Pith. sign in

REVIEW 3 major objections 6 minor 53 references

Compression Aware Certified Training

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training on compressed copies keeps models certifiably robust after pruning and quantization.

desk verdict CACTUS's pruning results are a solid, useful contribution; its quantization story is not yet backed by its own theorem, so treat those numbers as empirical hints pending validation. read the letter →

arxiv 2506.11992 v1 pith:GS6V2ZXW submitted 2025-06-13 cs.LG

Changming Xu , Gagandeep Singh This is my paper
classification cs.LG
keywords certifiedrobustnessmodelcompressionpruningquantizationadversarialweightperturbationintervalboundpropagationtrainingcompression-aware
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that certified robustness and model compression can be optimized together, rather than in sequence. It introduces CACTUS, a training loss that averages standard and certified losses over the full network and one or more compressed copies of it. For pruning the copies are exact masked networks; for quantization the copies are simulated through adversarial weight perturbation, which treats rounding as a worst-case weight shift. The paper reports that models trained this way keep high standard and certified accuracy after 50–70% pruning and after fp16/int8 quantization on MNIST, CIFAR-10, and TinyImageNet, often exceeding specialized baselines. If the claim is right, a single network can be deployed across multiple compression levels without retraining, which matters for edge devices that must be both efficient and provably safe.

What carries the argument

The compression set C(fθ) is the central object: a small collection made of the full network plus compressed copies, refreshed at every batch. For pruning the copies are obtained by magnitude-based masks; for quantization the non-differentiable rounding is replaced by adversarial weight perturbation, which searches for the worst-case bounded weight shift. Theorem 4.1 is the bridge: when qstep ≤ 2η, the AWP loss upper-bounds the quantized network's loss, so optimizing the former protects the latter. Averaging the standard and certified losses over all copies (Equation 8) is what forces the shared weights to stay accurate and certifiable across many compression parameterizations at once.

What would settle it

Measure the largest per-weight difference between the trained float network and its int8/fp16 quantized version (qstep), and compare it with the AWP radius η=0.25 used in CACTUS training; if qstep/2 > η for any layer, or if an exact maximizer over the η-ball yields a lower loss than the quantized network, then Theorem 4.1 does not cover the reported quantization results and the certified numbers after quantization would need independent verification.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the non-differentiable gap between a full network and its compressed versions can be bridged during certified training: pruning copies are exact masked networks, and quantization is represented by adversarial weight perturbation, so a single loss (Equation 8) can average standard and certified losses over the full network and a small set of compressed copies. Theorem 4.1 then states that if the perturbation radius η is at least half the quantization step size, the worst-case perturbed loss upper-bounds the loss of the quantized network, which is what lets adversarial weight perturbation stand in for rounding. The experiments show that networks trained this way retain substantially higher certified accuracy than existing compression-aware certified-training baselines after 50–70% pruning and after fp16/int8 quantization, across MNIST, CIFAR-10, and TinyImageNet.

Load-bearing premise

The load-bearing premise is that the approximate adversarial weight perturbation computed during CACTUS training really dominates the rounding error of the int8/fp16 formats used at test time; the paper's own limitations section also notes reliance on uniform quantization and Lipschitz-continuity assumptions, and the theorem's qstep ≤ 2η condition is never checked against measured step sizes.

