Paper:
We propose a new method to train neural networks based on a novel combination of adversarial training and provable defenses. The key idea is to model training as a procedure which includes both, the verifier and the adversary. In every iteration, the verifier aims to certify the network using convex relaxation while the adversary tries to find inputs inside that convex relaxation which cause verification to fail. We experimentally show that this training method is promising and achieves the best of both worlds -it produces a state-of-the-art neural network with certified robustness of 58.1% and accuracy of 78.8% on the challenging CIFAR-10 dataset with a 2/255 L ∞ perturbation. This significantly improves over the currently known best results of 53.9% certified robustness and 68.3% accuracy.

Review:
Summary: 
This paper provides a promising new general training methodology to obtain provably robust neural networks (towards adversarial input perturbations). The paper provides promising experimental results on CIFAR-10 by obtaining state-of-the-art certified accuracy while also simultaneously improving clean accuracy. The paper is overall well-written and the algorithm is clearly described. 
Important questions to be answered: 
I find the need to clarify my understanding and request for more information in order to make a decision. 
--Methodology/motivation for the method: I am trying to understand abstractly what the proposed layerwise training is trying to optimize. To be concrete, let's compare to the relaxation of Wong and Kolter (which this paper uses in the instantiation of layerwise adversarial training). What's the exact difference?
One way to view this is the following: The same training objective, but a different way to optimize. The new proposal to train involves freezing weights until one layer iteratively starting from the input layer. It is possible that this kind of training provides some inductive bias in finding better solutions. Is this an appropriate understanding? 
However, the paper’s experimental results unfortunately change the certification procedure. In other words, they haven’t evaluated the same training objective as that of Wong and Kolter. Hence, it’s not clear if the gains are from the better networks, or better certification method, or network being better suited for certification by the method used. The phrase “same relaxation” is not appropriately used. Their certification procedure uses a different (and tighter) relaxation. 
--Effect on latent adversarial examples: I am unable to understand why this training procedure would reduce the number of latent adversarial examples. The definition of latent adversarial examples seems to suggest that it’s the gap between the actual set of activations corresponding to the input perturbations and the convex hull. However, the proposed layerwise adversarial training procedure involves replacing the actual set S_i with the convex hull C_i when freezing things till below i-1. I do not follow how the proposed method tries to make C_i = S_i. Implicitly the optimization objective does try to make C_i small because the bounds being optimized are tighter when C_i is small. But this is true even for normal certified training, and not sure what changes in the new training procedure.
Specific experimental results that would help: 
--Certified accuracy on using the same LP based certification procedure used in Wong and Kolter with the new layerwise trained networks
--The paper’s own certification procedure (a combination of previous methods) on the network from Wong and Kolter or a note on why that doesn’t apply (if it doesn’t)
--The paper currently provides only one data point to suggest this training method is superior. Would be good to try SVHN or MNIST. MNIST is perhaps “essentially” solved for small \eps. But would be good to see if the training method offers gains at larger \eps. In general, would be good to see more consistent gains. 
--The paper reports results on first 1000 examples of CIFAR10 test set. From my personal experience, there is a lot of variability in the robustness of test examples when evaluated on 1000 random test instances. Especially since the paper doesn't take a random subset, it might be good to make sure the gains are consistent on some other subset. The Wong et al. baseline is evaluated on the entire test set for example, and hence might not be a fair comparison? What's the Wong et al. accuracy on just the first 1000 test exampes
Overall, I am leaning towards accept but need some conceptual and empirical clarification from the authors (detailed above).