Improving VAEs' Robustness to Adversarial Attack

1 INTRODUCTION . Variational autoencoders ( VAEs ) are a powerful approach to learning deep generative models and probabilistic autoencoders ( Kingma & Welling , 2014 ; Rezende et al. , 2014 ) . However , previous work has shown that they are vulnerable to adversarial attacks ( Tabacof et al. , 2016 ; Gondim-Ribeiro et al. , 2018 ; Kos et al. , 2018 ) : an adversary attempts to fool the VAE to produce reconstructions similar to a chosen target by adding distortions to the original input , as shown in Fig 1 . This kind of attack can be harmful when the encoder ’ s output is used downstream , as in Xu et al . ( 2017 ) ; Kusner et al . ( 2017 ) ; Theis et al . ( 2017 ) ; Townsend et al . ( 2019 ) ; Ha & Schmidhuber ( 2018 ) ; Higgins et al . ( 2017b ) . As VAEs are often themselves used to protect classifiers from adversarial attack ( Schott et al. , 2019 ; Ghosh et al. , 2019 ) , ensuring VAEs are robust to adversarial attack is an important endeavour . Despite these vulnerabilities , little progress has been made in the literature on how to defend VAEs from such attacks . The aim of this paper is to investigate and introduce possible strategies for defence . We seek to defend VAEs in a manner that maintains reconstruction performance . Further , we are also interested in whether methods for defence increase the robustness of downstream tasks using VAEs . Our first contribution is to show that regularising the variational objective during training can lead to more robust VAEs . Specifically , we leverage ideas from the disentanglement literature ( Mathieu et al. , 2019 ) to improve VAEs ’ robustness by learning smoother , more stochastic representations that are less vulnerable to attack . In particular , we show that the total correlation ( TC ) term used to encourage independence between latents of the learned representations ( Kim & Mnih , 2018 ; Chen et al. , 2018 ; Esmaeili et al. , 2019 ) also serves as an effective regulariser for learning robust VAEs . Though a clear improvement over the standard VAE , a severe drawback of this approach is that the gains in robustness are coupled with drops in the reconstruction performance , due to the increased regularisation . Furthermore , we find that the achievable robustness with this approach can be limited ( see Fig 1 ) and thus potentially insufficient for particularly sensitive tasks . To address this , we apply TC–regularisation to hierarchical VAEs . By using a richer latent space representation than a standard VAE , the resulting models are not only more robust still to adversarial attacks than single-layer models with TC regularisation , but can also provide reconstructions which are comparable to , and often even better than , the standard ( unregularised , single-layer ) VAE . ∗Equal Contribution . Contact at : mwilletts @ turing.ac.uk ; acamuto @ turing.ac.uk Published as a conference paper at ICLR 2021 Adversary Target 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial attacks , we develop a class of hierarchical VAEs that are more resilient still . Our model , Seatbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relative to single layer regularised VAEs . We show that regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . See Figure 1 for a demonstration of how adversarial attacks are highly effective on vanilla VAEs , less effective on regularised VAEs and close to ineffective on our proposed Seatbelt-VAE . Thus our key contributions are : • A demonstration that regularised VAEs , trained with an up-weighted total correlation , are significantly more robust to adversarial attacks than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness to adversarial attack . • New connections between robustness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . They have a joint distribution over data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an appropriate distribution given the form of the data , the parameters of which are represented by deep nets with parameters ✓ . As exact inference is intractable for this model , in a VAE we perform amortised stochastic variational inference . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradient ascent on the evidence lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adversarial attack an agent is trying to manipulate the behaviour of some machine learning model towards a goal of their choosing . Commonly in deep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks on CelebA for different models : a ) Vanilla VAE b ) -TCVAE c ) our proposed Seatbelt- VAE . Clockwise within each plot we show the initial input , its reconstruction , the best adversarial input the adversary could pro- duce , the adversarial distortion that was added to make the adver- sarial input , the adversarial input ’ s reconstruction , and the target image . We are trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can see that the ad- versarial reconstruction for the Vanilla VAE looks substantially like Wintour , indicating a successful attack . The -TCVAE adv . reconstruction does not look like Wintour , so the attack has not been successful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figure 1.a ) for an example of a successful attack on a vanilla VAE . Here we are trying to turn Hugh Jackman ( Original , top left ) into Anna Wintour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective mode of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial attacks , we develop a class of hierarchical VAEs that are more resilient still . Our model , Seatbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relative to single layer regularised VAEs . We show that regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . See Figure 1 for a demonstration of how adversarial attacks are highly effective on vanilla VAEs , less effective on regularised VAEs and close to ineffective on our proposed Seatbelt-VAE . Thus our key contributions are : • A demonstration that regularised VAEs , trained with an up-weighted total correlation , are significantly more robust to adversarial attacks than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness to adversarial attack . • New connections between ro stness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . They have a joint distribution over data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an appropriate distribution given the form of the data , the parameters of which are represented by deep nets with parameters ✓ . As exact inference is intractable for this model , in a VAE we perform amortised stochastic variational inference . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradient ascent on the evidence lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adversarial attack an agent is trying to manipulate the behaviour of some machine learning model towards a goal of their choosing . Commonly in deep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks on CelebA for different models : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each plot we show he initial input , its reconstruction , the best adversarial input the adversary could produce , the adversarial distorti n that was added to make the adversarial input , the adversarial input ’ s reconstruction , and the target image . We are trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can se that the adversarial reconstruction for the Vanilla VAE looks substantially like Wintour , indicating a successful attack . The -TCVAE adv . reconstruction does not look like Wintour , so the attack has not been successful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wint ur . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figure 1.a ) for an example of a successful attack on a vanilla VAE . Here we are trying to turn Hugh Jackman ( Original , top left ) into Anna Wintour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective mode of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 Improvi g VAEs ’ Robustness t A i l Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial attacks , we develop a class of hierarchical VAEs that re more r silient still . Our model , Seatbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relative to single layer regula ised VAEs . We show that regularised hierarch cal VAEs , without our proposed extensions , are not robust to adversarial att . See Figure 1 for d monstration of how adversarial attacks are highly effective on vanilla s , less effective on regularised VAEs a d cl se to ineff ctive on our proposed Seatbelt-VAE . Thus our key contributions are : • A demonstration that regularised VAEs , trained with an up-weighted total correlation , are significa tly more r bust to adversarial attacks than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness to adversarial attack . • New connections between robustness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) are a deep extensi n of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . They have a joint distribution over data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an appropriate distribution given the form of the data , the parameters of which are represented by deep nets with parameters ✓ . As exact inference is intractable for this model , in a VAE we perform amortised stochastic variational inf rence . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradient ascent on the evidence lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adversarial attack an agent is trying to manipulate the behaviour of some machine learning model towards a goal of their choosing . Commonly in deep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks on CelebA for different models : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each plot we show the initial input , its reconstruction , the best adversarial input the adversary could produce , the adversarial distortion that was added to make the adversarial input , the adversarial input ’ s reconstruction , and the target image . We are trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can see that the adversarial reconstruction for the Vanilla VAE looks substantially like Wintour , indicating a successful attack . The -TCVAE adv . reconstruction does not look like Wintour , so the attack has not been successful , but t is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figure 1.a ) for an example of a successful attack on a vanill VAE . Here we are trying to turn Hugh Jackman ( Original , top left ) int Anna Wintour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effectiv mode of attack VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the i sight that regulari ed VAEs are robust to adversarial attacks , we dev lop a lass of hierarchical VAEs tha are more resili nt still . Our model , Seatbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relativ to sin le lay r regularised VAEs . We how th t r gularised hierarchical VAEs , without our proposed exten ions , ar not robust to adversaria ttack . See Figure 1 for a d monstration of how adversarial attacks ar hig ly effective on vanilla VAEs , less effective on regulari d VAEs and cl se to ineffective on our proposed Seatbelt-VAE . Th s ur key contributions are : • A demonst ation that regularised VAEs , trained with an up-weighted tot correlation , are significantly more robust to adversarial attacks than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provid further robustness to adversarial attack . • N w co nections between robustness , disentangling and adversarial attack , linked through regularisation . 