Editorial extensions

If this is right

  • A CACTUS-trained network can be pruned to 50–70% sparsity or quantized to fp16/int8 without retraining while keeping most of its certified accuracy.
  • One set of weights can serve multiple deployment targets, so a device can switch compression level on the fly as resource budgets change.
  • The averaging recipe is independent of the underlying certified loss, so stronger bound-propagation domains or other certified-training losses could be plugged into the same framework.
  • Jointly optimizing pruning and quantization in one training run is possible, with a modest trade-off against optimizing either compression type alone.
  • The added training cost (roughly 40–140% longer than the compression-agnostic certified-training baseline) is a one-time expense that can be amortized over multiple compression levels and deployments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One testable extension is to measure the actual l∞ distance between trained float weights and their int8/fp16 quantized versions and compare it with the training radius η; the paper never reports these step sizes, so this check would confirm whether Theorem 4.1 covers the reported quantization results.
  • The same set-averaging idea should transfer to other non-differentiable compression transforms—weight clustering, low-rank factorization, or mixed-precision assignment—provided one can build a differentiable perturbation that dominates the transform's error.
  • Because the compression set is resampled every batch, CACTUS implicitly performs augmentation over architectures; this suggests the robustness gain may partly come from variance reduction across subnetworks, which could be isolated by ablating the number and diversity of copies.
  • The paper's own limitations section lists uniform quantization and Lipschitz continuity as theoretical assumptions; if a target hardware format violates them, the quantization guarantees would need re-establishment by direct certification of the quantized network.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces CACTUS, a certified training method that co-optimizes standard accuracy, certified robustness, and compressibility by averaging the standard and SABR certified losses over a set of compressed copies of the network. For pruning, the compressed copies are generated with differentiable masks; for quantization, adversarial weight perturbation (AWP) is used as a differentiable proxy, justified by Theorem 4.1. The authors evaluate CACTUS against HYDRA, NRSLoss, SABR, and QA-IBP on MNIST and CIFAR-10, with additional results on TinyImageNet and ResNet-18, reporting improved certified accuracy at 50-70% pruning and under fp16/int8 quantization.

Significance. If the results hold, CACTUS would be a useful contribution: it unifies compression and certified training in a single objective and demonstrates that a single network can remain certifiably robust across multiple compression levels without retraining. The pruning experiments are coherent and show consistent gains over the baselines at 50% and 70% sparsity, and the certified accuracies are computed independently with alpha-beta-CROWN on held-out test sets, which is a strength. The quantization half of the central claim is less solid: Theorem 4.1 is stated under conditions that are not verified in the implementation, and the paper does not report the quantization step sizes needed to apply the theorem. The empirical quantization results may still be of interest, but they are not supported by the theorem as presented.

major comments (3)
  1. [Section 4.3, Eq. (9), Theorem 4.1] Theorem 4.1 assumes that the inner maximization in Eq. (9) is solved exactly, but the text immediately after the theorem states that an approximate Delta* is computed with a gradient-based approach. The theorem therefore does not apply to the actual training procedure. This is load-bearing because the quantization results in Table 2 are justified by the claim that AWP over an l_infinity ball of radius eta dominates the loss of the quantized network. The paper should either present AWP explicitly as a heuristic without a formal guarantee, or provide a version of the theorem that accounts for approximate maximization (e.g., with a suboptimality gap).
  2. [Section 4.3, Appendix C.1, Table 2] The quantization-step condition is not verified: the main text states qstep <= eta, the appendix states qstep <= 2*eta, and the paper never reports the qstep of the int8 or fp16 formats used in the experiments. Moreover, fp16 is not a uniform-step quantization, so the bound |theta_Q_i - theta_i| <= qstep/2 used in the proof does not apply to it. Unless the authors report per-format (and per-layer, where relevant) quantization step sizes and verify that the uniform quantization error model holds, the AWP training objective is not shown to dominate the true quantized loss, and the high int8/fp16 certified numbers in Table 2 may not reflect the deployment condition the training objective was designed for.
  3. [Algorithm 1] In Algorithm 1, the parameter update on line 12 appears inside the for loop over the compressed networks (lines 8-13). As written, the update is performed after each individual compressed network's loss is added to LCACTUS, rather than once after the average over C(f_theta) is computed as specified in Eq. (8). This also means the compression set is refreshed only once per batch but used after intermediate parameter updates. If the actual implementation updates after the full loop, the pseudocode should be corrected; otherwise the training procedure is not the one defined by the CACTUS loss.
minor comments (6)
  1. [Section 5, Tables 1 and 2] The table formatting is difficult to read because several numerical entries are concatenated without separators (e.g., '99.23 98.2299.15 97.98' and '98.7393.15'). Please add proper column separators.
  2. [Appendix D.2, Table 5] Standard deviations are reported only for a single CIFAR-10 setting (epsilon = 8/255). The claim that improvements are consistent across runs would be strengthened by reporting error bars for the main results in Tables 1 and 2, or at least for all datasets and compression levels.
  3. [Appendix D.6] The text says alpha-crown is used for TinyImageNet and cites reference [48], but [48] appears to be the 'Fast and Complete' paper; the alpha-beta-CROWN verifier is reference [44]. Please correct the citation.
  4. [Section 2.2] There is a typo: 'gaurantees' should be 'guarantees'.
  5. [Section 5, Experimental Setup] Minor typo: 'A100-80Gb' should be 'A100-80GB'.
  6. [Appendix E] The limitations section mentions 'Lipschitz continuity' and 'epsilon-covering' assumptions, but these are not used in Theorem 4.1 or elsewhere in the paper; please clarify what role these assumptions play or remove them to avoid vague statements.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central claims rest on external certification and a one-way bounding theorem.

