Paper:
Workshop track -ICLR 2018 ENSEMBLE ROBUSTNESS AND GENERALIZATION OF STOCHASTIC DEEP LEARNING ALGORITHMS
The question why deep learning algorithms generalize so well has attracted increasing research interest. However, most of the well-established approaches, such as hypothesis capacity, stability or sparseness, have not provided complete explanations (Zhang et al., 2017;Kawaguchi et al., 2017). In this work, we focus on the robustness approach (Xu & Mannor, 2012), i.e., if the error of a hypothesis will not change much due to perturbations of its training examples, then it will also generalize well. As most deep learning algorithms are stochastic (e.g., Stochastic Gradient Descent, Dropout, and Bayes-by-backprop), we revisit the robustness arguments of Xu & Mannor, and introduce a new approach -ensemble robustness -that concerns the robustness of a population of hypotheses. Through the lens of ensemble robustness, we reveal that a stochastic learning algorithm can generalize well as long as its sensitiveness to adversarial perturbations is bounded in average over training examples. Moreover, an algorithm may be sensitive to some adversarial examples (Goodfellow et al., 2015) but still generalize well. To support our claims, we provide extensive simulations for different deep learning algorithms and different network architectures exhibiting a strong correlation between ensemble robustness and the ability to generalize.

Review:
Summary:
This paper presents an adaptation of the algorithmic robustness of Xu&Mannor'12 to a notion robustness of ensemble of hypothesis allowing the authors to study generalization ability of stochastic learning algorithms for Deep Learning Networks. 
Generalization can be established as long as the sensitiveness of the learning algorithm to adversarial perturbations is bounded.
The paper presents learning bounds and an experimental showing correlation between empirical ensemble robustness and generalization error.
Quality:
Globally correct
Clarity:
Paper clear
Originality:
Limited with respect to the original definition of algorithmic robustness
Significance:
The paper provides a new theoretical analysis for stochastic learning of Deep Networks but the contribution is limited in its present form.
Pros:
-New theoretical study for DL algorithms 
-Focus on adversarial learning
Cons
-I find the contribution a bit limited
-Some aspects have to be precised/more argumented
-Experimental study could have been more complete
Comments:
---------
*About the proposed framework.
The idea of taking a max over instances of partition C_i (Def 3) already appeared in the proof of results of Xu&Mannor, and the originality of the contribution is essentially to add an expectation over the result of the algorithm.
In Xu&Mannor paper, there is a notion of weak robustness that is proved to be necessary and sufficient to generalize. The contribution of the authors would be stronger if they can discuss an equivalent notion in their context.
The partition considered by the framework is never discussed nor taken into account, while this is an important aspect of the analysis. In particular, there is a tradeoff between \epsilon(s) and K:  using a very fine tiling it is always possible to have a very small \epsilon(s) at the price of a very large K (if you think of a covering number, K can be exponential in the size of the tiling and hard to calculate). 
In the context of adversarial examples, this is actually important because it can be very likely that the adversarial example can belong to a partition set different from the set the original example belong to. 
In this context, I am not sure to understand the validity of the framework because we can then compare 2 instances of different set which is outside of the framework. 
So I wonder if the way the adervarial examples are generates should be taken into account for the definition of the partition.
Additionnally, the result is given in the contect of IID data, and with a multinomial distribution according to the partition set - adversarial generation can violate this IID assumption.
In the experimental setup, the partition set is not explained and we have no guarantee to compare instances of the same set. Nothing is said about $r$ and its impact on the results. This is a clear weak aspect of the experimental analysis
In the experimental setup, as far as I understand the setup, I find the term "generalization error" a bit abusive since it is actually the error on the test set. 
Using cross validation or considering multiple training/test sets would be more appropriate.
In the proof of Lemma 2, I am not sure to understand where the term 1/n comes from in the term 2M^2/2 (before "We then bound the term H as follows")