2 . Backgr und 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezende t al. , 2 1 ) . They have a joint distribution over data x and latent variables z : p✓ ( x , = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and ✓ ( x|z ) is an appropriate distribution given the form of the data , the parameters of which are repres nted by deep n t with parameters ✓ . As exac inference is intractable for this model , in a VAE we perf rm amortised stochastic variational inference . By n r ducing a va iational p sterior distrib tion over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradi nt ascent on the evidence lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ x z DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ a d jointly , using the reparameterisation trick o take gradients thr ugh Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an dversarial attack an agent is trying to manipulate the beh viour of some achine le ning model towards a goal of their choosing . Commonly in deep learni g this would be fo ling a classifier to misclassify an image thr ugh adding a small pe turbatio ( Akhtar & Mian , 2018 ; Gilmer t al. , 2018 ) . Very small changes in input , of little importance o the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks on CelebA for different m dels : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each plot we show the initial input , its r construction , the best adversarial input the adversary could produce , the adversarial distorti n that was added to make the adversari l input , the adver arial input ’ s reconstruction , and the target image . W ar trying to make the initial input ( Hugh Jackman ) look like the ta get ( Ann Wintour ) . You can see that the adversarial reconstruction for the Vanilla VAE looks substantially like Wintour , indica ing a successful attack . The -TCVAE adv . reconstruction does not l ok like Wintour , so the attack has not bee successful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently ard to a tack that the output under att still lo ks l ke Jackman , not Wintour . output . Att cks on VAEs have been pr posed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given d stor ed image as input . See Figure 1.a ) or an example of a successful attack on a vanill VAE . Here we ar trying to turn Hugh Jackman ( Original , top l ft ) i to Anna Wintour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bott m right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial r c , bottom middle ) . The adversary has achieved their goal . The urr nt most effective m de of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 5 56 57 58 59 0 1 2 3 4 5 66 67 68 69 0 1 2 3 4 5 76 77 78 79 0 1 2 3 4 5 86 87 88 89 0 1 2 3 4 5 096 097 098 099 0 1 2 3 4 5 106 107 108 109 Improving VAEs ’ Robustness to Adve sarial Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial at acks , we develop lass of hierarchical VAEs that are more resilient still . O r m del , Se tbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relative to single layer regularised VAEs . We show that regularised hierarchical VAEs , without our proposed extensions , are not robust to dv rsarial attack . See Figure 1 for a demonstration of how adversarial attacks are highly effective on vanilla VAEs , less effective on regularis d VAEs and close to ineffective n our proposed Seatbelt-VAE . Thus our key contributions re : • A dem nstration that regularised VAEs , t ained with an up-weighted total corr lati n , are significa ly more robust to advers ri l attac s than vanilla VAEs . • We introduce a hierarchical V E , the Seatbelt-VAE , that provides further robustness to adversarial attack . • New connections between robustness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezend et al. , 2014 ) . They hav a joint distribution over data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) nd p✓ ( x|z ) is an app opriate distri bution given the form of the d ta , th parameters f which are r presented by deep nets with parameters ✓ . As exact inference is intractable for this model , in a VAE we perform amortised stochastic variation l inference . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perfo m gradient ascent on the evidenc lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adv sa ial attack an agent is trying to manipulate the behaviour of some m chine learning model towards a goal of their choosing . Commonly in d ep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Lat nt-space adversarial attacks Ce ebA for diff rent models : a ) Vanilla VAE b ) -TCVAE c ) our proposed S atbeltVAE . Clockwise wi hi each pl t we sh w th i itial input , its reco structio , the be t adversarial input the adversa y could pr - duce , the adversarial distortion that was d ed to make he adversarial input , the adversaria input ’ s reconstruction , nd the target image . We are trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can see that the adversarial reconstruction for the Vanilla VAE looks substantially like Wintour , indicating a successful attack . The -TCVAE adv . reconstruction does not look like Wintour , so the attack has not been successful but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figure 1.a ) for an example of a successful attack on a vanilla VAE . Here we are trying to turn Hugh Jackman , top left ) into Anna Wintour ( Target , bottom left ) . e can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective mode of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 055 056 057 058 059 060 061 062 063 064 065 066 067 068 069 070 071 072 073 074 075 076 077 078 079 080 081 082 083 084 085 086 087 088 089 090 091 092 093 094 095 096 097 098 099 100 101 102 103 104 105 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial attacks , we develop a class of hierarchical VAEs that are more resilient till . Our model , Seatbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , relative to single layer regularised VAEs . We show that regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . S e Figure 1 for a demon tration of how adv rsarial attacks are ighly effective on vanill VAEs , less effective on regularised VAEs nd close to i effective on our proposed Seatbelt-VAE . Thus our key contributions are : • A demonstration at eg larised VAEs , tra ned with an up-weighted total corr lation , are significa tly more robust to adversarial att cks than v nilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness to adversarial attack . • New connections between robustness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variatio al autoencoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . They have a joint distribution ov r data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) wh re p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an appropriate distribution given the form of the data , the pa ameters of which are represented y dee nets with parameters ✓ . As xact inference is intr c ble for this model , in VAE we perform mortised stochastic varia al inference . By i roducing a variational o terio distribution ov the latent vari bles q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradient ascent on he evidence lower bou d ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ nd jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adversarial attack an agent is trying to manipulate the behaviour of so e machine learning model towards a goal of their choosing . Commonly in deep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Late t-space adversarial attacks on CelebA for different m dels : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each plot we show the initial input , its reconstructio , the best adversarial input the adversary could produce , the advers rial distortion that was added to make the adversarial input , the adversarial input ’ s reconstructio , and the target image . We are trying t make th initial input ( Hugh Jackman ) look like the targe ( Anna Wintour ) . You can see that the adversarial reconstruction or the Vanilla VAE looks substantially like Wintour , indicat ng a successful attack . The -TCVAE adv . r c nstruct on d es not look like Wintour , so the attack has not been successful , but it is n t Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs h ve be n pr p sed in Tabac f et al . ( 2016 ) ; Gon im-Ribeiro et al . ( 2018 ) ; K et l. ( 2018 ) . Th adv rsary w nts draws from the model to e close to target image when given a distorted image as input . See Figure 1.a ) for an example of a successful attack on a v nill VAE . Here we are tryin to turn Hugh Jackman ( Original , top left ) into Anna Wi tour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , op middle ) to a somewh t blurry vers on of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective mode of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 5 56 57 58 59 0 1 2 3 4 5 66 67 68 69 0 1 2 3 4 5 76 77 78 79 0 1 2 3 4 5 86 87 88 89 0 1 2 3 4 5 096 097 098 099 0 1 2 3 4 5 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the i si ht that regulari ed VAEs are robust to adversarial at acks , we evelop l ss of hierarchi l VAEs that are more resilient till . O r m del , Se tbe t- AE , provides both robustness to adv sarial ttack , and higher quality reconstructions , relative to single layer regularised VAEs . We show that regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . Se Figure 1 for a demonstration of how adversarial attacks are high y effective on vanilla VAEs , less effective on regularis d VAEs and close to ineffective on our proposed Seatbelt-VAE . Thus our k y contributions are : • A demonstration that regularised VAEs , t ained with an up-weighted otal corr lati n , a significa ly more robust to a ve s ri l attac than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness to adversarial attack . • Ne connectio s betwee robustness , disentangling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variational autoencoders ( VAEs ) ar a deep extension of factor analy is suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Rezend