Adversarially Robust Representations with Smooth Encoders
Authors: Taylan Cemgil
Sumedh Ghaisas
Krishnamurthy (Dj) Dvijotham
Pushmeet Kohli
Venue:  (2020)
Keywords: Adversarial Learning
Robust Representations
Variational AutoEncoder
Wasserstein Distance
Variational Inference

Abstract: This paper studies the undesired phenomena of over-sensitivity of representations learned by deep networks to semantically-irrelevant changes in data. We identify a cause for this shortcoming in the classical Variational Auto-encoder (VAE) objective, the evidence lower bound (ELBO). We show that the ELBO fails to control the behaviour of the encoder out of the support of the empirical data distribution and this behaviour of the VAE can lead to extreme errors in the learned representation. This is a key hurdle in the effective use of representations for data-efficient learning and transfer. To address this problem, we propose to augment the data with specifications that enforce insensitivity of the representation with respect to families of transformations. To incorporate these specifications, we propose a regularization method that is based on a selection mechanism that creates a fictive data point by explicitly perturbing an observed true data point. For certain choices of parameters, our formulation naturally leads to the minimization of the entropy regularized Wasserstein distance between representations. We illustrate our approach on standard datasets and experimentally show that significant improvements in the downstream adversarial accuracy can be achieved by learning robust representations completely in an unsupervised manner, without a reference to a particular downstream task and without a costly supervised adversarial training procedure. 


Published as a conference paper at ICLR 2020
ADVERSARIALLY ROBUST REPRESENTATIONS WITH SMOOTH ENCODERS
A. Taylan Cemgil, Sumedh Ghaisas, Krishnamurthy Dvijotham & Pushmeet Kohli DeepMind, London (tay ancemg! 1, sumedhg, dvij, barpsheeettggoopp com
ABSTRACT
This paper studies the undesired phenomena of over-sensitivity of representations learned by deep networks to semantically-irelevaa cause for this shorteoming in the classical Variational Auto-encoder (VAE) objec- tive, the evidence lower bound (ELBO). We show that the ELBO fails control the behaviour of the encoder out the support of the empirical data distribution and this behaviour of the VAE can lead to extreme errors in the learned represen- tation. This is a key hurdle in the effective use of representations for data-efficient learning and transfer. To address this problem, propose to augment the data with specifications that enforce insensitivity of the representation with respect to families of transformations. To incorporate these specifications, we propose regularization method that is based on a selection mechanism that creates a fic- tive data point by explicitly perturbing an observed true data point. For certain choices of parameters, our formulation naturally leads to the minimization of the entropy regularized Wasserstein distance between representations. We illustrate our approach on standard datasets and experimentally show that significant im- provements in the downstream adversarial accuracy can be achieved by learning robust representations completely in an unsupervised manner, without reference to a particular downstream task and without a costly supervised adversarial train- ing procedure.
changes in data. We identify a
INTRODUCTION
Representation learning is fundamental problem in Machine learning and holds the promise to en- able data-efficient learning and transfer to new tasks. Researchers working in domains like Computer Vision (Krizhevsky et al. 2012) and Natural Language Processing (Devlin al. 2018) have already demonstrated the effectiveness of representations and features computed by deep architectures for the solution of other tasks. A case in point is the example of the FC7 features from the AlexNet image classification architecture that have been used for many other vision problems (Krizhevsky al. 2012).
The effectiveness of learned representations has given new impetus to research in representation learning, leading lot of work being done on the development of techniques for inducing rep- resentations from data having desirable properties like disentanglement and compactness (Burgess) al. 2018 Achille & Soatto 2017 Bengio 2013 Locatello et al. 2019). Many popular techniques for generating representation are based on the Variational AutoEncoders (VAE) model (Kingma & Welling 2013 RRzende et al. 2014). The use of deep networks as universal function approximators has facilitated very rapid advancements which samples generated from these models often being indistinguishable from natural data. While the quality of generated examples can provide significant convincing evidence that a generative model is flexible enough to capture the variability in the data distribution, it far from a formal guarantee that the representation is fit for other purposes. fact, if the actual goal is learning good latent representations, evaluating generative models only based on reconstruction fidelity and subjective quality typical samples is neither sufficient nor entirely necessary, and can be even misleading.
In this paper, we uncover the problematic failure mode where representations learned by VAEs ex- hibit over-sensitivity gemantically-ireeeevan changes in data. One example of such problematic

---

Published as a conference paper at ICLR 2020
behaviour be seen in Figure | We identify cause for this shortcoming in the classical Vari- ational Auto-encoder (VAE) objective, the evidence lower bound (ELBO), that fails to control the behaviour of the encoder out of the support of the empirical data distribution. We show this be- haviour of the VAE can lead to extreme errors the recovered representation by the encoder and of representations for data-efficient learning and transfer. To
key hurdle in the effective address this problem, we propose to augment the data with properties that enforce insensitivity of the representation with respect to families of transformations.
To incorporate these specifications, we propose a regularization method that is based on selection mechanism that creates a fictive data point by explicitly perturbing an observed true data point. For certain choices of parameters. our formulation naturally leads to the minimization of the entropy regularized Wasserstein distance between representations. We illustrate our approach on standard datasets and experimentally show that significant improvements in the downstream adversarial ac- curacy can be achieved by learning robust representations completely in an unsupervised manner, without reference to particular downstream task and without costly supervised adversarial training procedure.
Xa a
77
Za
θ
X
n
0
X
X
Figure 1: An illustration of the intrinsic fragility of VAE representations. Outputs from Variational Autoencoder with encoder f and decoder parametrized by and 0, respectively, trained on CelebA.
Conditioned on the encoder input X. Va the decoder output X (f())) (g (xx)) is shown on the top row. When the original example is perturbed with a carefully selected vector d such that X2 X, + with ||d]] S c, the output X' turns out be perceptually very different. Such examples suggest that either the representations Z. and Zo, are very different (the encoder is not smooth), or the decoder very sensitive to small changes in the representation (the decoder not smooth), or both. We identify the source of the problem primarily the encoder and propose practical solution.
It clear that if learned representations overly sensitive irrelevant changes in the input (for example, small changes in the pixels of an image or video, or inaudible frequencies added to an audio signal), models that rely on these representations are naturally susceptible to make incorrect predictions when inputs are changed. We argue that such specifications about the robustness prop- erties of learned representations can be one of the tractable guiding features in the search for good representations. Based on these observations, we make the following contributions:
1. We introduce method for learning robust latent representations by explicitly targeting structured model that admits the original VAE model as a marginal. We also show that in the the target is chosen pairwise conditional random field with attractive potentials, this choice leads naturally to the Wasserstein divergence between posterior distributions over the latent space. This insight provides us flexible class of robustness metries for controlling representations learned by VAEs.
2. We develop modification to training algorithms for VAEs to improve robustness of learned representations, using an external selection mechanism for obtaining transformed examples and by enforcing the corresponding representations to be close. As particular selection mechanism, we adopt attacks adversarial supervised learning (Madry et al. 2017) to attacks to the latent representation. Using this novel unsupervised training procedure learn encoders with adjustable robustness properties and show that these are effective at learning representations that perform well across variety of downstream tasks.
2

