
[48] Mingxing Tan and Quoc V Le. Efficientnetv2: Smaller models and faster training. arXiv
preprint arXiv: Moxxx:2/04.00 104.00298, 2021.
[49] Rohan Taori, Achal Dave, Vaishaal Shankar, Nicholas Carlini, Benjamin Recht, and Ludwig Schmidt. When robustness doesn't promote robustness: Synthetic vs. natural distribution shifts on imagenet. 2019.
[50] Bindya Venkatesh, Jayaraman J Thiagarajan, Kowshik Thopalli, and Prasanna Sattigeri. Cali- brate and prune: Improving reliability of lottery tickets through prediction calibration. arXiv preprint arXiv:2002.00 03875, 2020.
[51] Huan Wang, Can Qin, Yulun Zhang, and Yun Fu. Emerging paradigms of neural network pruning. arXiv preprint arXiv: 103.06660, 2021.
[52] Shufan Wang, Ningyi Liao, Liyao Xiang, Nanyang Ye, and Quanshi Zhang. Achieving adver- sarial robustness via sparsity. arXiv preprint 2tti::20000552222 2020.
[53] Wei Wen, Chunpeng Wu, Yandan Wang, Yiran Chen, and Hai Li. Learning structured sparsity in deep neural networks. arXiv preprint arXiv::608 03065, 2016.
[54] Yinghao Xu, Xin Dong, Yudian Li, and Hao Su. A main/subsidiary network framework for simplifying binary neural networks. In Proceedings of the IEEE/CV Conference on Computer Vision and Pattern Recognition, pages 7154-7162, 2019.
[55] Dong Yin, Raphael Gontijo Lopes, Jon Shiens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. In Advances in Neural Information Processing Systems, volume 32, 2019.
[56] Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. arXiv preprint arXiv:/611.033. 2016.
[57] Dinghuai Zhang, Kartik Ahuja, Yilun Xu, Yisen Wang, and Aaron Courville. Can subnetwork structure be the key to out-of-distributio generalization? arXiv preprint arXiv:2106 02890, 2021.
[58] Aojun Zhou, Anbang Yao, Yiwen Guo, Lin Xu, and Yurong Chen. Incremental network quanti- zation: Towards lossless cnns with low- cow-precision weights. arXiv preprint 1eX.v:172.00311 2017.
[59] Shuchang Zhou, Yuxin Wu, Zekun Ni, Xinyu Zhou, He Wen, and Yuheng Zou. Dorefa-net: Training low bitwidth convolutional neural networks with low bitwidth gradients. arXiv preprint 2016.
[60] Michael Zhu and Suyog Gupta. To prune, or not to prune: exploring the efficacy of pruning for model compression, 2017.
13


Reviews:
[{"review_id": "_c5xxCbKw3Z", "reviewer": "Reviewer_erM7", "summary": "This paper performs an empirical study on the OOD robustness of compact models and shows the existence of compact, accurate, and robust DNNs (CARDs). It gives a frequency-domain analysis with the Fourier sensitivity method to explain why different pruning methods lead to compact models with varying OOD robustness. Then, the paper proposes CARD-Deck, a domain-adaptive test-time ensembling approach, to dynamically choose an appropriate CARD for each test sample using a spectral-similarity metric and presents some experimental results with CARD-Decks. Finally, it provides some theoretical analysis to support the existence of CARD and the ability to find a CARD with CARD-Deck.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "**Originality**:\n\nThe paper tries to show that compact, accurate, and robust deep neural networks (CARDs) exist and to develop efficient algorithms to design CARDs that give comparable or better OOD robustness compared to the SOTA dense DNNs. These problems are important and it is novel that the paper points out compression can improve OOD robustness if done properly. Also, this work uses the existing Fourier sensitivity method to study the OOD robustness with different pruning approaches, which is valuable.\n\n**Quality**:\n\n1. The first part of the paper (sections 2 & 3), which discusses the observations on model OOD robustness with different pruning approaches and the Fourier sensitivity studies, is sound and the presented results support most of the claims in the paper.\n\n    * Here is a question regarding FT and GMP results in Figure 1 and Figure 3: in Figure 1, compared to the dense baseline, FT and GMP have higher Top-1 accuracy on CIFAR-10 and lower Top-1 accuracy on CIFAR-10-C. However, in Figure 3, the center of the heatmaps for FT and GMP indicates lower accuracy on clean data and higher robustness to the OOD data following the logic presented in lines 186-191. The conclusions given by the two figures are contradictory. How to explain this?\n\n2.  The second part (section 4) talking about CARD-Deck is very confusing. I have several questions regarding it:\n    * What is the difference between CARD-Decks of size 2, 4, and 6?