One strategy for adversarially training a robust model is to maximize its
certified radius -- the neighborhood around a given training sample for which
the model's prediction remains unchanged. The scheme typically involves
analyzing a "smoothed" classifier where one estimates the prediction
corresponding to Gaussian samples in the neighborhood of each sample in the
mini-batch, accomplished in practice by Monte Carlo sampling. In this paper, we
investigate the hypothesis that this sampling bottleneck can potentially be
mitigated by identifying ways to directly propagate the covariance matrix of
the smoothed distribution through the network. To this end, we find that other
than certain adjustments to the network, propagating the covariances must also
be accompanied by additional accounting that keeps track of how the
distributional moments transform and interact at each stage in the network. We
show how satisfying these criteria yields an algorithm for maximizing the
certified radius on datasets including Cifar-10, ImageNet, and Places365 while
offering runtime savings on networks with moderate depth, with a small
compromise in overall accuracy. We describe the details of the key
modifications that enable practical use. Via various experiments, we evaluate
when our simplifications are sensible, and what the key benefits and
limitations are.

本文探讨了通过直接传播平滑分类器中的协方差矩阵来缓解蒙特卡罗采样的瓶颈问题，提出了一种可以最大化神经网络认证半径的算法，并在实验中评估了该算法的优缺点。