Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper proposes Hamiltonian Monte Carlo (HMC) strategy for defending pre-trained encoder of VAE from adversarial attacks. 
The authors provides theoretical analysis to substantiate the proposed method, which alleviating the adversarial attacks. 
Also, the authors conduct experiments on various benchmark datasets to show the robustness of the proposed defending strategy.
strengths_and_weaknesses: - The work studies on interesting and significant topic, and the approach seems very simple to apply. I do believe that this kind of work gives positive social impact, for example, attacks like vicious data generation.
- The result also seems promising, including the one in Section 4.3. However, it would be much better if the authors also provide the qualitative result, the one in Figure 2, on high-resolution images regarding the experiment on NVAE.
- HMC seems unfamiliar in recent deep learning community, and it would be better to add the gentle explanation about HMC in the background section. 
- My concern (and also questions) on the paper is pointed at Question #2 and #3, which I might have not fully understood. Please read below questions.
- The paper is generally well-written, but some details are missing which are the keys to understand the entire paper. See Question section below.
questions: - What is $t$ in $q^t$, the number of MCMC steps?
- In the argument in Line 172-173, true posterior $p_\theta (z|x^a)$ is unknown. How can one tell $q^t (z|x^a) \rightarrow p_\theta (z|x^a)$ as $t \rightarrow \infty$, if $t$ implies the number of MCMC steps? I might miss something, but since Theorem 3 takes huge part of this paper, hence I respectfully ask the authors to address the question with theoretical backups.
- The $\beta$-VAEs are not designed for defending the adversarial attacks, rather they are for the disentangling purpose. I'm not sure if comparing VAE+HMC against $\beta$-VAEs is a fair comparison.
- Can the same strategy be applied to VAEs with other priors with explicit distributions? For example, priors of discrete probabilities such as Dirichlet distribution or Softmax computation after Gaussian sampling. Or, exponential families in general.
- What is the input scale? 0-1 for every experiment?
- In the caption of Table 2: radius 0.1 **(top)** and 0.2 **(bottom)**, perhaps typos?
- What is AVAE-SS in Table 3?
- How does the performance change when apply the proposed HMC method to the other VAE variants in Table 3?
- Typo in Line 332, a dash -.

limitations: The authors discussed the limitation of their work in Section 5, and it seems there are no potential negative societal impact on their work.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a defense against supervised and unsupervised adversarial attacks in VAEs – in the former a classifier trained on the latent space of the encoder is attacked, and in the later the latent codes themselves are attacked such that the decoded image looks different. The defense is motivated by the hypothesis that adversarial codes are located at low probability regions of the posterior distribution’s support, and consequently an effective defense is to move any code to a high probability region. The paper achieves this by using a particular MCMC approach – Hamiltonian Monte Carlo – as a post-processing sampling step on the codes generated by the encoder of a VAE. The theoretical results support the validity of the approach, and the empirical results show that it is effective in reducing the success of an adversary in both supervised and unsupervised attacks across several datasets.
strengths_and_weaknesses: The paper's proposed defense is simple and effective, and the theoretical analysis sufficiently backs up the defense. To my knowledge, this particular defense is novel, and it can be very significant given that it is independent of the VAE architecture and causes minor degradations in the generative quality. The paper also takes care to study the effect of several hyperparameters and design choices.

A main concern for me is the lack of a discussion on the inference time. The proposed defense will inevitably be slower than baseline VAEs due to the sequential sampling process, which typically takes 1000 steps per Table 7 in Appendix C.2, and requires at least 100 steps per Figure 12 in Appendix B.4. The analysis presented in Tables 2 and 3 would be much more substantial if the inference time is included. I also think that the choice of the particular MCMC algorithm – HMC – needs to be discussed in more detail versus other sampling strategies, given its central role in the proposed defense.

questions: 1. Is Figure 1 an illustration or an actual experiment? If it's an experiment, the “we observe...” part in the caption needs some more evidence, such as reporting posterior probability ratio assigned to reference codes over perturbed codes. This will also directly support your hypothesis.

2. In Algorithm 1, inside the for loop, $z^l$ should have superindex l-1 in the right side of the first and second line, and $p^l$ should be a temporary variable except in the left side of the last line (since it is overwriting itself)? Also, it is important to report the suggested or default values (used in your experiments) for the hyperparameters inside Algorithm 1's definition.

3. Theorem 3 should be Theorem 1?

4. What are the time, computation and memory costs of the proposed defense? How do they scale with the architecture (particularly in case of hierarchical VAEs)?

5. Can you comment on the applicability of the defense on VQVAE, or conditional VAEs with discrete latents?

limitations: Limitations are sufficiently discussed, except for the time and computation costs mentioned above.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: The paper presents the hypothesis that adversarial attacks on VAEs push the latent code into low probability areas. According to this hypothesis, the attack can be mitigated by pushing back the latent code into more probable region of the latent space. To do so, MCMC is applied in inference time. The results demonstrate that the images generated by the decoder from the "corrected" code are indeed more accurate as reconstructions. 
strengths_and_weaknesses: The paper propose a simple hypothesis, which opens an avenue into a simple mitigation technique. The paper is clearly written, and the approach seems to be theoretically justified and empirically convincing. The proposed method has the advantage of being applied post-hoc on a pretrained model without having to modify the encoder or re-train it. 