\n    * Given the first part of the paper talking about different pruning approaches leads to different OOD robustness, I expected to see a CARD-Deck containing models compressed with different pruning approaches and adaptively selecting models with an approach with the highest OOD robustness. However, according to the results in Table 2, it seems that a CARD-Deck only containing models trained with 2 augmentation schemes and compressed with a single pruning approach. Is there any reason for it? A CARD-Deck containing models compressed with only a single pruning approach is less attractive.\n    * It is not clear how CARD-Deck achieves the clean and robust accuracies presented in Table 2. In Table 1, the highest clean accuracy and robust accuracy with LRR is 96.1 and 89.8 given by Augmix. Why with CARD-Deck, LRR can achieve a clean accuracy of 96.6 and robust accuracy of 92? It may be worth spending more space to explain the experiment setups and results.\n    * Given the results in Table 2, the improvement brought by Adaptive CARD-Deck is not significant compared to the Agnostic counterparts. Therefore, what is the benefit of CARD-Deck? It would be better to clearly point it out in the paper.\n\n**Clarity**:\n\nThe paper is not well organized, and the presentation of the second half (starting from section 4) needs improvement. The description of experimental results is too brief so that it is hard to tell what is the benefit brought by CARD-Deck. The theoretical justifications are also vague. It is not clear what insight or guidance they can provide. I don’t see a strong connection between the CARD approximation theorem and the empirical observations in the paper. It cannot guarantee the existence of CARDs. Also, it cannot explain why “lottery ticket-style” pruning approaches are able to improve the OOD robustness over dense models. Section 5.2 is also unclear. I would recommend putting some formal analysis to the main paper instead of leaving everything in the appendix.\n\n**Significance**:\n\nThe idea of studying the existence of CARDs and comparing how different pruning methods affect the OOD robustness of compressed models are valuable and advance our understanding of the connection between model compactness, pruning methods, and OOD robustness. Also, the idea of selecting CARD given the spectral similarity metric is likely to be useful.\n\n**Overall recommendation**:\n\nMy overall score for this paper is 4. As stated above, the paper asks important questions and provides valuable observations. However, the presentation needs improvement; the experiments need better design and explanation, and it is better to make the theoretical analysis more relevant to the main ideas of the paper.\n\n\n**Updates to the Review post rebuttal**\n\nI appreciate the authors' detailed responses to all the reviews. These responses addressed most of my questions and concerns. I have raised my rating.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "5"}, "extra_text": {}}, {"review_id": "Z_H18FuBPiR", "reviewer": "Reviewer_JSRv", "summary": "This paper studies on whether pruning is able to improve the model robustness. This paper first show that with a proper pruning algorithm, the robustness can be achieved. Then a spectrum analysis is proposed to visualize what kind of heat map is suitable for robustness. Thirdly, a test-time augmentation approached is proposed to further improve the robustness.", "questions": "", "limitations": "", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The direction this paper studied is interesting while there are several important points regarding the significancy of the result needs discussions.\n\n1. To draw the main conclusion on what kind of pruning algorithm can improve the robustness, only one kind of bench mark (Cifar-10 on label corruption) is tested. This makes the conclusion less convincing. How about adversarial robustness? OOD detection? Calibration? The robustness so far is quite limited and the dataset test is also quite limited.\n\n2. I appreciate the analysis through the heat map, which is very interesting. However, despite that it is a successful visualization, it still didn't give answer to the most important question: why pruning is helpful for robustness. For example, if we train the network use some standard approach for robustness, is the heat map of pruning close to the network using robust training? If so, why this happens. I understand it is hard to really give a very comprehensive explanation but to me, the current analysis is more close to listing the observations.