Stochastic Activation Pruning for Robust Adversarial Defense
Neural networks are known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification and threaten the reliability of deep learning systems in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy. In this light, we propose Stochastic Activation Pruning (SAP), a mixed strategy for adversarial defense. SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate. We can apply SAP to pretrained networks, including adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration.
 This paper propose a simple method for guarding trained models against adversarial attacks. The method is to prune the network’s activations at each layer and renormalize the outputs. It’s a simple method that can be applied post-training and seems to be effective. The paper is well written and easily to follow. Method description is clear. The analyses are interesting and done well. I am not familiar with the recent work in this area so can not judge if they compare against SOTA methods but they do compare against various other methods. Could you elaborate more on the findings from Fig 1.c Seems that the DENSE model perform best against randomly perturbed images. Would be good to know if the authors have any intuition why is that the case. There are some interesting analysis in the appendix against some other methods, it would be good to briefly refer to them in the main text. I would be interested to know more about the intuition behind the proposed method. It will make the paper stronger if there were more content arguing analyzing the intuition and insight that lead to the proposed method. Also would like to see some notes about computation complexity of sampling multiple times from a larger multinomial. Again I am not familiar about different kind of existing adversarial attacks, the paper seem to be mainly focus on those from Goodfellow et al 2014. Would be good to see the performance against other forms of adversarial attacks as well if they exist.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Stochastic Activation Pruning for Robust Adversarial Defense
Neural networks are known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification and threaten the reliability of deep learning systems in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy. In this light, we propose Stochastic Activation Pruning (SAP), a mixed strategy for adversarial defense. SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate. We can apply SAP to pretrained networks, including adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper propose a simple method for guarding trained models against adversarial attacks. The method is to prune the network’s activations at each layer and renormalize the outputs. It’s a simple method that can be applied post-training and seems to be effective. The paper is well written and easily to follow. Method description is clear. The analyses are interesting and done well. I am not familiar with the recent work in this area so can not judge if they compare against SOTA methods but they do compare against various other methods. Could you elaborate more on the findings from Fig 1.c Seems that the DENSE model perform best against randomly perturbed images. Would be good to know if the authors have any intuition why is that the case. There are some interesting analysis in the appendix against some other methods, it would be good to briefly refer to them in the main text. I would be interested to know more about the intuition behind the proposed method. It will make the paper stronger if there were more content arguing analyzing the intuition and insight that lead to the proposed method. Also would like to see some notes about computation complexity of sampling multiple times from a larger multinomial. Again I am not familiar about different kind of existing adversarial attacks, the paper seem to be mainly focus on those from Goodfellow et al 2014. Would be good to see the performance against other forms of adversarial attacks as well if they exist.
assistant
 This paper propose a simple method for guarding trained models against adversarial attacks. The method is to prune the network’s activations at each layer and renormalize the outputs. It’s a simple method that can be applied post-training and seems to be effective. The paper is well written and easily to follow. Method description is clear. The analyses are interesting and done well. I am not familiar with the recent work in this area so can not judge if they compare against SOTA methods but they do compare against various other methods. Could you elaborate more on the findings from Fig 1.c Seems that the DENSE model perform best against randomly perturbed images. Would be good to know if the authors have any intuition why is that the case. There are some interesting analysis in the appendix against some other methods, it would be good to briefly refer to them in the main text. I would be interested to know more about the intuition behind the proposed method. It will make the paper stronger if there were more content arguing analyzing the intuition and insight that lead to the proposed method. Also would like to see some notes about computation complexity of sampling multiple times from a larger multinomial. Again I am not familiar about different kind of existing adversarial attacks, the paper seem to be mainly focus on those from Goodfellow et al 2014. Would be good to see the performance against other forms of adversarial attacks as well if they exist.