BOOSTING ROBUSTNESS CERTIFICATION OF NEURAL NETWORKS
We present a novel approach for the certification of neural networks against adversarial perturbations which combines scalable overapproximation methods with precise (mixed integer) linear programming. This results in significantly better precision than state-of-the-art verifiers on challenging feedforward and convolutional neural networks with piecewise linear activation functions.
This paper proposed a mixed strategy to obtain better precision on robustness verifications of feed-forward neural networks with piecewise linear activation functions.
The topic of robustness verification is important. The paper is well-written and the overview example is nice and helpful. 
The central idea of this paper is simple and the results can be expected: the authors combine several verification methods (the complete verifier MILP, the incomplete verifier LP and AI2) and thus achieve better precision compared with imcomplete verifiers while being more scalable than the complete verifiers. However, the verified networks are fairly small (1800 neurons) and it is not clear how good the performance is compared to other state-of-the-art complete/incomplete verifiers. 
About experiments questions:
1. The experiments compare verified robustness with AI2 and show that RefineAI can verify more than AI2 at the expense of much more computation time (Figure 3). However, the problem here is how is RefineAI or AI2 compare with other complete and incomplete verifiers as described in  the second paragraph of introduction? The AI2 does not seem to have public available codes that readers can try out but for some complete and incomplete verifiers papers mentioned in the introductions,  I do find some public codes available:
* complete verifiers
1. Tjeng & Tedrake (2017): github.com/vtjeng/MIPVerify.jl
2. SMT Katz etal (2017): https://github.com/guykatzz/ReluplexCav2017
* incomplete verifiers
3. Weng etal (2018) : https://github.com/huanzhang12/CertifiedReLURobustness
4. Wong & Kolter (2018): http://github.com/locuslab/convex_adversarial
How does Refine AI proposed in this paper compare with the above four papers in terms of the verified robustness percentage on test set, the robustness bound (the epsilon in the paragraph Abstract Interpretation p.4) and the run time? The verified robustness percentage of Tjeng & Tedrake is reported but the robustness bound is not reported.  Also, can Refine AI scale to other datasets?
About other questions:
1. Can RefineAI handle only piece-wise linear activation functions? How about other activation functions, such as sigmoid? If so, what are the modifications to be made to handle other non-piece-wise linear activation functions? 
2. In Sec 4, the Robustness properties paragraph. "The adversarial attack considered here is untargeted and therefore stronger than ...". The approaches in Weng etal (2018) and Tjeng & Tedrake (2017) seem to be able to handle the untargeted robustness as well? 
3. In Sec 4, the Effect of neural selection heuristic paragraph. "Although the number of images verified change by only 3 %... produces tighter output bounds...". How tight the output bounds improved by the neuron selection heuristics?