---

Published as a conference paper at ICLR 2020
3. We show that alternative models proposed in the literature, in particular 3- V-E model used for explicitly controlling the learned representations, or Wasserstein Generative Adversarial Networks (GANs) also be interpreted in framework variational lower bound maximization.
4. We show empirically using simulation studies on MNIST, color MNIST and CelebA datasets, that models trained using our method learn representations that provide higher degree of adversarial robustness even without supervised adversarial training.
GENERATIVE MODELS
Modern generative models are samplers p(X for generating realizations from an ideal target distribution (X)), also known the data distribution. In practice ((X) is unknown in the sense that it is hard to formally specify. Instead, we have representative data set X, samples that are assumed be conditionally independently drawn from the data distribution x(X) of interest. We will refer to the empirical distribution as 4 (X) = [ ΣeEx ö(x E). The goal is learning parameter such that p(X 8*) = ( 4" (p(Z) = (X). thereby also learning a generator.
2.1 FROM VAE TO SMOOTH ENCODERS
The VAE corresponds to the latent variable model p( 0)p(Z) with latent variable Z and obser- vation X. The forward model p 2, (the decoder) is represented using neural network with parameters 0, usually the mean of a Gaussian (Nx 0), v/,) where u is scalar ob- servation noise variance and I is identity matrix. The prior is usually standard Gaussian p(Z = (2; 0, Is). The exact posterior over latent variables p(2
x, 0) is approximated by probability model q( z, 17) with parameters 7). A popular choice here Gaussian N(Z: p(:;; m), E(x; v)), where the mapping f such that (j,, Σ) far, 11) is chosen to be neural network (with parameters 17 to be learned from data). We will refer to the pair f.g g as an encoder-decoder pair. Under the above assumptions, VAB's are trained by maximizing the following form of the ELBO using stochastic gradient descent (SGD),
multivariate
log p(X x 0)
E (logp(X x|Z,0)}, X= (K 2, m7) (2)) (n.
The gradient of the Kullback Leibler (KL) divergence term above (see A.I is available in closed form. An unbiased estimate of the gradient of the first using the reparametrization trick Kingma & Welling (2013), aided by automatic differentiation.
be obtained via sampling = from g
2.2 A PROBLEM WITH THE VAE OBJECTIVE
Under the i.i.d. assumption, where each data point (*)), for = 1... is independently drawn from the model equivalent batch ELBO objective can be defined (See also E. as
B(n 0)
N Σ By60 (n. 0) = DKi (+ (x
const
where the empirical distribution of observed data is denoted Ā. This form makes it more clear that the variational lower bound is only calculating the distance between the encoder and decoder under the support of the empirical distribution.
To see how this locality leads to a fragile representation, we construct a VAE with discrete latents and observations. We let X (1...., N₂) } and Z E f1...., N₂) and define the following system of conditional distributions as the decoder and encoder models as:
p(X i|z = j) exp (u(m, - i/Na))
(w)
= =|x= exp w (m j/N₂)
where w(u) cos(2 These distributions be visualized by heatmaps of probability tables where i and j are row and column indicies. respectively Figure 2 This particular von-M von-Mises like parametrization is chosen for avoiding boundary effects due finite latent and observable spaces.
3

---

Published as a conference paper at ICLR 2020
Figure 2: Example VAE model. (left) Hcatmap of the coder distribution (darker colors referring to higher prob- abilitty q x| (: where each row i is probability distribution over latents with a mode around Mi and spread o; (middle) Heatmap of the decoder dis- tribution p(X i = my, Uÿ) where each column j is a probability distribution with mode my and spread The prior p(Z) is chosen to be uniform and is not shown here. (right) The marginal model p(X alm, v) =E p(Z = j)p(X = i| = m,, v) depicted as an histogram.
Encader
Desoier
Latent
Latent
Probobiltty
The prior p(Z) taken as uniform, and is not shown. Note that this parametrization emulates a high capacity network that can model any functional relationship between latent states and observations, while being qualitatively similar to standard VAE model with conditionally Gaussian decoder and encoder functions.
In reality, the true target density is not available but we would have a representative sample. To simulate this scenario, sample 'dataset" from a discrete target distribution IT ((X): this is merely a draw from a multinomial distribution, yielding a multinomial vector s with entries & that gives the count how many times observe i. The results of such experiment are depicted in Figure aia (see caption for details). This picture reveals several important properties of a VAE approximation.
aa)
(b)
Figure 3: (a) Result by optimizing the ELBO for a VAE that illustrates the fragility of the encoder. Subfigure with the title 'Data' (x) is random sample from the true target 'Target' (=(X)) on the right. The resulting encoder g( [ XX) and decoder p( X ()) are shown as 'Q" and 'P', respectively. The vertical and horizontal axes correspond latents Z and observations X respectively. Integrating over the decoder distribution using a uniform prior p(Z) over the latents, we obtain the model distribution 'Model' p(X)= Eg p( X Z) (Z). (b) The results obtained by a smooth encoder. Both the decoder and the representation (encoder) are more smooth while essentially having similar fitting quality.
1. After training, we observe that when j and j' are close, the corresponding conditionals p(X|Z = j) and p(X = j') are close (hence corresponding decoder mean parame- ters my and my are close, hence (see middle panel of Fig a) with the title P showing the decoder). This smoothness is perhaps surprising at a first sight: in this example, we could arbitrarily permute columns of the decoder and still get the same marginal distribu- tion. Technically speaking, given a uniform prior p(Z). the marginal likelihood p(X (0) is entirely invariant with respect permutations of the latent state. In fact if the encoder distribution wouldn't be constrained we could also permute the columns of the encoder to keep the ELBO invariant. In the appendix E.2 we provide an argument why the choice of an unimodal encoder model and optimization of the variational objective leads naturally to smooth decoder functions.
2.
The encoders found by the VAE on the other hand are not smooth at all, despite the fact that the model shows a relatively good fit. This behaviour alerts us about judging generative models only by the quality of the samples, by traversing the latent space and generating conditional samples from the decoder. The quality the decoder seems to be not a proxy for the robustness of the representation.
4

---

Published as a conference paper at ICLR 2020
The fragiliity of representations is inherent from the ELBO objective. For the entire dataset, batch ELBO that involves the counts Sy can be written as
s.q(Z j/ p(X = - = j)p(z =
ELBO - EΣ s: s.glZ = j|xa = i) log
The last expression is proportional to the negative KL. divergence between two tabular distributions: sz j|X, 1)/ and p(X 2 j)p(Z j). As such, whenever 8; is zero, the contribution of row i of the encoder distribution vanishes and the corresponding parameters μ4 and o; are not effecting the lower bound. In sense, the objective does enforce any structure on the encoder outside of the position of the data points in the training set. This figure shows that the out- of-sample behaviour (i.e., for where (X) 0) the encoder is entirely initialization dependent, hence no learning takes place. We would also expect that the resulting representations would be fragile, in the sense that small perturbation of an observation can result in a large change in the encoder output.
ROBUST REPRESENTATIONS WITH SMOOTH ENCODERS
In this section, we will adopt a strategy for training the encoder that is guaranteed not to change the original objective of the decoder when maximizing the lower bound while obtaining a smoother representation. The key idea of our approach is that assume an external selection mechanism that able to provide new fictive data point x' in the vicinity of each observation in our data set x. Here, "in the vicinity" means that we desire that the corresponding latent state of the original datapoint 2 = fxx; and the latent state of the fictitious point x' f(z'; 7)) should be close to each other in some sense. Assuming the existence of such external selection mechanism, we first define the following augmented distribution
p(X=x, = x. X' = ='' x f
p(x = x ZlZz.0)p(X' x' Zz. (). Zz)dZ
(3)
exp(- c( Ze. Zn )p(p) ( This is pairwise conditional Markov random field (CRF) model (Lafferty et al., 2001 Sutton & McCallum 2012), where we take c( (Za, Za. as pairwise cost function. A natural choice here would be, for example, the Fuclidean square distance
where 2i (Za, Σb)
1z Zoll². Moreover, we choose nonnegative coupling parameter 2 0. For any pairwise QZZa, Zo) distribution, the ELBO has the following form
logp(X x, X' =0(00)
E (logp(X = x| x|Za, 0))((.))) E (log (logp(Za))ogs
+Eoggg'(X' Zo, 0) (q(2))))))))))) I flog pl (o)) ((()))
7 Bc( Zo) ( + H(Q(Za, Z.))
(4)
2
It may appear that the SE has to maintain pairwise approximation distribution (Z,, Zo). How- ever, this turns out to be not necessary. Given the encoder, the marginals of QZ Zo) are fixed as (2,) q(2 x
x, 1) and (x(Z,) = q[ x, m)) so the only remaining terms that depend on the pair distribution are the final two terms in (4. We note that this two terms are just the objective function of the entropy regularized optimal transport problem (Cuturi) 2013 Amari et al. 2017). If we view Q(Z,, Zb) as a transport plan, the first term is maximal when the expected cost is minimal while the second term is maximal when the variational distribution is factorized as Q?Z,, 7x)
In retrospection, this link is perhaps not that surprising as the Wasserstein distance, the solution of the optimal transport problem, is itself defined as the solution to variational problem (Solomon, 2018; Consider a set I of joint densities Q Zn) with the property that Q has fixed marginals (a) and Qu i.e.,
T(Qa, Qu) = (Q Qulaa) / (1(2a,Zi)dZon Qb(Zo) (Q(2a,72)dZ.
(5)
5