full rationale

The paper is self-contained against external benchmarks. Certified accuracies are computed with αβ-CROWN on held-out test sets, not derived from the training objective, so the empirical claims are not forced by construction. Theorem 4.1 is a one-way bounding argument: when qstep/2 ≤ η, the quantized network lies in the feasible set of the AWP maximization in Eq. 9, so the exact AWP loss dominates the quantized loss; this is a valid implication, not a circular restatement. The admitted use of an approximate Δ* and the main-text/appendix qstep bound discrepancy are correctness risks, not circularity. The compression set used in training overlaps with some tested pruning ratios, but the tested compressed networks are produced by unseen pruning methods and evaluated on test data, so the improvement is not analytically forced. Coauthor self-citations [39,40] appear only as background on abstract-domain verification and are not load-bearing for the claimed contribution.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper contributes an empirical training recipe. Its uncharged premises are the effectiveness of SABR as a certified-training surrogate, the representativeness of a single randomly pruned copy per batch, the transfer from AWP weight perturbations to real quantization, and sound certification of compressed networks with alpha-beta-CROWN. No new entities are introduced.

free parameters (3)
  • lambda (standard/certified loss weight) = 0.75
    Weight for mixing cross-entropy and SABR loss after a linear warmup; set via standard IBP protocols (Appendix B.1). It shapes the trade-off and affects all reported results.
  • eta (AWP perturbation radius) = 0.25
    Selected from the ablation on CIFAR-10 8/255 (Table 3) and reused for all datasets and quantization settings; controls the claimed quantization coverage.
  • compression ratio distribution for C(f_theta) = uniform delta in [0.25, 0.75], tested at 0, 0.5, 0.7
    Hand-chosen range; ablation in Appendix D shows limited sensitivity, but the choice is not derived from theory.
assumptions (5)
  • domain assumption SABR small-box loss is an effective certified-training surrogate.
    CACTUS uses SABR (Eq. 3) as its certified loss and inherits its unsound training-time approximation. Location: Section 4.2.
  • ad hoc to paper Uniform quantization error is bounded by qstep/2, and qstep <= 2*eta for the formats used.
    Theorem 4.1 relies on these; the paper does not report qstep for int8/fp16, so the condition is unverified. Location: Section 4.3, Appendix C.
  • ad hoc to paper The inner maximization in AWP (Eq. 9) is solved exactly.
    Stated in Theorem 4.1, contradicted by implementation using approximate gradient descent. Location: Section 4.3.
  • domain assumption A compression set of the full network plus one random pruned copy per batch is representative enough for unseen pruning levels and methods.
    The paper's generalization claims rest on this; experiments with two unseen pruning methods give partial evidence. Location: Section 4.4, Section 5.1.
  • domain assumption alpha-beta-CROWN soundly certifies compressed and quantized networks.
    All certified accuracies are computed with alpha-beta-CROWN; no details are given for handling quantization. Location: Section 5.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Compression Aware Certified Training." pith.science (2026). https://pith.science/paper/GS6V2ZXW

@misc{pith2026250611992,
  author       = {Pith},
  title        = {Pith review of: Compression Aware Certified Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GS6V2ZXW}},
  note         = {Machine review of arXiv:2506.11992}
}
read the original abstract

Deep neural networks deployed in safety-critical, resource-constrained environments must balance efficiency and robustness. Existing methods treat compression and certified robustness as separate goals, compromising either efficiency or safety. We propose CACTUS (Compression Aware Certified Training Using network Sets), a general framework for unifying these objectives during training. CACTUS models maintain high certified accuracy even when compressed. We apply CACTUS for both pruning and quantization and show that it effectively trains models which can be efficiently compressed while maintaining high accuracy and certifiable robustness. CACTUS achieves state-of-the-art accuracy and certified performance for both pruning and quantization on a variety of datasets and input specifications.

