Systems, methods, and computer readable media are described to train a compressed neural network with high robustness. The neural network is first adversarially pre-trained with both original data as well as data perturbed by adversarial attacks for some epochs, then “unimportant” weights or filters are pruned through criteria based on their magnitudes or other method (e.g., Taylor approximation of the loss function), and the pruned neural network is retrained with both clean and perturbed data for more epochs.