et al. , 2 14 ) . Th y hav a joint distribution over data x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) nd p✓ ( x|z ) is an app opriate distri bution given the form of the d ta , th parameters of which are r presented by deep nets with parameters ✓ . As exact inference is intractable for this model , in a VAE we perform amortised stochastic variational inference . By introducing a variational posterior distrib tion over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perfo m gradient ascent on the evide l wer bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ a d jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adv sa ial attack an agent is trying to man pulat he be viour of some m chine learning model towards a goal of their choosing . Commonly in d ep l arning this would be fooling a classifier to misclassify an image thr ugh adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer t al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks on CelebA for different models : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each plot we show the initial input , its reconstruction , the best adversarial input the adver ary could produce , the adversarial distortion that was added to make the adversarial input , the adversarial input ’ s reconstruction , and the target image . We are trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can see that the adversarial reconstruction for the Vanill VAE looks substantially like Wintour , indicating a succ ssful ttack . The -TCVAE adv . reconstruction does n t look l ke Wi tour , so he attack has n t been successful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figur 1.a ) for an example of a successful attack on a vanilla VAE . Here we are trying to t rn Hugh Jackman , top left ) i to Anna Wintour ( Target , bottom left ) . e can see hat , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective m de of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 5 56 57 58 59 0 1 2 3 4 5 66 67 68 69 0 1 2 3 4 5 76 77 78 79 0 1 2 3 4 5 86 87 88 89 0 1 2 3 4 5 096 097 098 099 0 1 2 3 4 5 106 107 108 Impr ving VAEs ’ Robustnes to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial attacks , we develop lass of hierarchical VAEs that are more resilient still . O r m del , Se tbelt-VAE , provides both robustness to adversarial attack , and higher quality reconstructions , rel tive to single layer regul rised VAEs . We show that reg larised hierarchical VAEs , without our proposed extensi ns , are not robust to adversarial att ck . See Fig re 1 for a demonstration of how dv rsari l attacks are highly effective on vani la VAEs , less eff c ive on regularis d VAE and close to i eff ctive on our propose Seatbelt-VAE . Thus our key contributions are : • A demonstration that regulari ed VAEs , t ained with an up-weighted total corr lati n , are significa tly more robust to advers ri l attac s than vanilla VAE . • We introduce a hierarchical VAE , the Seatbelt-VAE , hat provides further robustness to adversarial attack . • New connections between obustness , di ent ngling and adversarial ttack , linked through regularisation . 2 . Background 2.1 . Variational Autoencoders Variatio al uto ncod rs ( VAEs ) ar d e extension of factor an lysis suitable for high-dimens onal data like images ( Kingma & Welling , 2013 ; Rezende et al. , 2014 ) . They hav a joint distribution over data x and latent variabl s z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an app opriate distri bution given the form of the d ta , the parameters of hich are r presented b deep nets with parameters ✓ . As exact inference is intra table for this model , in a VAE we perform amortised stochastic variational inference . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perfo m gradient ascent on the evidenc lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adv sa ial attack an gent is trying to manipulate the behaviour of some m chine learning model towards a goal of their choosing . Commonly in d ep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversarial attacks CelebA for differe t models : a ) Vanilla VAE b ) -TCVAE c ) our proposed SeatbeltVAE . Clockwise within each pl t we sh w th i itial input , its reconstruction , the best adversarial input the adversary could produce , the adversarial distortion that was added to make he adversarial input , the adversarial input ’ s reconstruct on , nd the target image . We are trying to m ke the initial input ( Hugh Jackman ) look like the targe ( Anna Wintour ) . You can see that the adversarial reconstruction for the Vanilla VAE looks substantially like Wint ur , indicating a successful attack . The -TCVAE adv . econstruction does ot lo k like Wintour , so the att k has not been succe sful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks on VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Kos et al . ( 2018 ) . The adversary wants draws from the model to be close to a target image when given a distorted image as input . See Figur 1.a ) for an example of a successful attack on a vanilla VAE . Here we are trying to turn Hugh Jackman , top left ) into Anna Wintour ( Target , bottom left ) . e can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effective mode of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 55 56 57 58 59 0 1 62 63 64 65 66 67 68 69 0 1 72 73 74 75 76 77 78 79 0 1 82 83 84 85 86 