\n\n3. Although pruning can improve the robustness, but more important experiment is to show, combined with the training algorithm that improves the robustness, whether pruning can further enhance the robustness above that. To seriously achieve the robustness, people will use non-standard training approach. How's the pruned network's robustness performance compared with that? How much improve you can further achieve above that?", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "N/A", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "2.5h"}, "extra_text": {}}, {"review_id": "QIZA1RnAOCJ", "reviewer": "Reviewer_kbDD", "summary": "The authors evaluate several pruning techniques and their impact on accuracy and robustness on CIFAR10. They perform a spectral analysis of Fourier domain errors and attempt to link those to OOD robustness. They propose an ensembling approach based on the spectral properties of unlabeled test images.", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### Pros:\n\nI think the question of achieving robustness and efficiency at the same time is interesting and very relevant. I also think that this is an under-explored question and agree with the authors’ statement in line 53: “Perhaps surprisingly, the current solution in the robust ML community to improve the OOD robustness (and accuracy) is to increase the model size (e.g., [21, 13] and [6]).” It would be great if we had small and efficient models that are robust and accurate.\n\n### Cons:\n\nThe authors oversell their results in all performed experiments. They speak of “drastic” gains, “dramatically more robust” models etc. Looking at the results, the robustness gains are on the order of 6-8 percent points for the smaller models and on the order of 1-2 percent points for the larger and thus, more interesting models. Given that their findings do not produce significant gains for their best model, I doubt that this analysis would actually scale to ImageNet. Since their small models with the larger gains have around 88% clean accuracy on CIFAR10, I do not find an analysis on those models particularly interesting, because the clean result is very far from the state of the art on CIFAR10, and the ultimate goal of the authors is to show a new state of the art on CIFAR10. Thus, they maybe should focus on using better models from the beginning.\n\nSimilar to the overselling of results, the authors seemed to have an “agenda”, a “hypothesis” of what they wanted to show. Irrespective of experimental evidence, they still claimed to see the desired outcome in the experiment, even if the experiment showed the exact opposite, which is a very dangerous and unscientific practice. \nExamples:\n\nLine 156: “While layerwise pruned models consistently achieved the maximum accuracy (across prune percentages), the globally pruned models consistently provided significant robustness gains over the layerwise models. Furthermore, the globally-pruned models typically achieve higher or comparable accuracy at higher sparsity levels, indicating that using initialization methods with global pruning can yield CARDs with better accuracy and robustness at the same level of compactness.” I am confused. 1. The layerwise pruning methods (yellow) lose quite a lot of clean accuracy in the conv models (up to 10-12 percent points) while the global ones degrade the clean accuracy less. Thus, the first part of the first sentence “While layerwise pruned models consistently achieved the maximum accuracy (across prune percentages)” is wrong. 2. On both VGG and ResNet18, the global pruning methods show the same loss in clean accuracy as their robustness gain. Thus, the models are not “CARDS”, because they are less accurate than the baseline *for all considered pruning percentages*! Thus, the statement that “initialization methods with global pruning can yield CARDs with better accuracy and robustness at the same level of compactness” is incorrect. Furthermore, for the ResNet18, the gains/losses are on the order of 1-2 percent points which I would not call significant in the first place. This symmetry in losing clean accuracy and gaining the “same amount” in robustness makes me wonder whether there is some weird robustness-accuracy trade-off at play?\n\nLine 186: “In particular, by comparing the center of the heatmaps for layerwise and global methods, it follows that initialization methods leveraging layerwise pruning are more robust to low frequency perturbations, which translates to a higher accuracy on the clean data.” -> This is plain wrong. We look at conv8 with 80% weights pruned. Conv8 at 80% pruned weights has a 2% lower clean accuracy for Edgepopup and maybe a 0.5% increase in clean accuracy for Biprop (both initialization methods). Virtually all the remaining models have lower clean accuracy compared to baseline at all pruning levels for layerwise pruning.