---

Published as a conference paper at ICLR 2020
The Wasserstein divergened | denoted by WD is defined as the solution of the optimization problem with respect to pairwise distribution Q
/ clZe, 2.)( 2x) Zo)dL,dZs
WDId(Q.. Q+) - inf
(6)
QEI'
where c(Za, Zb) a function that specifies the 'cost' of transferring a unit of probability mass from Za to Zb.
is important to note that with our choice of the particular form of the variational distribution QZZa; ZΔ) we can ensure that can achieve this by simply integrating out the X", effectively ignoring the likelihood term for the fictive observations. Our choice does not modify the original objective of the decoder due to the fact that the marginals are fixed given 7). To see this, take the exponent of (4) and integrate over the unobserved X'
still optimizing lower bound of the original problem. We
log / [d''p(X= XX'p(X=x,X110
logp(X = =x10)
E (logp(( x z/ 01) Q(2)) + flog (looop((Z)))(zz E (log (1o)2(Z)))((aa))
- B (c(Za: Zo) (Q( 2x)) = BB)((,
we name this lower bound B&E as the Smooth Encoder ELBO (SE-ELBO). The gradient of BsE with respect the decoder parameters 0 identical the gradient of the original VAE objective B. This is intuitive as x' is an artificially generated sample, we should use only terms that depend on x and on x'. Another advantage of this choice is that is possible to optimize the decoder and encoder concurrently as in the standard VAE. Only an additional term enters for the regularization of the en- coder where the marginals obtained via amortized inference g [Za Fa 17) and q Zb, 26, 77) are forced to be close in a regularized Wasserstein distance sense, with the coupling strength 7. Effectively, we are doing data augmentation for smoothing the representations obtained by the encoder without changing the actual data distribution. In the appendix [.3]] we also provide argument about the smoothness of the corresponding encoder mapping, justifying the name. The resulting algorithm is actually simple modification to the standard VAE and is summarized below:
Initialize 1, ((())
for t = 1,2,
do
Ta = GetData(),
Select( I., (see Section 3.1
Pa: N. = f(xa:))
μb, Dn = fasi 17) (Compute Representation)
WD2, . (n)
Va, Mb: Do. 7) (see Apdx. B.2
u NN, (Reparametrization Trick)
E1 0) - -2 H/a. + ///2 u; 0)1 (Data Fidelity)
Ez(1) - (11ea112 ||m0|= +T<EE, En}) (Prior Fidelity)
E(n, 8) (1, E2(n) WWD (1)
n7(r), ((T) Optimization Step( F, '7 11) g(r
end
3.1 SELECTION MECHANISM VIA ADVERSARIAL ATTACKS
Adversarial attacks are one of the most popular approaches for probing trained models in supervised tasks, where the goal of an adversarial attack is finding small perturbations to an input example that would maximally change the output, e.g., flip classification decision, change significantly a prediction (Szegedy et al. 2013). The perturbed input is named as an adversarial example and these extra examples models (Madry et al.] 2017) Kurakin et al.] 2016). As extra samples are also included, such a training procedure is referred as data augmentation. However, in unsupervised learning and density estimation, data augmentation is not a valid approach as the underlying empirical distribution would be altered by the introducing new points.
used, along with the original data points, for training adversarially robust
We use the term divergence to distinguish the optimal transport cost from the corresponding metric. This distinction reminiscent the distinction hetween Fuclidian divergence -| and the Fuclidian distance ||-

---

Published as a conference paper at ICLR 2020
However, we let the encoder to target different distribution than the actual decoder, we can actually use the extra, self generated samples to improve desirable properties of a given model. Hence this approach could also be interpreted bias our search for a "good encoder' and the data selection mechanism acts like a critique, carefully providing examples that should lead to similar representations.
"self-supervisedd learning approach where
In this paper we will restrict ourselves to Projected Gradient Descent (PGD) attacks popular in ad- versarial training Carlini & Wagner (2016) selection mechanism, where the goal of the attacker is finding point that would introduce the maximum difference in the Wasserstein distance of the latent representation. In other words, we implement our selection mechanism where the extra data point is found by approximately solving the following constrained optimization problem
= + arg max d: Sc
(D x. n), g (( x + d,
This attack is assigned a certain iteration budget L for given radius c, that we refer selection iteration budger and the selection radius, respectively. We note a similar attack mechanism is pro- posed for generative models described in (Kos et al. 2017), where one of the proposed attacks is directly optimizing against differences in source and target latent representations. Note that our method is not restricted to particular selection mechanism; indeed two inputs that should give similar latent representation could be used as candidates.
4 EXPERIMENTS
Goal and Protocol In our experiments, we have tested and compared the adversarial accuracy of representations learned using VAE and our smooth encoder approach. We adopt two step exper- imental protocol, where we first train encoder-decoder pairs agnostic to any downstream task. Then fix the representation, that is we freeze the encoder parameters and only use the mean of the encoder as the representation, then train a simple linear classifier based on the fixed representation using standard techniques. In this supervised stage, no adversarial training technique is employed. Ideally, we hope that such an approach will provide a degree of adversarial robustness, without the need for a costly, task specific adversarial training procedure. To evaluate the robustness of the re- sulting classifier, for each data point in the test set, we search for an adversarial example using an untargeted attack that tries to change the classification decision. The adversarial accuracy is reported in terms of percentage of examples where the attack is not able to find an adversarial example.
The VAE and SE decoder and encoder are implemented using standard MI.P and ConvNet archi- tectures. The selection procedure for SE training is implemented as projected gradient descent optimization (a PGD attack) with selection iteration budget of L iterations to maximize the Wasser- stein distance between x x)) and [Z| x + 5) with respect the perturbation 8 where ||0||=o < c. Further details about the experiment can be found in the appendix C.I
We run simulations ColorMNIST, MNIST and CelebA datasets. The ColorMNIST is constructed from the MNIST dataset by coloring each digit artificially with all of the colors corre- sponding to the seven of the eight corners of the RGB cube (excluding black). We present the results with the strongest attack we have experimented: PGD attack with 100 iterations and 10 restarts. We observe that for weaker attacks (such 50 iterations with no restarts), the adversarial accuracy is typically much higher.
Results:
For the ColorMNIST dataset, the results are shown in Figure 4 where we test the adversarial accuracy of representations learned by our method and compare it to VAE. We observe that the adversarial accuracy of VAE representation quickly drops towards zero while SE can maintain adversarial accuracy in both tasks. In particular, we observe that for the arguably simpler color classification task, we are able to obtain close to perfect adversarial test accuracy using representations learned by the VAE and SE, However, when the classifiers are attacked using PGD, the adversarial accuracy quickly drops with increasing radius size, while the accuracy degrades more gracefully in the SË case.
In Figure 5 we show the robustness behaviour of the method for different architectures. A ConvNet seems perform relatively better than an MLP but these results show that the VAE representation is not robust, irrespective of the architecture. We have also carried out controlled experiments with random selection instead of the more costly untargetted adversarial attacks (See appendix C.T Fig-
7