Figures

Figures reproduced from arXiv: 2506.11992 by the authors.

Figure 1
Figure 1. CACTUS jointly optimizes for accuracy, certified robustness, and compressibility, ensuring [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

53 extracted references · 37 canonical work pages

  1. [1]

    Artificial neural networks in medical diagnosis.Journal of Applied Biomedicine, 11(2), 2013

    Filippo Amato, Alberto López, Eladia María Peña-Méndez, Petr Va ˇnhara, Aleš Hampl, and Josef Havel. Artificial neural networks in medical diagnosis.Journal of Applied Biomedicine, 11(2), 2013

    work page 2013

  2. [2]

    Adversarial training and provable defenses: Bridging the gap

    Mislav Balunovi´c and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In8th International Conference on Learning Representations (ICLR 2020)(virtual). International Conference on Learning Representations, 2020

    work page 2020

  3. [3]

    End to end learning for self-driving cars.arXiv preprint arXiv:1604.07316, 2016

    Mariusz Bojarski, Davide Del Testa, Daniel Dworakowski, Bernhard Firner, Beat Flepp, Prasoon Goyal, Lawrence D Jackel, Mathew Monfort, Urs Muller, Jiakai Zhang, et al. End to end learning for self-driving cars.arXiv preprint arXiv:1604.07316, 2016

    arXiv 2016

  4. [4]

    Hongrong Cheng, Miao Zhang, and Javen Qinfeng Shi. A survey on deep neural network pruning: Taxonomy, comparison, analysis, and recommendations.IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(12):10558–10578, 2024

    2024

  5. [5]

    Scalable multi-modal learning for cross-link channel prediction in massive iot networks

    Kun Woo Cho, Marco Cominelli, Francesco Gringoli, Joerg Widmer, and Kyle Jamieson. Scalable multi-modal learning for cross-link channel prediction in massive iot networks. In Proceedings of the Twenty-Fourth International Symposium on Theory, Algorithmic Foundations, and Protocol Design for Mobile Networks and Mobile Computing, MobiHoc ’23, page 221–229, ...

    work page 2023

  6. [6]

    PACT: parameterized clipping activation for quantized neural networks.CoRR, abs/1805.06085, 2018

    Jungwook Choi, Zhuo Wang, Swagath Venkataramani, Pierce I-Jen Chuang, Vijayalakshmi Srinivasan, and Kailash Gopalakrishnan. PACT: parameterized clipping activation for quantized neural networks.CoRR, abs/1805.06085, 2018

    arXiv 2018

  7. [7]

    Expressive Losses for Verified Robustness via Convex Combinations

    Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M Pawan Kumar, Robert Stan- forth, and Alessio Lomuscio. Expressive losses for verified robustness via convex combinations. arXiv preprint arXiv:2305.13991, 2023

    work page Pith review arXiv 2023

  8. [8]

    The mnist database of handwritten digit images for machine learning research.IEEE Signal Processing Magazine, 29(6):141–142, 2012

    Li Deng. The mnist database of handwritten digit images for machine learning research.IEEE Signal Processing Magazine, 29(6):141–142, 2012

    2012

Show all 53 references
  1. [9]

    Llm.int8(): 8-bit matrix multiplication for transformers at scale

    Tim Dettmers, Mike Lewis, Younes Belkada, and Luke Zettlemoyer. Llm.int8(): 8-bit matrix multiplication for transformers at scale. InProceedings of the 36th International Conference on Neural Information Processing Systems, NIPS ’22, Red Hook, NY , USA, 2022. Curran Associates Inc

    2022

  2. [10]