It would be beneficial to more directly assess the original hypothesis, i.e., to what extent the latent codes produced by the model after the attack are less probable? In addition, it would be beneficial to consider alternative correction methods, e.g. performing a k-means clustering on the latent space and pushing each point towards the center of each assigned cluster. 
questions: What is the sensitivity of the method to the percentage of corrected examples?
limitations: Yes.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: The paper proposes to defend against adversarial attacks on variational autoencoders by doing Hamiltonian Monte Carlo in the latent space to move the attacked sample back to a more high probability region. The authors compare the effects across different datasets and attack methodologies and show that it improves robustness. Additionally, the authors produce theoretical results that show that doing HMC should help against attacks. 
strengths_and_weaknesses: **Strengths**

The paper explains the method well and compares it with several other methods in detail.
The theory part gives a good explanation as to why the method can lead to improved robustness.
A method that only changes the inference part has the huge advantage that it can be retrofitted to trained models which can be very helpful when it is hard to retrain a model or in cases where the model can't be changed.
Using MCMC to improve robustness is an interesting direction that can be very helpful for the community if further explored.

**Weaknesses**

The paper claims multiple times that because training isn't changed the performance for non-attacked inputs won't be decreased. I don't understand that logic, as the inference defence would have to be applied to non-attacked inputs as well, as usually you won't know beforehand if the image has been attacked or not. In lines 145-146 even claim that it could improve results for non-attacked images. Looking at all the results it seems like this is never tested. Figure 1 doesn't apply MCMC to the non-attacked input, and the MSE and FID values in Table 2 and 3 are exactly the same for VAE and VAE + HMC which seems unlikely if MCMC was used. If the results are really not decreased for non-attacked samples then this should be shown.
While the method increases robustness, the robust accuracy is very low in some cases compared to other methods e.g. just 0.16 or 0.11 for ColorMNIST accuracy in Table 3 compared to other methods getting values around over 0.9 or 0.8 respectively. While the authors show that these methods result in high MSE and FID errors this might not be relevant in some applications. It would be interesting to include nominal accuracy in the results to show if the increased robustness leads to lower nominal accuracy for these methods. This would also again be interesting to see if the HMC steps have an effect on nominal accuracy.
questions: If the logic is that samples from low density latent spaces are worse why is HMC used which just aims to produce independent samples. Wouldn't instead an optimisation technique that tries to maximize the posterior be more helpful? HMC might even reduce the posterior of the sample. 

I find the results in Section 4.3. very surprising. How does knowing the defence make the attacker so much weaker? I would expect the opposite. Do the authors have any insight on this?

Small comments: 
- Since MSSSIM and the Adv. accuracy have arrows pointing up it would be good to add arrows pointing down for MSE and FID in Table 2 and 3.
- It would be better to have MSSSIM as the y-axis label than the title in Figure 4.
limitations: The authors emphasize that their method only changes the inference and not the training compared to other defenses. While this has obvious advantages the paper should also discuss the downsides, e.g. that in practical applications often you would trade longer training time if it avoids a computationally demanding MCMC step for every inference call.
review_title: null

Meta-review: metareview: This paper received generally positive reviews, with all reviewers backing acceptance (albeit typically quite weakly) after discussion with the authors.  The paper was praised on a number of fronts such as novelty, potential significance, clarity, and experimental evaluation.  Though there were a few high-level concerns raised about the work by the reviewers (at least not those which were not successfully explained away by the authors), there were some notable lower-level technical concerns, such as the drop in performance for non-adversarial inputs and increased inference time.

My own view of the paper is that the underlying ideas and core contributions of the work are very strong and clearly worthy of acceptance, but there are also quite a large number of technical and lower-level issues that need to be sorted out for publication (as laid out in my comment to the authors).   I do not feel that any of these is individually especially serious, but together they do represent quite a large body of things that would need addressing for the camera ready and one could argue that they would collectively represent too large of an update to accept the work.

On balance, my recommendation is to give the authors the benefit of the doubt and accept the work, as the underlying contribution is clearly solid and there are no fundamental flaws.  Most importantly, I think all of the issues raised, though numerous, are addressable for the camera ready and the authors seem to be already making good progress towards this.  I also feel that the large number of low-level issues raised are partly due to the relatively high level of scrutiny the paper has undergone, rather than being purely a reflection of the number of issues actually present.  I do hope though that the authors take the concerns raised seriously and make appropriate updates for the camera ready.

Additional comments to those given in the previous comment to authors
- The introduction should make it much clearer that you are utilising the decoder to help protect the encoder.  For me, the key to what is going on here is that the encoder is what is used for downstream tasks and is also the thing that is vulnerable to attack because it is applied before the randomness of the embedding.  Using the, more robust, decoder to help protect the encoder is a really neat idea, but I do not think this is currently properly emphasised at present.  Without making this clear I think the approach is quite confusing: the first impression I got when you say that you use MCMC to “fix the latent code” is that you are utilising forbidden information about the original input, rather than utilising the fact we essentially have access to two models.
- The first page of the paper has a lot of grammatical errors and some poorly worded sentences, it needs a few low-level edit passes.  This is not such an issue later in the paper, but there are still some errors later to correct.

confidence: Less certain
Decision: Accept