---

Published as a conference paper at ICLR 2020
Color Ni Utzdh: TesleCaur, Sudipenig))
Cajer Hoad (Archi Canw, Teseitight Bualget:00)
100
Runaau sub, waw.iauunnaa Suturu
VAE
Advemara Aecuracy (14)
02-
Selkad
Advenar Accuracy (hh)
10-
Sellod
Momenal
60
VAE Nemmna SE Keminsl
CO-
0.53
0.58
0.22
0.30
0.01
0.00
0.50
3.30
Attack Radius
Atthce Radius
(a) Task: Color
(b) Task: Digit
Figure 4: Simulation Results on ColorMNIST. The goal is the comparison of adversarial accuracy of VAE representations with SE representations trained with a selection radius of 0.1 and 0.2 and a selection budget of 20 PGD iterations. Vertical axis shows the adversarial accuracy as a function of attack radius. The dashed and dotted lines show the nominal accuracy of the VAE and SE when there are no attacks (The SE nominal accuracy is virtually identical for different selection radii, hence only a single level is shown.)
ure (aa) for further results). We observe some limited improvements with SE using random selection in adversarial accuracy compared to VAE but training SE with adversarial selection seems to be much more effective. We note that the selection iteration budget was lower (L = 20 with no restarts) than the attack iteration budget (100 with 10 restarts) during evaluation. It was not practical to train the encoder with more powerful selection attacks, thus it remains to be seen if the tendency of in- creased accuracy with increased iteration budgets would continue. We also observe that essentially the same level of adversarial accuracy can be obtained with a small fraction of the available labels (See appendix C.I Figure X for further results).
Mt (Arch: MLP.P T.s Sc.. Htr Budgett501
Miist (Arch Cony. Task Digtt Sei, kor. Budget:501
0.2
Adverana Accumaty 150
VIE Nominal
0.2
Adderuaaa Accumacy 150
Selted
solttdd D.1
S6: Namiiul
02-
80
60-
40-
20.
20
0.00
Artack Radius
Attack Radius
MLP
(b) ConvNet
Figure 5: Simulation Results on MNIST. The goal is illustrating the effect of the architecture (MLP and ConvNet). In all the examples, the SE is trained by a selection radius a budget of 50 PGD iterations. The linear classifier is always trained without any adversarial training. by fixing the encoder parameters. The blue dot, green triangle and red squares correspond to the standard VAE and SE trained with selection radius of 0.1 and 0.2 respectively. The dashed and dotted lines show the nominal accuracy of the VAE and SE when there are no attacks (The SE nominal accuracy is virtually identical for different selection radii, hence only a single level is shown.)
We have also repeated our experiments on the CelebA dataset, a large collection of high resolution face images labeled with 40 attribute labels per example. We have used 17 of the attribute labels as the targets of 17 different downstream classification tasks. The results are shown in Table The results clearly illustrate that we can achieve much more robust representations than VAE. is also informative to investigate specific adversarial examples to understand the failure modes. In Figure 6 we show two illustrative examples from the CelebA. Here we observe that attacks to the SE representations are much more structured and semantically interpretable. In our exploratory investigations, we qualitatively observe that the reconstructions corresponding to the adversarial examples are almost always legitimate face images with clearly recognizable features. This also seems support our earlier observation that VAE decoders typically smooth while the encoders
8

---

Published as a conference paper at ICLR 2020
X
o fXxa)
X; Xa +
(o f)(o)
d
(a) VAE
(b) SE
(c) VAE
(d) SE
Figure 6: Qualitative results on CelebA. Attacks downstream tasks (a), (b) 'Mustache' classifica- tion, (c), (d) 'Bald' classification. (a) In the VAE case, the attack is successful but the perturbation does have a visible structure. (b) The SE representation is attacked by perturbation that can clearly be identified as drawing beard on the image. In this case, the attack is able to fool the classi- fier and the generated image from the representation that of a person with beard and mustache. In the second example (c), the VAE representation seems to be attacked by exploiting the non-smooth nature of encoder by mapping the latent representation be seen from the corresponding reconstruction.
the one in the vicinity of a clearly
different person with the desired features, In contrast, the SE case (d), an unsuccessful attack that adds a much more structured perturba- tion. From the reconstruction it evident that latent feature is attacked that seems control the receding hairline.
are inferring non-robust features. Our approach seems to be step towards obtaining more robust representations.
VAE
SE
VAE
SE
Task
Nom
Adv
Nom
Adv
Task
Nom
Adv
Nom
Adv
Brown Hair
83.1
0.0
80.5
41.5
Bald
97.8
0.0
97.4
86.5
Eyeglasses
95.6
0.0
95.7
33.0
Mustache
96.1
0.0
95.7
84.4
Black Hair
79.7
0.0
81.4
31.4
Necklace
86.2
0.0
88.0
78.9
Bangs
90.3
0.0
89.6
27.0
Straight Hair
79.1
0.0
78.7
77.3
No Beard
86.5
0.0
85.3
24.3
Wearing Hat
96.6
0.0
96.4
77.3
Wavy Hair
71.4
0.0
72.8
10.2
Earrings
79.3
0.0
81.3
55.3
Smiling
82.7
0.0
85.7
1.1
Blond Hair
92.4
0.0
90.7
53.5
Gender
81.1
0.0
81.6
0.7
Necktie
93.2
0.0
92.7
51.7
Lipstick
79.2
0.0
80.3
0.6
Table 1: Comparison of nominal (Nom) and adversarial (Adv) accuracy (in percentage) on 17 down- stream tasks using VAE and SE trained with selection radius of c 0.1 and evaluated with attack radius of 0.1 and iteration budget of 100 with 10 restarts. See Section 4 for the experimental protocol.
5
RELATED WORK
The literature on deep generative models and representation learning quite extensive and rapidly expanding. There is plethora of models, but some approaches have been quite popular in recent

---

Published as a conference paper at ICLR 2020
years: Generative Adversarial Networks (GANs) and VAEs. While the connection of our approach to VAE's is evident, there is also a connection to GANs. In the appendix, we provide the details where we show that GAN decoder can be viewed an instance of a particular smooth encoder. Our method is closely related to the 3-VAR (Higgins et al. 2017). used for controlling representations replaces the original variational objective (1) with another one for explicitly trading the data fidelity with that of prior fidelity. In the appendix, we show that the method can be viewed as an instance of the smooth encoders.
Wasserstein distance minimization has been applied in generative models as an alternative objective for fitting the decoder. Following the general framework sketched Bousquet et al. (2017). the terms of the variational decomposition of the marginal likelihood can be modified in order to change the observation model or the regulariser. For example, Wasserstein AutoEncoders (WAE) Tolstikhin et al. 2017). Zhang et al. (2019) or sliced Wasserstein Autoencoders Kolouri et al. (2018) propose to replace data fidelity and/or the KL terms with a Wasserstein distance. Our approach is different from these approaches we do not propose to replace the likelihood as a fundamental principle for data fitting. In contrast, the Wasserstein distance formulation naturally emerges from the particular model choice and the corresponding variational approximation.
Our approach involves an adversarial selection step. The word 'Adversaiial' is an overloaded term in generative modelling so it is important to mention differences between our approach. Adversarial Variational Bayes is a well known technique in the literature that aims to combine the empirical success of GANs with the probabilistic formulation of VAEs, where the limiting functional form of the variational distribution can be replaced by blackbox inference (Mescheder et al. 2017). This approach also does not modify the original VAE objective, however, the motivation here different as the aim is developing a more richer family. In our view, for learning useful representations. when the decoder is unknown, the advantage of having a more powerful approximating family is not clear yet; this can even make the task of learning good representation harder. Adversarial Autoencoders (Makhzani et al.) 2015), Adversarially Learned Inference (ALI) (Dumoulin et al.) 2016) and BiGANs (Bidirectional GANs) (Donahue et al. 2016) are also techniques that combine ideas from GANs and VAEs for learning generative models. The key idea is matching an encoder process q(2 x))((()) (z) and to the decoder process p( 2))(z( using an alternative objective, rather than by minimizing the KL. divergence. In this formulation, p(z) is approximated by the empirical data distribution, and p(2) is the prior model of a VAE. The encoder (<2|2)) and decoder p(æ( are modelled using deep networks. This approach is similar to Wasserstein autoencoders that propose to replace the likelihood principle.
The idea of improving VAFS by capturing the correlation structure between data points using MRFs and graphical models has been also been recently proposed (Tang al.) 2019) under the name Correlated Variational Auto-Encoders (CVAEs). Our approach is similar, however we introduce the correlation structure not between individual data points but only between true data points and artificially selected data points. We believe that correctly selecting such a correlation structure of the individual data points can be quite hard in practice, but if such prior knowledge is available, CVAE can be indeed a much more powerful model than VAE. We note that a proposal for automatically learning such a correlation structure also recently proposed by (Louizos et al. 2019).
DISCUSSION AND CONCLUSIONS
In this paper, have introduced method for improving robustness of latent representations learned by a VAF. It must be stressed that our goal is not building the most powerful adversarially robust supervised classifier, but obtaining method for learning generic representations that can be used for several tasks; the tasks can be even unknown at the time of learning the representations. While the nominal accuracy of an unsupervised approach is expected to be inferior to supervised training method that is informed by extra label information, we observe that significant improvements in adversarial robustness can be achieved by our approach that forces smooth representations.
ACKNOWLEDGMENNTS
We are grateful to Arnaud Doucet for the insights and references about optimal transport and Araud Doucet, Johannes Welbl, Sven Gowal and Michalis Titsias for their helpful comments to earlier drafts of this paper.
10

