Deep neural nets (DNNs) compression is crucial for adaptation to mobile devices. Though many successful algorithms exist to compress naturally trained DNNs, developing efficient and stable compression algorithms for robustly trained DNNs remains widely open. In this paper, we focus on a co-design of efficient DNN compression algorithms and sparse neural architectures for robust and accurate deep learning. Such a co-design enables us to advance the goal of accommodating both sparsity and robustness. With this objective in mind, we leverage the relaxed augmented Lagrangian based algorithms to prune the weights of adversarially trained DNNs, at both structured and unstructured levels. Using a Feynman-Kac formalism principled robust and sparse DNNs, we can at least double the channel sparsity of the adversarially trained ResNet20 for CIFAR10 classification, meanwhile, improve the natural accuracy by 8.69% and the robust accuracy under the benchmark 20 iterations of IFGSM attack by 5.42%.
Summary: This paper presents an observation that Feynman-Kac formalism principled ResNet ensemble [1] yields sparser network weights compared to those of standard Resnet.  Based on this observation, the authors combine the ensemble model with Lagrangian based sparsification methods to obtain sparse and robust models. 
Pros:
- Obtaining sparse and robust networks is an important and challenging problem that could be of interest to a large audience.
- The paper provides an interesting observation that EnResNet [1] yields sparser network weights compared to standard ResNet, and further leverage it to obtain sparse and robust models. 
Cons:
- The paper has limited novelty. It has already been shown in the original EnResNet paper [1] that EnResNet is more robust to adversarial attacks. Thus the only additional contribution of this paper is the observation that EnResnet is more sparse than standard ResNet, and combination of EnResnet with sparsification methods.  
- The paper is not well justified on why one should use sparsifying techniques such as RVSM, RGSM with the Feynman-Kac formula principled EnResnet. The authors state that this enables sparsity to meet robustness; however, in all experimental results, the robustness actually decreases with the increase in sparsity which is opposite to the claims made in the paper. 
- The authors only report robustness on white-box gradient-based attacks. Thus it is not clear whether the method will generalize to black-box/gradient-free attack approaches such as NAttack [2].
Minor comments:
- Why didn’t you report the accuracy on the clean examples? This is important in showing that the method generalizes well to clean examples while maintaining robustness.
- Why use only 20 iterations to evaluate the attack? Will the model maintain its robustness with the increase in the iteration and epsilon? 
- Figures are not referenced anywhere in the text.
- It would be better to put the results on CIFAR100 in the main paper rather than in the appendix.
- Page 2, “lower cases”  -> “lower case”.
- Page 2, “Related Works” -> “Related work”, it’s better to have it as a separate section.
Overall, while the paper provides an interesting observation, it has limited contributions due to lack of novelty. Further, inadequate experimental validation makes it difficult to see if the claims made in the paper are actually true. Thus I believe that this paper requires substantial improvements in order to be accepted to top-tier publication venues such as ICLR.
References:
[1] Bao et al. 2018, https://arxiv.org/abs/1811.10745 
[2] Yadong et al. 2019, https://arxiv.org/abs/1905.00441