Paper:
Ensuring robustness of Deep Neural Networks (DNNs) is crucial to their adoption in safety-critical applications such as self-driving cars, drones, and healthcare. Notably, DNNs are vulnerable to adversarial attacks in which small input perturbations can produce catastrophic misclassifications. In this work, we propose EMPIR, ensembles of quantized DNN models with different numerical precisions, as a new approach to increase robustness against adversarial attacks. EMPIR is based on the observation that quantized neural networks often demonstrate much higher robustness to adversarial attacks than full precision networks, but at the cost of a substantial loss in accuracy on the original (unperturbed) inputs. EM-PIR overcomes this limitation to achieve the "best of both worlds", i.e., the higher unperturbed accuracies of the full precision models combined with the higher robustness of the low precision models, by composing them in an ensemble. Further, as low precision DNN models have significantly lower computational and storage requirements than full precision models, EMPIR models only incur modest compute and memory overheads compared to a single full-precision model (<25% in our evaluations). We evaluate EMPIR across a suite of 3 different DNN tasks (MNIST, CIFAR-10 and ImageNet) and under 4 different adversarial attacks. Our results indicate that EMPIR boosts the average adversarial accuracies by 43.6%, 15.3% and 11.9% for the DNN models trained on the MNIST, CIFAR-10 and ImageNet datasets respectively, when compared to single full-precision models, without sacrificing accuracy on the unperturbed inputs.

Review:
This paper suggests using ensemble of both full-precision and low-bits precision models to defense adversarial examples.
From methodological point of view, this idea is quite straightforward and not novel, since there are already several works that applied ensemble methods to improve the robustness of NNs, including the Strauss et.al 2017 and (the following references are not included in the manuscript)
"Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
Warren He, James Wei, Xinyun Chen, Nicholas Carlini, Dawn Song" 
"Ensemble Adversarial Training: Attacks and Defenses
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, Patrick McDaniel" .
"Improving Adversarial Robustness via Promoting Ensemble Diversity
Tianyu Pang, Kun Xu, Chao Du,  Ning Chen,  Jun Zhu " ICML 2019
Though these methods only considered combining full-precision models, the idea is the same in essence and let the low-bits networks involve into the ensemble is quite natural and straightforward. So I don't think the methodology contribution of this paper is enough for publication.
When checking the empirical results, the compared baselines miss a very common-used and strong baseline PGD adversarial training. And also the performance of this ensemble is not significant. 
Considering the weakness of the paper both in methodology development and empirical justification, this work does not merit publication from my point of view.