---

Published as a conference paper at ICLR 2020
REFERENCES
Alessandro Achille and Stefano Soatto. Emergence of Invariance and Disentanglement in Deep Representations. arXiv e-prints, art. 1xXv:11006.01300, Jun 2017.
Shun-ichi Amari, Ryo Karakida, and Masafumi Oizumi. Information Geometry Connecting Wasser- stein Distance and Kullback-Lcibler Divergence via the Entropy-Relaxee Transportation Problem. arXiv e-prints, art. arXiv:1709.1000 10219, Sep 2017.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein GAN. arXiv e-prints, art.
arXiv: 1xXiv:701.0775 701.0777, Jan 2017.
Yogesh Balaji, Hamed Hassani, Rama Chellappa, and Soheil Feizi. Entropic GANs meet VAEs: A Statistical Approach to Compute Sample Likelihoods in GANs. arXiv e-prints, art. arXiv:1810.04177, Oct 2018.
Yoshua Bengio. Deep Learning of Representations: Looking Forward. arXiv e-prints, art. arXiv:1305.0445, May 2013.
Olivier Bousquet, Sylvain Gelly, Ilya Tolstikhin, Carl-Johann Simon-Gabriel, and Bernhard Schoelkopf. From optimal transport to generative modeling: the VEGAN cookbook. arXiv e- prints, art. D.XXv:1705.07622. May 2017.
Christopher P. Burgess, Irina Higgins, Arka Pal, Loic Matthey, Nick Watters, Guillaume Des- jardins, and Alexander Lerchner. Understanding disentangling in 3-VAE, arXiv e-prints, art. arXiv: MxXiv:1804.03590 Apr 2018.
Nicholas Carlini and David Wagner. Towards Evaluating the Robustness of Neural Networks. arXiv e-prints, art, arXiv: 1111..608..44444 Aug 2016.
Marco Cuturi. Sinkhorn Distances: Lightspeed Computation of Optimal Transportation Distances. arXiv e-prints, art. arXiv: 1306. 389.0 Jun 2013.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of Deep Bidirectional Transformers Language Understanding. arXiv e-prints, art. arXiv:1810.04805 Oct 2018.
Jeff Donahue, Philipp Krähenbühl, and Trevor Darrell. Adversarial Feature Learning arXiv e-prints, art. arXiv: 1655.600999 .97882,7 May 2016.
160Kv::600.000
Vincent Dumoulin, Ishmael Belghazi, Ben Poole, Olivier Mastropietro, Alex Lamb, Mar- tin Arjovsky, and Aaron Courville. Adversarially Learned Inference. arXiv e-prints, art. arXiv: 16o::00000044 Jun 2016.
J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative Adversarial Networks. arXiv e-prints, art. arXiv:1406.26611 Jun 2014.
Irina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-vae: Learning basic visual concepts with constrained variational framework. In International Conference on Learning Representations (ICLR), 2017.
Matthew D. Hoffman and Matthew J. Johnson. Elbo surgery: yet another way to carve the variational evidence lower bound. In Advances in Approximate Bayesian Inference, NIPS 2016 Workshop, 2016.
Diederik P Kingma and Max Welling. Auto-Encodding Variational Bayes. arXiv e-prints, art. arXiv:1312.610 14,, Dec 2013.
Soheil Kolouri, Phillip E. Pope. Charles E. Martin, and Gustavo K. Rohde. Bliced-Wassersteii Au- toencoder: An Embarrassingly Simple Generative Model. arXiv e-prints, art. MrXiv:1804.01947, Apr 2018.
11

---

Published as a conference paper at ICLR 2020
Jemnj Kos, Ian Fischer, and Dawn Song. Adversarial examples for generative models. arXiv prints, art. arXiv:1702.06832, Feb 2017.
Alex Krizhevsky, Ilya Sutskever, and Geoffrey Hinton. Imagenet classification with deep convo- lutional neural networks. In F. Pereira, C. J. C. Burges, L. Bottou, and K. Q Weinberger (eds.), Advances in Neural Information Processing Systems 25, pp. 1097-1105. Curran Associates, Inc., 2012.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 2016.
John D. Lafferty, Andrew McCallum, and Fernando C. N. Pereira. Conditional random fields: the Probabilistic models for segmenting and labeling sequence data. In Proceedings the Eighteenth
International Conference Machine Learning, ICML '01, pp. 282-289, San Francisco, CA, USA, 2001. Morgan Kaufmann Publishers Inc. ISBN 1-55860-778-1. URL http::/dl acm.
org/ ci taattatiioo cdf..mmmmddm55m00 655813
Francesco Locatello, Stefan Bauer, Mario Lucic, Gunnar Raetsch, Sylvain Gelly, Bernhard Schölkopf, and Olivier Bachem. Challenging common assumptions in the unsupervised learn- ing of disentangled representations. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceed- ings of Machine Learning Research, pp. 4114 4124, Long Beach, California, USA, 09-15 Jun 2019, PMLR. URL htttt:://proceedingg m mir.. pre.s/rs./eeeo vv 1197//ocateelln lol 9a. html
Christos Louizos, Xiahan Shi, Klamer Schutte, and Max Welling. The Functional Neural Process. arXiv e-prints, art. arXiv: 09604434,, Jun 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks, arXiv preprint (tt6::770600088. 2017.
Alireza Makhzani, Jonathon Shlens, Navdeep Jaitly, Ian Goodfellow, and Brendan Frey. Adversarial Autoencoders. arXiv e-prints, art. arXiv:1511 1.05644, Nov 2015.
Lars Mescheder, Sebastian Nowozin, and Andreas Geiger. Adversarial Variational Bayes: Uni- fying Variational Autoencoders and Generative Adversarial Networks. arXiv e-prints, art. arXiv:1701.04722. Jan 2017.
Jimenez Danilo Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic Backpropagation and Approximate Inference in Deep Generative Models. arXiv e-prints, art. arXiv:1401.4082, Jan 2014.
Justin Solomon. Optimal Transport on Discrete Domains. arXiv e-prints, art. MeXXv:1801.07720 Jan 2018.
Charles Sutton and Andrew McCallum. An introduction to conditional random fields. Found. Trends Mach. Learn., 4(4):267-373, April 2012. ISSN 1935-8237. doi: 10.1566//200000011. URL
http: dx. doi. www./oggg/..... 1ww1111210000000
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv: 2013.
Da Tang, Dawen Liang, Tony Jebara, and Nicholas Ruozzi. Correlated Variational Auto-Encoders. arXiv e-prints, art.
May 2019.
Ilya Tolstikhin, Olivier Bousquet, Sylvain Gelly, and Bernhard Schoelkopf. Wasserstein Auto- Encoders. arXiv e-prints, art. 1711 105158, Nov 2017.
Shunkang Zhang, Yuan Gao, Yuling Jiao, Jin Liu, Yang Wang, and Can Yang. Wasserstein- Wasserstein Auto-Encoders, arXiv e-prints, art. arXiv:1902.00333. Feb 2019.
12