87 88 89 0 1 092 093 094 095 096 097 098 099 0 1 102 103 104 105 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as b ing regularised VAEs . Leveraging the insight that regularised VAEs are robust to adversarial att cks , we develop class of hierarc i al VAEs that re more r ilient still . Our model , Seatbelt-VAE , provides both robustness to advers rial attack , nd higher qualit reconstructions , rel tive to single layer regularised VAEs . We show tha regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . See Fig e 1 for d m n ration of how dversarial attacks are highly effectiv on vani la s , less eff c ive on regularised VAE a d cl s t ineffective on o r proposed Seatbelt-VAE . Thus our key contributions are : • A demonstration t t regularised VAEs , trai d with an up-weighted total correlation , are significantly more r bust to adversarial attacks than vanilla VAEs . • We introduce a hierarchical VAE , the Seatbelt-VAE , that provides further robustness t adversarial att ck . • New con ections between obustness , di ent ngling and adversarial ttack , linked through regu arisation . 2 . Background 2.1 . V ri tion l Autoencoders Variational autoencoders ( VAEs ) are a deep ext nsi n of factor analysis suitable for high-dim nsional dat like images ( Kingma & W lling , 2013 ; Rezende et al. , 2014 ) . They h e a joint di tribution ov r dat x and latent variables z : p✓ ( x , z ) = p✓ ( x|z ) p ( z ) where p ( z ) = N ( 0 , I ) and p✓ ( x|z ) is an appro riate distribution given the form of the ata , the parameters of hich are represented b deep nets with parameters ✓ . As exact inferenc is intractable for t is model , in a VAE we perform amortised stochastic variational inf rence . By introducing a variational posterior distribution over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perform gradient ascent on the evidence lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ ( x|z ) DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ and jointly , using the reparameterisation trick to take gradients through Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adversarial attack an agent is trying to manipulate the behaviour of some machin learning model towards a goal of their choosing . Commonly in deep learning this would be fooling a classifier to misclassify an image through adding a small perturbation ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance to the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Lat nt-space adv rsarial attacks o CelebA for different mod ls : a ) Vanill VAE b ) -TCVAE c ) o r proposed S atbeltVAE . Clockwise within each plot we how t initial input , its r tr ti , th b st dversarial input the advers ry could pro d ce , the dversarial dist rtion th t was added t m ke the adversarial put , the adversarial inp t ’ reconstru tion , and the target image . We a e trying to make the initial input ( Hugh Jackman ) look like the target ( Anna Wintour ) . You can see that the adversarial reconstruction for t e Va illa VAE looks s bstantially like Wint ur , indicating a uccessful attack . The -TCVAE dv . reconstruction does not lo k like Wintour , so the att ck has not been succe sful , but it is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently hard to attack that the output under attack still looks like Jackman , not Wintour . output . Attacks n VAEs have been proposed in Tabacof et al . ( 2016 ) ; Gondim-Ribeiro et al . ( 2018 ) ; Ko et al . ( 2018 ) . The adversary wa ts draws from th m del to be close to a target image when given a distorte image as input . See Figur 1.a ) for n example of a succ ssful attack a vanill VAE . He e we are trying to turn Hugh Jackman ( Original , top left ) int Anna Wintour ( Target , bottom left ) . We can see that , by adding a well-chosen distortion ( Distortion , bottom right ) , t e reconstruction of Jackman goes from l oking like a s mewh blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial rec. , bottom middle ) . The adversary has achieved their goal . The current most effectiv mode of attack VAEs , the latent sp ce attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro 5 56 57 58 59 0 1 2 3 4 5 66 67 68 69 0 1 2 3 4 5 76 77 78 79 0 1 2 3 4 5 86 87 88 89 0 1 2 3 4 5 096 097 098 099 0 1 2 3 4 5 106 107 108 109 Improving VAEs ’ Robustness to Adversarial Attack correlation penalty as being regularised VAEs . Leveraging the i sight that r l VAEs are robust to adversarial att cks , we dev lop lass of hierarchical VAEs tha are more resili nt till . O r m del , Se tbelt-VAE , provides bot robustne s to adversarial attack , and higher quality reconstructions , relativ to single layer regularised VAEs . W how th t regularised hierarchical VAEs , without our proposed extensions , are not robust to adversarial attack . Se Fig re 1 for a demonstration of how dversarial attacks a e hig ly effectiv on vani a s , less eff c ive on regulari d VAE and cl e to i ffe tive on our proposed Sea belt-VAE . Th s ur key contributions are : • A dem nst ation that regularised VAEs , t ained with an up-weighted total corr lati n , are significa tly more robust to advers ri l attac s than vanilla VAEs . • We introduce a hierarchical VAE , the Se tbelt-VAE , that provid further robustness to adversari l attack . • N w co nect ons between obustness , di ent ngling and adversarial attack , linked through regularisation . 