    Esser, Jeffrey L

    Steven K. Esser, Jeffrey L. McKinstry, Deepika Bablani, Rathinakumar Appuswamy, and Dharmendra S. Modha. Learned step size quantization.CoRR, abs/1902.08153, 2019

    1902 arXiv

  3. [11]

    Adversarial training and provable robustness: A tale of two objectives

    Jiameng Fan and Wenchao Li. Adversarial training and provable robustness: A tale of two objectives. InProceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 7367–7376, 2021

    2021

  4. [12]

    Exploring the performance of pruning methods in neural networks: An empirical study of the lottery ticket hypothesis, 2023

    Eirik Fladmark, Muhammad Hamza Sajjad, and Laura Brinkholm Justesen. Exploring the performance of pruning methods in neural networks: An empirical study of the lottery ticket hypothesis, 2023

    2023

  5. [13]

    Edge ai: Evaluation of model compression techniques for convolutional neural networks, 2024

    Samer Francy and Raghubir Singh. Edge ai: Evaluation of model compression techniques for convolutional neural networks, 2024

    2024

  6. [14]

    The lottery ticket hypothesis: Finding sparse, trainable neural networks, 2019

    Jonathan Frankle and Michael Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks, 2019

    2019

  7. [15]

    Sparsegpt: massive language models can be accurately pruned in one-shot

    Elias Frantar and Dan Alistarh. Sparsegpt: massive language models can be accurately pruned in one-shot. InProceedings of the 40th International Conference on Machine Learning, ICML’23. JMLR.org, 2023

    2023

  8. [16]

    Gptq: Accurate post-training quantization for generative pre-trained transformers, 2023

    Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. Gptq: Accurate post-training quantization for generative pre-trained transformers, 2023

    2023

  9. [17]

    Song Han, Huizi Mao, and William J. Dally. Deep compression: Compressing deep neural network with pruning, trained quantization and huffman coding. In Yoshua Bengio and Yann LeCun, editors,4th International Conference on Learning Representations, ICLR 2016, San Juan, Puerto Ri...

    2016

  10. [18]

    Song Han, Jeff Pool, John Tran, and William J. Dally. Learning both weights and connections for efficient neural networks. InProceedings of the 29th International Conference on Neural Information Processing Systems - Volume 1, NIPS’15, page 1135–1143, Cambridge, MA, USA,

  11. [19]

    Babak Hassibi and David G. Stork. Second order derivatives for network pruning: Optimal brain surgeon. InAdvances in Neural Information Processing Systems (NeurIPS), volume 6, pages 164–171, 1993

    1993

  12. [20]

    Learning sparse neural networks through mixture-distributed regularization

    Chang-Ti Huang, Jun-Cheng Chen, and Ja-Ling Wu. Learning sparse neural networks through mixture-distributed regularization. In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), pages 2968–2977, 2020

    2020

  13. [21]

    Binarized neural networks

    Itay Hubara, Matthieu Courbariaux, Daniel Soudry, Ran El-Yaniv, and Yoshua Bengio. Binarized neural networks. InProceedings of the 30th International Conference on Neural Information Processing Systems, NIPS’16, page 4114–4122, Red Hook, NY , USA, 2016. Curran Associates Inc

    2016

  14. [22]

    Batch normalization: accelerating deep network training by reducing internal covariate shift

    Sergey Ioffe and Christian Szegedy. Batch normalization: accelerating deep network training by reducing internal covariate shift. InProceedings of the 32nd International Conference on International Conference on Machine Learning - Volume 37, ICML’15, page 448–456. JMLR.org, 2015

    2015

  15. [23]

    Quantization and training of neural networks for efficient integer-arithmetic-only inference

    Benoit Jacob, Skirmantas Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew Howard, Hartwig Adam, and Dmitry Kalenichenko. Quantization and training of neural networks for efficient integer-arithmetic-only inference. InProceedings of the IEEE Conference on Computer Vision and...