---

Published as a conference paper at ICLR 2020
A APPENDIX
A.1 KL DIVERGENCE
The KL divergence between two Gaussian distributions translates well known divergence in the parameters (in the general case this is a Bregman divergence)
KL(PalIPb== = (Tr (Tr - 2n}) - log 22g 20.1 + 2 (Ha mb) 1b) 2 (No (u))
(8)
where P. (N 2.) and P. = (us.. Σb. are Gaussian densities with mean μ. and covariance matrix Σ., and 1.1 denotes the determinant for matrix argument, and Tr denotes the trace. The KL divergence consists of two terms, the first term is the scale invariant divergence between two covariance matrices also known as a Itakuro- Saito divergence and the second term a Mahalonobis distance between the means. The KL divergence is invariant the choice of parametrization the choice of the coordinate system.
B OPTIMAL TRANSPORT AND WASSERSTEIN DISTANCE
Consider a set of joint densities Q(Za; Zb) with the property that Q has fixed marginals Qa and (Z)),, i.e.,
T[Qu, Qo1 0o1= = (0:==(:0000 Qu(z))
Q(Z,, ( dZ). Qb(Z,) = = Zo)
The Wasserstein divergence WD is defined as the solution the optimization problem with respect to pairwise distribution Q
/ cZZ, Zz,, dZ)
WD[d Q.) Q.)= in! inf
(10)
QEI
where c(Ea, 26) is a function that specifies the 'cost' of transferring unit of probability mass from za to 2b-
B.1 4 WASSERSTEIN DISTANCE W
The & Wasserstein distance W for two Gaussians has interesting form. The optimum transport plan, where the minimum of (IO) is attained, is given
(za (z), =6) -N N (( Na
(
Σ
V Σb
))
(1I)
1bb
where /2
/ E. 2 ///
be checked that this optimal Guassian density is degenerate in the sense that there exists linear mapping between and 2b:
Za (z62)
+ M.
111/2 ( -//0)))11222-/// -
1b)
where 21/2 denotes the matrix square root, symmetric matrix such that (22 A for a sym- metric positive semidefinite matrix A. The fz-Wasserstein distance is the value attained by the optimum transport plan
(P Pb) = ||pa- - mall3 + Tr(E. + Ei - -2x:://2 N. 123) 1/2)
(12)
B.2 ENTROPY REGULARIZED f2- WASSERSTEIN DISTANCE
Entropy Regularized lg Wasserstein the value attained by the minimizer of the following func- tional
F[Q] "B E (Tr Z.) Zo) IQ(2,22) H[Q(Za, Z.)] 2
(13)
where is the entropy of the joint distribution Q. Using the form in 11 subject to the semidefinite
constraint Σ., v V T
Tr (za- 2b) (Za 20) -2 -2 + const
(14)
13

---

Published as a conference paper at ICLR 2020
The entropy of a Gaussian Q( 2b) is given by the Schur formula
D
(2Q =)] = log(2re) + log [> - V
(15)
2
Here, D the dimension of the vector (Ea, 2b). The entropy regularized problem has a solution where we need to minimize
1 Trlog V
F(V) = - Tr(V)
(16)
2
Taking the derivative and setting to zero
(F(
- + N (Ea -
(17)
NV
we obtain a particular Matrix Ricatti equation
0
/ u
+ Ea
(18)
7
that gives us a closed form formula for the specific entropy regularized Wasserstein distance
W2, (m Ba),N(nn ((mm: Et))
I| m + Tr + En 2
(19)
WD2, (M Ea), ((),, Ex)) Iw2, (N Ea),N(m Ex))
(20)
D
1
log(2Te)
log E1, E.
V
T
(21)
For the case of two univariate Gaussians, i.e., when the joint distribution has the form
Q(Za, %b) = =N
(aa) mm
Σa
+ Σb
the solution given by the solution the scalar quadratic equation.
JODY = 2/2 + 1p
En =
(22)
1 +
1 (1 47 1/2
(23)
27 2/>
We take the root that gives a feasible solution as the minimizer. In the scalar case, this the solution that satisfies En 2 /g > 0, or equivalently M, 2 2
v = 2
(u, (Ea; Eb) 1)
(24)
where we have defined
ury (Za, ETA (1 + 47 21 1/2
It can be easily checked that the other root is infeasible. For the scalar & case we obtain
1
((m) Ex))
(Ilma - ms 12- + Eg + Σx)
2 (My (Ea, Ex) -1)
1
2 log(u,, my (Ea, Eb) + 1) - log 1og(2ExE.)) log(2nr)
2
C SUMMARY OF THE SMOOTH ENCODER ALGORITHM WITH FACTORIZED GAUSSIAN
Assume a factorized encoder distribution of form g(Zal=,7) Ni(ti > and q( (Zoola n) IP: A (ZZh;
(Zh:pt piz Σ/) where D2 is the dimension of the latent representation, and
14

---

Published as a conference paper at ICLR 2020
ut and Σ are the k'th component of the output of neural network with parameters n, Similarly, r' denotes the i'th component the observation vector x of size Dz. For optimization, we need an unbiased estimate of the gradient of the SE-ELBO with respect to encoder parameters 7) and decoder parameters
(s
E {logg((X =z|Za, 21 9( (z) + (llgg((Z))))) (l (2..1)) + (logg(Ze)) ((Zs/ma.n)
BB (c(Za: g)), (o + H (a( Zb Ta. Tb, T])
Given v, we first select a fictive sample via selection mechanism, in this case as an adversarial attack explained in section 3.1
Sample latent representation and calculate the associated prediction
gZal.. n) = N (Nai Mar Ea)
I = g(a0i 11)
The terms of the SE-ELBO can be calculated as
Do
1
D2
(l (logp(z)Za,
log 2T
4 ).)²
2
2v
i=1
D.
D
E [(logp(Zal3a122xx-ma0
(( + +()
log 2m
2
2
k=1
D
D2 log 2n
E (loog((76)) ((2
Σ ((1)) + +E/)
(
2
k=1
WD2n
E {1 Zoll3) (
11 (9(2a, Zo 2b; 11))
9(2.. va.2s.))
where
Uny (Na Enb
V
E,,
WD2,7
7
(1kt 2 E Σ/)
2
((uy (E, Σイ} - 1) - log(us (Et, Exe + 1) + log log(2E{;
2
k=1
D2 log((T)) D
C.I EXPERIMENTAL DETAILS AND FURTHER RESULTS
We always train decoder-encoder pairs with identical architectures using both the standard VAE ELBO and the SE ELBO with fixed y. Then, in each case by fixing the encoder (that is essentially using the same representation) and by only using the mean activations of the encoders, we train linear classifiers using standard training for solving several downstream tasks.
For both encoder and decoder networks we use 4 layer multi layer perceptron (MLP) and a con- volutional network (ConyNET) architectures with 200 units of ReLU activations at each layer. We carried out experiments with latent space dimensions of 32, 64 and 128, corresponding to output sizes of an encoder with 64, 128 and 256 units, with two units per dimensions to encode the mean and the lor-variance parameters of fully factorized Gaussian condition distribution. The training done using the Adam optimizer. Each network (both the encoder and decoder) are randomly initialized and trained for 300K iterations.
15

---

Published as a conference paper at ICLR 2020
MNIST
Digit
Tasks
Color-MNIST
Color, Digit
CelebA
see table
Training
Representation Dimension, dim Z)
32, 64, 128, 256
Observation noise variance,
0.25, 0.5, 1., 2.
VAE SE
Architecture
MLP, ConvNET
Training
Coupling Strength ? Selection PGD Radius
0.01, 0.1, 1, 10, 50
0.01, 0.1, 0.2, 0.3
SE Only
Selection PGD Iteration Budget L
I, 10, 20, 50
Attack PGD Radius to downstream task
0.01, 0.1, 0.2, 0.3
Evaluation
Attack PGD Iteration Budget
100 (10 random restarts)
Table 2: Experiment Hyperparameters
Color Fonw, Disk: Şel. Iter. Budget:20)
(Arch Conv. Task Colpr,
Eps.:
100
100
mum.um n.m di. dum. di mun com.mmmmaa mum.
Adversanial Accuracy (15)
SE Selection: PGD
VAE
Adverseriaal Accuracy 196
10
Selection: Random
SE Nominal
40
60-
Allack Radius
Attack Epsilon
(a)
(b)
Figure 7: Simulation Results on ColorMNIST. (a) The goal is comparing the robustness as result of the selection procedures, uniformly random selection from the unit ball and adversarial selection. (b) The effect of the selection budget L on the adversarial accuracy. The plot shows adversarial accuracy results for 1, 10, 20.
CelebA (Arch: Cony, Task:Mugtache, Sel, Jter. Budget:20, Sel. Eps::0.)
CelebA (Arch: Conv, Task:Bplld Sel. Budget:20. Sel. Eps.
Adverserial Accurscy (8)
Adversorial Accuracy (S0
80-
Adv. acc offull data
Adv, sct offlll cata
Parcentage data for training
Percentage for training
(a) Mustache
(b) Bald
Figure 8: Simulation Results that illustrate label efficiency on CelebA. Dotted line shows down- stream task adversarial accuracy obtained by using all the labelled data. Once the representation is fixed, it is feasible to achieve the same accuracy with a small fraction of data.
D RELATED WORK
D.1 GENERATIVE ADVERSARIAL NETWORKS (GANS)
GANs presented as neural sampling models of observations of form f((: m) where is typically a deep neural network with parameters 7,, and Ç is a realization from some simple distribu- tion 2)2). In the context of GANs, the function f is called generator. When the dimension of
16

