COMBINATORIAL ATTACKS ON BINARIZED NEURAL NETWORKS
Binarized Neural Networks (BNNs) have recently attracted significant interest due to their computational efficiency. Concurrently, it has been shown that neural networks may be overly sensitive to "attacks" -tiny adversarial changes in the input -which may be detrimental to their use in safety-critical domains. Designing attack algorithms that effectively fool trained models is a key step towards learning robust neural networks. The discrete, non-differentiable nature of BNNs, which distinguishes them from their full-precision counterparts, poses a challenge to gradient-based attacks. In this work, we study the problem of attacking a BNN through the lens of combinatorial and integer optimization. We propose a Mixed Integer Linear Programming (MILP) formulation of the problem. While exact and flexible, the MILP quickly becomes intractable as the network and perturbation space grow. To address this issue, we propose IProp, a decomposition-based algorithm that solves a sequence of much smaller MILP problems. Experimentally, we evaluate both proposed methods against the standard gradient-based attack (PGD) on MNIST and Fashion-MNIST, and show that IProp performs favorably compared to PGD, while scaling beyond the limits of the MILP.
The authors study the problem of generating strong adversarial attacks on binarized neural networks (networks whose weights are binary valued and have a sign function nonlinearity).  Since these networks are not continuous (due to the sign function nonlinearity), it is possible that standard gradient-based attack algorithms are not effective at producing adversarial examples. While this problem can be encoded as a mixed integer linear program, off-the-shelf MILP solvers are not scalable to larger/deeper networks. Thus, the authors propose a new target propagation style algorithm that attempts to infer desired activations at each layer (from the perspective of maximizing the adversary's objective) starting at the final layer and moving towards the input. The propagation at each layer requires solving another MILP (albeit a much smaller one). Further, in order to prevent the target propagation from discovering assignments at upper layers that are unachievable given the constraints at lower layers, the authors propose two heuristics (making small moves and penalizing deviations from the previous target values) to obtain an effective attack algorithm. The authors validate their approach experimentally on MNIST/Fashion MNIST image classifiers.
Quality: The paper is reasonably well written and the key ideas are communicated well. However, the experimental section needs to be improved significantly.
Clarity: The paper is easy to understand and organized well.
Originality: The application of target propagation in the context of adversarial examples is certainly novel and so are the specific enhancements proposed in the context of adversarial example generation. The 
Significance: The study of adversarial examples for binarized networks is novel and important and effective attack generation algorithms are a significant first step towards training robust models of this type - this could enable deployment of robust and compact binarized classifiers in on-device settings (where model size is important).
Cons
My main concerns with this paper are regarding the experimental evaluation - I do not feel these are sufficient to justify the strength of the attack method proposed. Here are my broad concerns:
1. Even though the datasets used are small (MNIST/Fashion MNIST), the experimental validation of adversarial attacks is only performed on 100 test examples. This is not sufficiently representative (given experimental evidence with adversarial attacks on non-binarized models) and this needs to be addressed for the results to be considered conclusive.
2. The attack method is only compared to FSGM, which is known to be a rather poor attack even on non-binarized networks. The authors should compare to stronger gradient based attacks (like PGD) and gradient free attacks which have been used to break adversarial defenses that are nondifferentiable in prior work - https://arxiv.org/abs/1802.00420 and https://arxiv.org/abs/1802.05666). Further, the MILP approach used can be strengthened by doing better bound propagation (like in https://arxiv.org/pdf/1711.00455.pdf)
3. The attack radii used are very small compared to what has been used in non-binarized networks, where networks have been trained to even be verifiably robust to adversarial pertrubations of much larger radii (see for example https://arxiv.org/pdf/1805.12514.pdf). Given the existence of this work, it is important to evaluate the algorithms proposed on larger radii (since it is possible to construct non-binarized networks that are indeed robust to perburbations of eps=.1-.3 on MNIST).
4. Motivation for binarization: I assume that motivation for binarized models arising from faster training/inference times and smaller model sizes. However, to justify this, the authors need to compare their BNNs to comparable non-binarized neural networks (for example,ones that are similar  in terms of number of bits used to represent the model) on training time, inference time and adversarial robustness. Otherwise, it seems hard to see why binarized networks are valuable from a robustness.