\n\n\nLine 189: “On the other hand, global pruning in initialization methods yields CARDs that are less sensitive to mid to high frequency perturbations when compared to layerwise pruned CARDs, which translates to a\nhigher robustness to the OOD data.” To me, the layerwise pruning heat maps definitely have higher robustness values in the mid-to-high range frequencies compared to the global pruning methods. Following the authors’ argumentation, layerwise pruning methods should then have higher OOD robustness compared to layerwise pruning methods which they don’t.\n\nLine 216: “Our analysis in Section 3 highlights that the robustness of the compressed model on frequency \nperturbed data is crucially dependent on the interaction between the frequencies the model is biased towards and the frequencies on which the test-time corruption is concentrated.” This is wrong. The authors did not evaluate the individual corruptions in CIFAR-C, but only differentiated between clean (low frequency) and corrupted (high frequency) corruptions. Considering that CIFAR-C corruptions have very different frequencies, I find the analysis too coarse and the statement here far too bold.\n\nThe results in Table 1 look very strange. The vanilla trained model has the highest baseline accuracy which is significantly degraded by Gaussian noise training and Augmix. There must some optimization issue. Since the authors use an adaptive method, I would suggest comparing to TENT (https://arxiv.org/abs/2006.10726v1) who also use an adaptive technique at test time and show results on CIFAR-C. I would then either use the same architecture as them or reimplement their method on a ResNet50.\n\nThe results are only done on CIFAR10. I would suggest performing the analysis on ImageNet since this is the dataset robustness researchers, i.e. the target audience for this paper, are most interested in. I doubt robustness researchers would pay attention to this work if the analysis is only done on CIFAR10.\nIn general, the used models are very far from state-of-the-art models on CIFAR10. Checking the CIFAR10 leaderboard (https://paperswithcode.com/sota/image-classification-on-cifar-10), models with a clean accuracy of 94.4% are around place 104 in the leaderboard. The VGG net has a top-1 accuracy of 93.4%. Given that CIFAR10 is a very small dataset and thus, does not impose huge computation requirements, I would suggest using a state-of-the-art model. Even larger state-of-the-art CIFAR10 models can still be run on one GPU with a reasonable computation time.\nLine 262: Gaussian noise is part of CIFAR-C. The authors overfit to the test set rendering their results meaningless. In any case, the performance gains over the baseline are moderate at best (2 percent points max).\n\nThis was a rough summary of my impression of the paper and a justification of my rating. Please see the general comments section for further comments.\n\n### General comments:\n\nLine 96ff. “F1 represents the function to find the masks, F2 represents the function to train the weights after pruning, ki is the earliest training iteration that Fi requires information from”, “Rewinding-based Lottery Tickets: k1 = T and k2 = r; r < T;” I am confused by this definition. I understand F2 to be the function to be trained after pruning. This means, F2 needs to know F1 (i.e. the masks). Then, the definition k1=T, k2=r; r<T does not make sense because this would lead to the opposite: We would first train the already pruned function at k2=r and then find the pruning masks at k1=T. Please rephrase this paragraph for clarity.\nWhich heuristic is used to determine the final network? Is it the accuracy on the clean training set?\n\nLine 116: „For a reliable comparison, we make use of convolutional [9], VGG [39] and ResNet [16] style architectures of varying size and train them on CIFAR-10 [24]“. The distinction is unclear: VGG and ResNet architectures also involve convolutions. \n\nLine 125: “For each pruning method, we plot the mean accuracy or robustness value over all realizations relative to the mean of the dense baseline realizations with error bars extending to the minimum and maximum realization value at each of the aforementioned sparsity levels.” This sentence is very hard to parse, please rephrase. Also: unclear which “realizations”.\nDoes the y-axis of Figure 1 show percent points?\n\nLine 134: “However, we find that rewinding and initialization based pruning approaches consistently produce dramatic gains in robustness relative to dense baselines while matching (and sometimes surpassing) the accuracy of the dense baseline.” -> “consistently dramatic gains” is a strong claim and for the ResNet18 which is a popular model for CIFAR10 and which is the one with the highest clean accuracy of 94.4% here, the gain seems to be at 2 percent points which is rather small.