As deep neural networks become widely adopted for solving most problems in computer vision and audio-understanding, there are rising concerns about their potential vulnerability. In particular, they are very sensitive to adversarial attacks, which manipulate the input to alter models' predictions. Despite large bodies of work to address this issue, the problem remains open. In this paper, we propose defensive tensorization, a novel adversarial defence technique that leverages a latent high order factorization of the network. Randomization is applied in the latent subspace, therefore resulting in dense reconstructed weights, without the sparsity or perturbations typically induced by the randomization. Our approach can be easily integrated with any arbitrary neural architecture and combined with techniques like adversarial training. We empirically demonstrate the effectiveness of our approach on standard image classification benchmarks. We further validate the generalizability of our approach across domains and low-precision architectures by considering an audio classification task and binary networks. In all cases, we demonstrate superior performance compared to prior works in the target scenario.
This paper tackles the problem of designing neural network architectures that are robust to adversarial attacks. Several defense techniques against adversarial attacks have been proposed, mainly adversarial training (train on perturbed inputs) and introducing random perturbation to the weights or activations of the network. The paper claims that one limitation of the second approach is that it introduces artifacts (e.g. sparsity). The authors propose a simple but original idea to address this issue: parameterize the network's weight matrices as low rank tensors (in the Tucker format) and randomize the weights by sketching the core tensor of the Tucker decomposition (in effect, the sketching amounts to randomly setting fibers of the core tensor to 0). 
I think this paper can be relevant to the community but I am not confident that this is an important contribution. The idea is interesting and addresses the problem of sparsity artifacts in randomized defense strategies, but it does not appear clearly why using tensor decomposition techniques is a sound approach for designing robust networks (besides overcoming sparsity artifacts). I believe there may be more fundamental (theoretical, principled) arguments to motivate the approach, but this is not explored in the paper: the idea is interesting but not supported by much theoretical insight. Yes, using Tucker decomposition allows one to have randomized but still dense weights. Is it the only reason to use tensor decomposition? Why not do the same with a simple low rank matrix for example?
The experimental section is developed but I find the experimental setting not clearly described (e.g., what is the metric? is it the accuracy over adversarial examples?). Maybe this is because I am not familiar with the adversarial defense literature. 
In conclusion, I am a bit on the fence for this paper. The idea is interesting and definitely worth exploring but to me a more thorough discussion and analysis of why tensor decomposition techniques are relevant is missing. Still, the approach is original and this paper may spark future work further exploring these questions, so I recommend acceptance.
* Comments / Questions *
- Paragraph "Latent high-order parametrization of the network". If I understand correctly, the core tensor G in the decomposition as the same size of W, so at this stage W is not parameterized as a low rank tensor (W is actually over-parmeterized). This is only when the stochastic vectors \lambda are introduced that the Tucker rank of W is implicitly reduced. This could be clarified.
- Is stochasticity preserved at test time (unlike when using dropout but like in Wang, et al. (2018))?
- What is the metric used in Table 1 to compare the models?
- Would it make sense to explore other tensor decomposition models (e.g. CP, tensor train, tensor ring, ...)? Are there any particular reasoning motivating the choice of Tucker?