B: Overview of the proposed PhiSNet architecture.

Provably Robust Deep Learningvia Adversarially Trained Smoothed Classifiers.

S2.2 Varianceofimportanceweights The importance-sampled estimate of the log-likelihood used to retrain the oracle (Equation 17) is unbiased, butmayhavehighvariance duetothevariance oftheimportance weights. LetLβ: X R Rdenote a pertinent loss function induced by the oracle parameters,β, (e.g., the squared errorLβ(x,y) = (Eβ[y |x] y)2). While the bound,L, on Lβ may be restrictive in general, for any givenapplication one may beable touse domain-specific knowledge toestimateL. CbAS naturally controls the importance weight variance. Design procedures that leverage a trust region can naturally bound thevariance oftheimportance weights.