    2018

  16. [24]

    Machine learning for medical diagnosis: history, state of the art and perspective

    Igor Kononenko. Machine learning for medical diagnosis: history, state of the art and perspective. Artificial Intelligence in medicine, 23(1):89–109, 2001

    2001

  17. [25]

    Learning multiple layers of features from tiny images, 2009

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images, 2009

    2009

  18. [26]

    Quantization-aware interval bound propagation for training certifiably robust quantized neural networks

    Mathias Lechner, DJordje Žikeli´c, Krishnendu Chatterjee, Thomas A Henzinger, and Daniela Rus. Quantization-aware interval bound propagation for training certifiably robust quantized neural networks. InProceedings of the AAAI Conference on Artificial Intelligence, volume 37, p...

    2023

  19. [27]

    Denker, and Sara A

    Yann LeCun, John S. Denker, and Sara A. Solla. Optimal brain damage. InAdvances in Neural Information Processing Systems (NeurIPS), volume 2, pages 598–605, 1990

    1990

  20. [28]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InInternational Conference on Learning Representations, 2018

    2018

  21. [29]

    Taps: Connecting certified and adversarial training.arXiv e-prints, pages arXiv–2305, 2023

    Yuhao Mao, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Taps: Connecting certified and adversarial training.arXiv e-prints, pages arXiv–2305, 2023

    2023

  22. [30]

    Differentiable abstract interpretation for provably robust neural networks

    Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. InInternational Conference on Machine Learning, pages 3578–3586. PMLR, 2018

    2018

  23. [31]

    Certified train- ing: Small boxes are all you need

    Mark Niklas Mueller, Franziska Eckert, Marc Fischer, and Martin Vechev. Certified train- ing: Small boxes are all you need. InThe Eleventh International Conference on Learning Representations, 2022

    2022

  24. [32]

    Metaheuristics for pruning convolutional neural networks: A comparative study.Expert Systems with Applications, 268:126326, 2025

    Vikas Palakonda, Jamshid Tursunboev, Jae-Mo Kang, and Sunghwan Moon. Metaheuristics for pruning convolutional neural networks: A comparative study.Expert Systems with Applications, 268:126326, 2025

    2025

  25. [33]

    Pytorch: An imperative style, high-performance deep learning library.Advances in neural information processing systems, 32, 2019

    Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library.Advances in neural information processing systems, 32, 2019

    2019

  26. [34]

    Adversarial pruning: A survey and benchmark of pruning methods for adversarial robustness, 2024

    Giorgio Piras, Maura Pintor, Ambra Demontis, Battista Biggio, Giorgio Giacinto, and Fabio Roli. Adversarial pruning: A survey and benchmark of pruning methods for adversarial robustness, 2024. 11

    2024

  27. [35]

    Xnor-net: Imagenet classification using binary convolutional neural networks

    Mohammad Rastegari, Vicente Ordonez, Joseph Redmon, and Ali Farhadi. Xnor-net: Imagenet classification using binary convolutional neural networks. In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling, editors,Computer Vision – ECCV 2016, pages 525–542, Cham, 2016. Springer...

    2016

  28. [36]

    Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems, 33:19655–19666, 2020

    Vikash Sehwag, Shiqi Wang, Prateek Mittal, and Suman Jana. Hydra: Pruning adversarially robust neural networks.Advances in Neural Information Processing Systems, 33:19655–19666, 2020

    2020

  29. [37]

    Uncertainty in machine learning: A safety perspective on autonomous driving

    Sina Shafaei, Stefan Kugele, Mohd Hafeez Osman, and Alois Knoll. Uncertainty in machine learning: A safety perspective on autonomous driving. InComputer Safety, Reliability, and Security: SAFECOMP 2018 Workshops, ASSURE, DECSoS, SASSUR, STRIVE, and WAISE, Västerås, Sweden, Sep...