\n\nLine 137: “In particular, the rewinding class of methods provide a consistent, moderate improvement to both accuracy and robustness while the initialization class provides more substantial gains in robustness even when the accuracy is slightly below the baseline accuracy.” -> The second statement about the initialization class strongly oversells: For the ResNet18, the drop in clean accuracy is actually larger than the gains in robustness! For the VGG network, we see a loss of 3% in clean accuracy and a gain of 6% in robustness.\n\nLine 139: “The significance of overparameterization to finding highly compact CARDs using initialization methods is evident for all architecture types, as the robustness of these models in higher pruning regimes improves at increasing levels of parameterization.” I am confused by this sentence. A ResNet18 has more parameters than a Conv4, but sees fewer gains from pruning? Additionally, the gains diminish for all models in higher pruning regimes. Please rephrase/ explain.\n\nLine 162: “drastically different levels of OOD” -> very bold statement. I would not call a gain of 2 percent points for the best and thus most interesting model drastic.\n\nLine 173: “usually corresponding to clean data” -> what does “usually” mean here? Very vague, be more specific please.\n\nLine 180: “Figure 3 illustrate how rewinding and initialization pruning methods reduce the error rate across the whole frequency spectrum of perturbations when compared to the dense model.” I do not see major differences for the rewinding based approaches. I would highly suggest to the authors to show ResNet18 results here since it is their best and therefore, it is the most interesting and relevant model. Looking at Figs. 8 and 9 and the ResNet18 heat maps, I do not see any differences between the dense heat map and the rewinding methods’ heat maps. -> Maybe it would be helpful if the authors also reported an aggregated value because a qualitative comparison merely by looking at the heat maps can be ambiguous.\n\n\nline 191: “Finally, traditional pruning methods yield a Fourier heatmap with a slightly altered structure when compared to the dense baseline and it slightly resembles a higher error rate version of heatmaps for rewinding methods.” Very vague, using “slightly” twice in this sentence and I don’t agree. I don’t see structure differences I would consider significant here. As discussed above, I interpret this sentence as authors wanting to follow their agenda and over-interpreting their results.\n\nI don’t understand what Figure4 is supposed to tell me. I don’t see significant differences between the different columns.\n\nThe results in Table 1 seem wrong: In the first column, “clean” training leads to a robust accuracy of 89.2% while Gaussian noise training only leads to 73.7%. Given that the authors overfit to Gaussian noise on CIFAR-C, the accuracy with Gaussian noise training should be much higher than with clean training. It also seems wrong that Augmix seems to degrade accuracy over clean training. In addition, the high accuracy of 89.2% achieved with clean training is surpassed by not even one percent point when using the ensembling strategy. I would suggest to the authors to mark the best value in bold to make parsing the table easier.\n\nSection 5.1. I do not understand how Theorem 1 relates to the experiments/ the rest of the paper. None of the pruning methods are about binary networks, yet Theorem 1 considers binary networks. In addition, in theorem 1, the pruned network is twice as deep as the target non-compressed network which also doesn’t hold for any of the pruning approaches above. The theoretical considerations seem like an after-thought and did not get how they supported the other insights from the paper.\n\n### Updates to the Review post rebuttal\n\nI think the authors did a great job addressing my comments and participating in the discussion with me. I specifically appreciate them removing and modifying instances where their results are \"oversold\". I think their last response to my question as to how the Fourier analysis and the OOD robustness analysis are connected is very rigorous and should be reflected in the paper as was presented in their comment.  Due to their last comment, I now understand the connection much better and it does make sense to me to include the Fourier analysis even though a direct correspondence to CIFAR10-C is not given. I urge the authors to include all points from their last comment in the manuscript to avoid confusion similar to what I experienced.\nI appreciate that they included results from the robustbench benchmark and that they show that they actually get SotA results with their method. As stated before, I think the main research question is interesting and important, that is how to design compact DNNs that are accurate and robust at the same time.