---

Published as a conference paper at ICLR 2020
is bigger than the dimension of (, the density p(z) induced by the transformation f is inevitably degenerate distribution. Since f is continuous, and it is concentrated on a subset of the data space X2 {z: 3Ç,x f()) Our use of letter f and parameters 1j is deliberate and we will illustrate in the sequel that the generator network of a GANs is actually analogous to a smooth encoder, where the roles of the latent variables and observations are switched, but we will first review GANs.
To fit a degenerate distribution to a dataset, the GAN approach adopts a strategy where the generator is co-trained with second neural network d(;;; w) with parameters w with the following objective
min max E {log d(æ; w)] (.a())) + E (log(1 d(g(S: 0): (): p(c))
(25)
0 W
where (r) is the empirical data distribution. This objective is (unfortunately) referred as an adversarial objective in the literature, not to be confused with adversarial attack mechanism in the context of supervised learning Madry et al. (2017). The function d is called a discriminator. After replacing expectations with finite sample averages, this objective enforces that a dataset that contains both synthetically generated (fake) and real examples, the classification function d should increase the correct classification rate by discriminating fakes from real examples while the generator should decrease the detection rate of fake examples. When 0 d(-) I 1, which is the case for a classifier, one can also write the objective as
min max W
E (1(2; D.) - -E (I((((G:)):
(26)
where ((:; w) log d(æ; w). This form also highlights interesting alternative formulation and an interpretation in terms of optimal transport. In fact, not long after the seminal work of Goodfellow jet al. (2014), the mechanism beyond the GAN objective and its direct connection the theory of
optimal transport has been recognized by the seminal paper (Arjossyy et al. (2017) where the problem further framed as
min max { E (1(2; )) - E (1(;; (D) }
(27)
0
with the constraint that [[x;; w) I(=; w)l S [)],,))ll, i.e. I is Lipschitz function for some L where [|((2, I| I L|x 10-- æl|. Here, Disno (z; 8) is the fitted density of i = f(C:n). This is the dual formulation of the optimal transport problem, that can be understood as an economic transaction between a customer and a shipment company. Here, the difference 1(2;; w) - [(;; w) can be interpreted as the profit made by the company for the shipment of one unit of mass from x and to E. and the Lipschitz condition ensures that it makes still sense for the customer to make use of the services of the company rather than simply doing the transport of her own (Solomon, 2018). The customer wants to pay less, so she should minimize the profit of the company. This can be achieved by changing the desired delivery distribution Drake by adjusting 0, so that the transfer from the fixed source distribution Dreat is minimized. Ideally, when Drake Dreat, there is nothing to transfer and no cost is incurred. This objective also minimizes the Wasserstein distance between the actual data distribution Dr and the fake data distribution Drake as given by the generator.
Once the GAN objective can be viewed as minimizing a particular Wasserstein distance, it is rather straightforward to view it as maximizer of a particular ELBO corresponding to particular smooth encoder, albeit in one where the positions of the observations and the latents are exchanged and a very large coupling coefficient y is chosen. Moreover, the variational marginals have specific forms: One marginal (X) is chosen as the empirical data distribution and the other marginal is chosen as having the form of neural sampler (x())) = q(X, Zo, 1))(()))))))) (Z))dd.
The artificial extended target becomes
p(Z, ()),8) x / (XXx0(2
(28)
It can be seen that the ELBO in this case becomes
log (Z, Z' (,0) 2
E [[logg(Z|Xx00) (x)) + +E (logp(X) +E (logr(( N,, 0) (xx)x))) + E (logp( (logp(()))
E fc(Xa, (o)Xa.X)) Xo)l((x)))) + H(Q(X,, Xi))
(29)
2
17

---

Published as a conference paper at ICLR 2020
Now, by taking the coupling ? sufficiently large, the coupling term dominates the lower bound and we obtain the Wasserstein minimization objective. The random draws from p(Z) become the selection mechanism. Moreover, the terms that depend the artificial target p pZZ 0) become also irrelevant so in this regime the problem becomes just solving the optimal transport problem between Qa and Qb-
link between entropic GANs and VAEs is also pointed at in the literature, albeit for calculating a likelihood for GANs Balaji et al. (2018). However, our motivations well the interpretation of the connection is quite different and we view the GAN decoder as an instance of the smooth encoder.
D.2 DISENTANGLED REPRESENTATIONS AND 3- 3-VAE
Targeting the encoder an augmented distribution different than the decoder us the freedom to express some extensions of VAE in the same framework. One of such extensions is the (3-AE, quite often used for controlling representations replaces original variational objective (1) with the following objective
logp(X X = x0 2 (logp(X x (2 q(2))) x))=)(()=) - (Dxx, = x, 7)) lp (3))
The justification in the original paper Higgins et (2017) is obtained from implicit robustness n) [2) < and 3 appears in a Lagrangian formulation. Hoff
criteria where DKL (g( X
man & Johnson 2016) have also provided an alternative justification.
In our formulation, 8 can be simply interpreted as dispersion term that is related to the number of points selected by the selection mechanism. To see this, suppose the selection mechanism chooses
3 11 points Fb, where i =1... 1...3
that are identical to the true observation x Ib x for
1...5
/ 1dX
p(X10)
(31)
/ 22
8-1 1(:1
(32)
B-1
/ 42002,
I
(33)
Now, instead of integrating out Zí, we choose a variational distribution with identical marginals of form
B-1
- = =x, x,
II
X = x,
(34)
1=1
The variational lower bound becomes identical to the 8 VAE objective as
logp(X(10 > E ((1osp((X12,0)))azxxx.. + E ( (logp( ((0
(35)
8-1
E flog b + (Q( Z 1)))
(36)
(log((X z()) - ((|)._=2.) - 3D. (g X = =x, xz,))l((2)) (37)
where the last step follows due to the functional form of the variational distribution.
E TECHNICAL RESULTS
E. BATCH ELBO
In section
2.2 we have defined a batch ELBO (2) To see the connection to VAE ELBO (1)
log (XX x 0)
2
E. (logp(X z17, )), 9( x=am) DKIl((Z]XX x. ())))((()) (n.
18

---

Published as a conference paper at ICLR 2020
first define the empirical data distribution π rx() 1/2 E 5(X - 24). We can now write
log p( = =x(0) 2
E
plogp(X = x|Z, 212,0) - DKL(a(ZIX = z, n))ll((()) = (n. 0)
N
N
1
log x = 2; =
E (logp(X = =x;1=x,10000 )
N
N
Bilog -0:
E (log p Z))
( ((
E (log pl X Z, 0) g(2(Xx))((x)) E flog a( (( ()) (1
+ (log pl 9(Z
-E (log x (X)) ((2(X))))X) + E (log (x)
= - (
+ const
This result shows that the ELBO is minimizing the KL distance between one exact and one approx- imate factorization of the joint distribution p(X, Z) = p ())(Z) z ())
E.2 WHY IS THE DECODER TYPICALLY SMOOTH AFTER THE VAE TRAINING?
In the context of a VAE, the smoothness of the decoder is implicitly enforced by the highly con- strained encoder distribution and the dynamics of SGD based training. In the sequel, we will illustrate that, if two latent coordinates are sufficiently close, the decoder mean mapping is forced to be bounded.
In a standard VAE, the encoder output for each data point is conditionally Gaussian as (Z = 3r; n) = (N, (z; n)), fx((;; r)). The decoder is chosen p( X % 2;1)) (g 0), v/). The decoder parameters 0 under the ELBO depend only on the data fidelity term | [(; 0)1
For moment, assume that the encoder is fixed and focus on a single data point æ. During training, set of latent state vectors z; for i = .. are sampled from the conditionally Gaussian encoder distribution. When the dimension of the latent space D2 is large, these samples 2; will be with high probability on the typical set. The typical set of nondegenerate Gaussian distribution is approxi- mately the surface of a Mahalanobis ball, a compact hyper-ellipsoid (æ) centered at f 7) with scaling matrix fx 2/2
If we assume that the training procedure is able reduce the error in the sense that ||| ((; z;; 0)| < E for all 2, where is a bound on the error magnitude for z sampled from the encoder, the decoder forced give the same output for each point approximately on M (x). For point 2, drawn from xl = 1)) we have
1| - fa(=;n)llx = VDz with high probability
where K = fs)(2; and ||~|| = Vx Kr.
For point 2; independently drawn from g(Z X = xz 1). by the triangle inequality we have
[1g(2a: 0) g(26: 8) = 2E
(38)
where the Mahalanobis distance
2 2/D. 1 = S
11 - 20ll
Vmmin
where Amin is the smallest eigenvalue of the covariance matrix. Hence the distance is also bounded when the variance is not degenerate and minimum distance will be on the order of I| - 261l s 2 DzAmin so we expect the ratio to be bounded
[1o(=.;
g(=0: 0)11/||a -2ull S F./ D2Amin
(39)
19