    2018

  30. [38]

    Fast certified robust training with short warmup.Advances in Neural Information Processing Systems, 34:18335– 18349, 2021

    Zhouxing Shi, Yihan Wang, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh. Fast certified robust training with short warmup.Advances in Neural Information Processing Systems, 34:18335– 18349, 2021

    2021

  31. [39]

    Fast and effective robustness certification.Advances in neural information processing systems, 31, 2018

    Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, and Martin Vechev. Fast and effective robustness certification.Advances in neural information processing systems, 31, 2018

    2018

  32. [40]

    An abstract domain for certifying neural networks.Proceedings of the ACM on Programming Languages, 3(POPL):1– 30, 2019

    Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev. An abstract domain for certifying neural networks.Proceedings of the ACM on Programming Languages, 3(POPL):1– 30, 2019

    2019

  33. [41]

    On adaptive attacks to adversarial example defenses.Advances in neural information processing systems, 33:1633–1645, 2020

    Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses.Advances in neural information processing systems, 33:1633–1645, 2020

    2020

  34. [42]

    On the feasibility of compressing certifiably robust neural networks

    Pratik Vaishnavi, Veena Krish, Farhan Ahmed, Kevin Eykholt, and Amir Rahmati. On the feasibility of compressing certifiably robust neural networks. InProceedings of the Third Workshop on Trustworthy Machine Learning in OpenReview, 2022

    2022

  35. [43]

    Haq: Hardware-aware automated quantization with mixed precision

    Kuan Wang, Zhijian Liu, Yujun Lin, Ji Lin, and Song Han. Haq: Hardware-aware automated quantization with mixed precision. In2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8604–8612, 2019

    2019

  36. [44]

    Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. Beta-CROWN: Efficient bound propagation with per-neuron split constraints for complete and incomplete neural network verification.Advances in Neural Information Processing Systems, 34, 2021

    2021

  37. [45]

    Adversarial weight perturbation helps robust generalization.Advances in neural information processing systems, 33:2958–2969, 2020

    Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization.Advances in neural information processing systems, 33:2958–2969, 2020

    2020

  38. [46]

    Integer quantization for deep learning inference: Principles and empirical evaluation, 2020

    Hao Wu, Patrick Judd, Xiaojie Zhang, Mikhail Isaev, and Paulius Micikevicius. Integer quantization for deep learning inference: Principles and empirical evaluation, 2020

    2020

  39. [47]

    Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry

    Kai Y . Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, and Aleksander Madry. Training for faster adversarial robustness verification via inducing reLU stability. InInternational Conference on Learning Representations, 2019

    2019

  40. [48]

    Fast and Complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers

    Kaidi Xu, Huan Zhang, Shiqi Wang, Yihan Wang, Suman Jana, Xue Lin, and Cho-Jui Hsieh. Fast and Complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. InInternational Conference on Learning Representations, 2021

    2021

  41. [49]

    Autotag: Recurrent variational autoencoder for unsupervised apnea detection with rfid tags

    Chao Yang, Xuyu Wang, and Shiwen Mao. Autotag: Recurrent variational autoencoder for unsupervised apnea detection with rfid tags. In2018 IEEE Global Communications Conference (GLOBECOM), pages 1–7, 2018

    2018

  42. [50]

    Towards optimal compression: Joint pruning and quantization, 2023

    Ben Zandonati, Glenn Bucagu, Adrian Alan Pol, Maurizio Pierini, Olya Sirkin, and Tal Kopetz. Towards optimal compression: Joint pruning and quantization, 2023

    2023

  43. [51]

    Towards stable and efficient training of verifiably robust neural networks.arXiv preprint arXiv:1906.06316, 2019

    Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Duane Boning, and Cho-Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks.arXiv preprint arXiv:1906.06316, 2019

    1906 arXiv

  44. [52]

    Can pruning improve certified robustness of neural networks?Transactions on Machine Learning Research, 2022

    LI Zhangheng, Tianlong Chen, Linyi Li, Bo Li, and Zhangyang Wang. Can pruning improve certified robustness of neural networks?Transactions on Machine Learning Research, 2022. 12

    2022

  45. [53]

    Compression-aware training of neural networks using frank-wolfe.arXiv preprint arXiv:2205.11921, 2022

    Max Zimmer, Christoph Spiegel, and Sebastian Pokutta. Compression-aware training of neural networks using frank-wolfe.arXiv preprint arXiv:2205.11921, 2022. 13 A Extended Background A.1 Detailed Compression Methods A.1.1 Pruning Methods Pruning methods can be categorized along...

    2022 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.