Paper:
Sparse DNNs with Improved Adversarial Robustness
Deep neural networks (DNNs) are computationally/memory-intensive and vulnerable to adversarial attacks, making them prohibitive in some real-world applications. By converting dense models into sparse ones, pruning appears to be a promising solution to reducing the computation/memory cost. This paper studies classification models, especially DNN-based ones, to demonstrate that there exists intrinsic relationships between their sparsity and adversarial robustness. Our analyses reveal, both theoretically and empirically, that nonlinear DNN-based classifiers behave differently under l 2 attacks from some linear ones. We further demonstrate that an appropriately higher model sparsity implies better robustness of nonlinear DNNs, whereas over-sparsified models can be more difficult to resist adversarial examples.

Review:
This paper assumes an intrinsic relationship between the sparsity and the robustness of DNN models. The authors prove that this assumption holds for linear models under the $l_infinity$ attacker model, and it also holds for nonlinear models under both $l_2$ and $l_infinity$ attacker models. Then, the authors demonstrate some experimental results which are consistent with the theory.  In general, this paper is well-written, and it is a plausible investigation on the issues of DNN robustness. The problem studied in this paper is very important and also challenging.  The methods of the paper are inspiring. However, there are also critical issues in this paper, which jeopardize the importance of the achieved results. So I tend to give a weak reject to this paper. More details are shown below.  Critical Issues: 1) The authors adopt two metrics to reflect the robustness of DNNs. However, they have not shown how general are such measurements. 2) When proving Theorem 3.1 and Theorem 3.2, the authors assume that the labels of the dataset follow uniform distributions. But they have not discussed whether the theorems hold for the scenarios of unbalanced datasets. In practice, it is very often that some labels occur more frequently than others. If the theorems cannot hold in such cases, the importance of the results would be affected. 3) The proof of nonlinear DNNs does not consider pooling functions, which are popular in present neural networks. Besides, the authors obtain two bounds in the proof, but these bounds are not reflected in the experimental results. Moreover, the robustness of Figure 2 drops dramatically after a threshold, which confuses the reviewer about the correctness of the proof.  More Issues: 1) Page 2 line 51: the related papers published in the ICLR workshop this year draw conclusions opposite to this paper. However, the authors did not address the difference between the related papers and this paper. Since these results appear conflicting to each other, this reviewer is confused about the correctness of this paper if there is no appropriate explanation.  2) Page 3 line 93: the authors claim that the $r_2$ metric makes more sense if the classifiers are less accurate. However, the question is whether it is worth improving the robustness if the classifier is inaccurate itself? 3) Page 3 line 114: the authors conjecture that the robustness of linear models is unrelated to the sparsity with respect to $r_2$. This conclusion further confuses this reviewer about the generality of the two metrics.  Minor Issues: Page 2 line 52: “shows” => “show”  Page 6 line 245: The bar above 0.3 seems a typo. Page 7 line 263: The description of the DNNs is not clear. Page 7 line 264: “2 convolutional layer” => “2 convolutional layers”