The paper presents a method to prune a network while making it more adversarially robust. The idea is simple and has thorough experimental validation. The reviewers suggest several additional experiments, especially using RN50 on ImageNet which would further strengthen the paper. Additionally, the strongest possible baseline should be used throughout.