---

Published as a conference paper at ICLR 2020
We that the ELBO objective enforces the decoder to be invariant on the typical set of q 2; 17), where most of the probability mass concentrated.
Now, for each data point z, the corresponding latent space hyper-ellipsoid Mx) are forced to be large in the sense having large determinant by the entropy term of the encoder that promotes large log-determinant. The size of (x) is also controlled by the prior fidelity term, avoiding blowing up. Hence the union (ar), where X' is the dataset, will approximately cover the latent space when the encoder has converged and on each hyper-ellipsoid M (x) the decoder will be enforced to be smooth.
E.3 SMOOTHNESS OF THE SMOOTH ENCODER
this section we show that the smooth encoder training forces a small Lipschitz constant for the encoder mean mapping. To simplify the argument, we will assume that the variance mapping of the encoder would a constant function that does not vary with æ, i.e. fz(=; Σ(n). The latter assumption could be removed by considering metric the joint space of the means and covariance.
Using the adversarial selection mechanism, during training solve the following problem using PGD:
arg
WD(g(Z)X n). g =
Assuming that PGD finds the global maximum at the boundary of the e-ball where || x c, under constant variance assumption for the encoder can see that the Wasserstein divergence simply becomes the square distance between mean mappings
WD(g(ZIX x, 1)) (Z)
m)) (=) (x*;))))
We know that the SE ELBO objective has to minimize this distance for any coupling term y the procedure actually tries to reduce the local Lipschitz constant L(x) around data point x
Ilf 1) fa(x"; mlll
L(x)
| 1---0 x 11p
and promotes smoothness where E is an upper bound on the change in the representation (1; fa(*";n)ll E.
20


Reviews:
[{"review_id": "rJe5MJ5_9B", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This is a very interesting paper, I believe, a solid contribution to Variational Autoencoders. The basic argument is that encoders in VAEs are highly susceptible to noise in input data, whereas decoders are not. This argument is supported with a full fledged section 2.2, reformulating ELBO objective of VAEs, and introducing a VAE with discrete latent variables and discrete observations, so as to easily understand why and where VAEs fail.\n\nTo make encoders robust to noise in inputs, it is proposed to generate new fictive data points in the neighborhood of original data points so as to ensure that the latent representations of a data point and its fictive version are similar in \"some sense\" as part of the proposed regularization term. The implementation of this idea is solid in the paper, relating it to theoretical concepts such as  \"entropy regularized entropy transport problem\", \"Wasserstein distance\", etc. The most important point is that, it is easy to extend an encoder of an existing VAE with the proposed algorithm, while letting a decoder be untouched as the latter is shown to be robust/smooth anyways (in sec 2.2). It is also discussed on how to generate fictive samples, including but not restricted to approaches like projected gradient descent based adversarial attacks.\n\nSection 2.2 can be improved further, in terms of presentation. This is the most important section which can be of interest to the community to understand VAEs' limitations, a good contribution on its own. Though challenging, I encourage the authors to improve the exposition in this section as much as possible.\n\nIntroduction is written beautifully. Good job, done!\n\nFor instance, some explanation about variables, m_j, u_i, their distribution.\n\nHow do you relate the Eq. 1 with the standard ELBO. (some reference to derivation?)\n\nIs it not possible to explain limitations of present VAEs without introducing the particular von Mise like parameterization (last equation of page 3). I am not suggesting that you should remove it. The connections between the two could be more explicit, though I understand that it is already mentioned in the paper, \"parameterization emulates a high capacity network that can model any functional relationship between latent states and observations...\". \n\nIn this context, I found the explanation after Eq. 2 to be intuitive in regards to inefficiency of encoders. If I understand correctly, to put it in even simpler terms, the encoding neural network is overfitting mapping from input data points to the latent representations, not performing any learning for the unseen data points at all; on the other hand, decoder explores the space of latent variables well because it is modeled as a Gaussian?\n\nSome of the new equations should be numbered for easy reference. \n\nOn page 4, the flow is a bit abrupt. Right after Fig. 3, there are points 1 and 2 added without any note on what these two points (items in latex) are about.\n\nI found point 1 very confusing in page 4. On the other hand, point 2 is beautifully written. Though, it could be made explicit in the latter on why encoders found in VAE are not smooth, referring to Fig 2, 3.\n\nThere are minor grammar mistakes making some of sentences incoherent or confusing, in the paper. Something to do with style of language. I think, overall, language can be improved. Though, technical flow of the paper is great, and introduction is written very well, pointing out very important bold insights about the literature on unsupervised representation learning. I would say, it is a very well written paper, which is an enjoyable read, despite some of the grammar mistakes which can be easily fixed by proof reading.\n\nExperimental evaluation is sufficient. \n\nLast but not the least, one could argue that we are going to the literature of kernel function based methods, or markov random fields, to improve the neural network models. This is a general trend we are observing. It is interesting to see new models such as the proposed one, getting the best from both worlds. It may be worthwhile to point  out something along these lines in the paper so that other works like this can be accomplished which are bold, and advance representation learning, digging mathematical concepts from diverse domains. If I am mistaken, please feel free to point out. It is not going to be change the review. I am inspired from this work.\n \nOne practical challenge is to generate fictive data points which are not very near to existing data points. I am not sure if GANs can achieve that, either. Having such points is critical to deal with more structured noise. Any comments on this? ", "extra_scores": {"experience_assessment": "I have published in this field for several years.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}, {"review_id": "Sygb7qk0tr", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies the vulnerability of representations learned by variational auto-encoders (VAE). It first show that the learned representation of VAE is susceptible to small changes, similar to the adversarial examples in supervised learning setting. Then propose a regularization method, called smooth encoder, to improve the robustness of the representation. Experiments are conducted on several benchmark datasets to show the effectiveness of the method. \n\nOverall I find the idea interesting and the experimental results promising. The following are my detailed comments.\n\na About the theory\nThe illustration of the problem in VAE is interesting. However, one missing point is to theoretically quantify the effect of the proposed regularization (in some simple cases). In particular, it is claimed that the regularization could make the encoder smoother and the experimental results clearly justifies it. What would be better is to show in which sense/measure the encoder is smoother and provide some theoretical guarantee about it. (for instance smaller Lipschitz constant?)\n\nb About the Experiment\nThe experimental section is clear and promising. I just have one question about the evaluation on the robustness of the VAE representation. In particular, a linear classifier is concatenated right after the VAE representation and it is not clear to me where it is concatenated. Is it right after the layer of \\mu and \\Sigma or in later layers? If it is in the later layers, the VAE is outputting a distribution, then how does the accuracy measured?\n\nMinor comment:\nI think it is unnecessary to introduce the new term selection strategy because it is just an adversarial training with respect to a different loss. In particular, the loss is the Wasserstein distance between the latent space vectors instead of a supervised loss. For simplicity, it could be just named as latent space adversarial training. (this is just a suggestion, which will not change my decision)", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "HJg8AR0-9H", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper analyzes the shortcoming of VAE objective, and propose a regularization method based on a selection mechanism that creates a fictive data point by explicitly perturbing an observed true data point. It is lead to Wasserstein distance between representations. Experiments are made on three datasets; ColorMNIST, MNIST, and CelebA, which shows superior performance on adversarial accuracy while similar accuracy to VAE on nominal accuracy.\nThe paper is well-organized and well-written. The point is clear and the proposed algorithm is valid. The only problem of the paper is the improvement on the experiment is marginal. Although adversarial accuracy is far better (like 0% vs 50%), it is apparent that the vanilla VAE is fragile to the adversarial examples because the added noise is intended so. Thus I can not say this is a fair comparison and because the superiority of the proposed algorithm is shown in only this point, I am not sure the proposed algorithm is surely useful. \n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes an novel way of expanding our VAE toolkit by tying it to adversarial robustness. It should be thus of interest to the respective communities.
Decision: Accept (Poster)