2 . Background 2.1 . Variatio al Autoencod rs Variational auto ncoders ( VAEs ) are a deep extension of factor analysis suitable for high-dimensional data like images ( Kingma & Welling , 2013 ; Reze d t al. , 2014 ) . They h v a joint distribution over data x and l tent variables z : p✓ ( x , = p✓ ( x|z ) p ( z ) where p ( z ) N ( 0 , I ) nd p✓ ( x|z ) is an app o riate distri bution given the form of the d ta , th parameters f hich are r pres nted b de p n ts with parameters ✓ . As exac inferenc is intr ctable f r this model , in a VAE we perf rm amortised stochastic variational inference . By n r ducing a va iational p sterior distrib tion over the latent variables q ( z|x ) = N ( µ ( x ) , ⌃ ( x ) ) , we can perfo m gradi nt ascent on the evide c lower bound ( ELBO ) L ( x ) = DKL ( q ( z|x ) ||p✓ ( x , z ) ) = Eq ( z|x ) log p✓ x z DKL ( q ( z|x ) ||p ( z ) ) log p ( x ) w.r.t.both ✓ a d jointly , using the reparameterisation trick o take gradients thr ugh Monte Carlo samples from q ( z|x ) . 2.2 . Attacks on VAEs In an adv sa ial attack an agent is trying to manipulat the beh viour of some chine le ning model towards a goal of their choosing . Commonly in d ep learning this would be fo ling a classifier to misclassify an image thr ugh adding a small pe turbat o ( Akhtar & Mian , 2018 ; Gilmer et al. , 2018 ) . Very small changes in input , of little importance o the human eye , can produce large changes in the model ’ s ( a ) ( b ) ( c ) Figure 1 . Latent-space adversari l at acks on CelebA for different mod ls : a ) Vanilla VAE b ) -TCVAE c ) ur propose Seat ltVAE . Clockwise withi e ch plot we show the initial input , its r construction , the best adver arial input the adversary could produce , the adversari l distorti n that was added to make the adversari l input , the adv r arial input ’ s reconstruction , and the target image . W a trying to mak th initi l input ( Hugh Jackman ) look like th t g t ( Ann Wi tour ) . Y u can see that the adversarial reconstruction for the Vanilla VAE looks substantially like Wint ur , indica a succe sful attack . The -TCVAE adv . reconstruc ion does not l k like Wintour , so the att ck has not been succe sful , but i is not Jackman either . Our proposed model , Seatbelt-VAE , is sufficiently ard to a tack that the output under att still lo ks l ke Jackman , not Wintour . output . Att cks on VAE have been pr posed in Tabacof et al . ( 2016 ) ; G ndim-Ribeiro et a . ( 2018 ) ; Kos et al . ( 2018 ) . The adversa wants draws from the odel to be close to a target image when given d st r ed image as input . See Figure 1.a ) or an example of a successful attack on a vanill VAE . Here we are trying to turn Hugh Jackman i i l , top left ) i to Anna Wintour ( Target , bottom left ) . e can see that , by adding a well-chosen distortion ( Distortion , bott m right ) , the reconstruction of Jackman goes from looking like a somewhat blurry version of the input ( Original rec. , top middle ) to a somewhat blurry version of Wintour ( Adversarial r c , bottom middle ) . The adversary has achieved their goal . The urrent most effective m de of attack on VAEs , the latent space attack ( Tabacof et al. , 2016 ; Gondim-Ribeiro a a es a r e o st a e t o r s l e av a p h . n e a . he , econs c , u , a , u c , . . , s . . , , . , , , . e a a r o o t on a VA E βTC VA E Se at be lt- VA E Adversarial Input Figure 1 : Adversarial attacks on CelebA for different models . Here we start with the image of Hugh Jackman and introduce an adversary that tries to produce reconstructions that look like Anna Wintour . This is done by applying a distortion ( third column ) to the original image to produce an adversarial input ( second column ) . We can see that th adversarial reconstruction for the Vanilla VAE looks s bstantially like Wintour , indicating a successful attack . Adding a regularisation term using the β-TCVAE produc s an adversarial reconstruction that does not look like Wintour , but it is also far from a successful reconstruction . The hierarchical version of a β-TCVAE ( which we call Seatbelt-VAE ) is sufficiently hard to attack that the output under attack s ill looks like Jackman , not Wintour . To summarise : We provide insights into what makes VAEs vulnerable to attack and how we might go about defending them . We unearth novel connections between disentanglement and adversarial robustness . We demonstrate that regularised VAEs , trained with an up-weighted total correlation , are much more robust to attacks than vanilla VAEs . Building on this we develop regularised hierarchical VAEs that are more robustness still and offer improved reconstructions . Finally , we show that robustness to adversarial attack also confers increased robustness to downstream tasks .

Summary: This work builds on the vulnerability of VAEs to adversarial attacks to propose investigate how training with alternative losses may alleviate this problem, with a specific focus on disentanglement. In particular it is found that disentanglement constraints may improve the robustness to adversarial attacks, to the detriment of the performance. In order to get the best of both, the author(s) propose a more flexible (hierarchical) model, trained with the beta-TC penalization on the ELBO. The algorithm, named Seatbelt-VAE, shows improvement over the beta-TC VAE in terms of reconstruction, as well as in term of adversarial robustness for several datasets (Chairs, 3D Faces, dSprites).