\n\nI really like the current rebuttal setting of NeurIPS and I think that the submission has been improved a lot due to the discussion. I wish it was possible to upload a new version of the paper. I would like to reread it with the new changes, as it is hard to judge whether any incosistencies remain. \n\nI have raised my rating.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors discussed limitations of their work. They did not discuss potential negative societal impacts of their work, but I would not expect this paper to lead to such.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "11-12"}, "extra_text": {}}, {"review_id": "7jhwppnIz7", "reviewer": "Reviewer_eMfa", "summary": "This paper explores the possibility and practibility to build compact, accurate, and robust deep neural networks (CARDs). The authors first conduct extensive empirical studies to verify the existence of CARDs. Meanwhile, to better understand CARDs, authors further analyze the Fourier sensitivity in the spectral domain. Based on the empirical observations, a domain-adaptive ensembling approach (CARDs-Deck) is proposed as a practical algorithm to utilize the CARDs models, which is able to achieve new SOTA results for robustness and accuracy on CIFAR-10. The paper is quite informative and solid throughout the text, and the claims are well supported by empirical observations. There are also theoretical analysis that justifies CARDs in depth. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\nStrengths:\n\n* The paper explores an important problem with promising conclusions: the compact, accurate and robust deep neural networks do empirically exist.\n\n* The authors not only answer the existence of CARDs, but also propose a practical approach to utilize CARDs to improve the accuracy and OOD robustness, which establish new SOTA performance with smaller model sizes on CIFAR-10-C.\n\n* The methodologies involved in both empirical studies (e.g., Fourier sensitivity analysis) and the practical algorithm (domain-adaptive ensembling) are inspiring and novel.  \n\n\nWeakness:\n\n* While extensive experiments and analysis are conducted on CIFAR-10 and CIFAR-10-C, it remains unknown if CARD still exists on large scale datasets such as ImageNet and ImageNet-c. \n\n* It seems the theoretical results (e.g., Theorem 1 and Theorem 3) are less related to pruning, but are general to analyze the approximation and OOD robustness. It may be inspiring to show in what way the compactness (sparsity of network parameters) affect the CARD approximation or the upper bound of OOD robustness.\n\n\nDetailed comments:\n\n* How about the standard deviation of different methods in Figure 1 and 2? Some lines are highly over-lapped, which could be hard to draw firm conclusions. For example, it is not very clear that layerwise pruned models consistently achieve the maximum accuracy as mentioned in L157. \n\n* The improvement of domain-adaptive CARD-DECKs seems to be incremental, especially when more models are present, according to Table 2.\n\n* In Table 1, there is mis-alignment of the header. Meanwhile, it is kind of misleading that baseline models have the same performance and memory under different pruning ratios in both Table 1 and Table 2.\n\n* The authors can make the paper more self-contained when an additional page is allowed in the revision, especially for theoretical analysis Section 5.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Yes the authors have listed the limitations and potential societal impact.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "5"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work studies whether or not model pruning can be leveraged to improve the out-of-distribution robustness of image models. The work notes that the benefits of pruning strongly depend on details on how pruning is applied. This observation is valuable in light of past literature which were largely unable to improve robustness via model pruning. Reviewers initially had a number of criticisms of the work. For example the question of why model compression sometimes improves robustness remained unanswered and also the work only provides experiments on variants of CIFAR-10 and CIFAR-100. However, the authors had several extended back and forth discussions with reviewers during the rebuttal period and made several improvements to the work while addressing a number of concerns that reviewers have. Although I am quite hesitant to accept a primarily empirical work with experiments only on CIFAR, I overall agree with reviewers that the provided experiments are quite through and recommend accepting the work.
Decision: Accept (Poster)