Alleviating Adversarial Attacks on Variational Autoencoders with MCMC
Authors: Anna Kuzina
Max Welling
Jakub Mikolaj Tomczak
Venue: NeurIPS 2022 Accept (2022)
Keywords: VAE
MCMC
Adversarial Attack

Abstract: Variational autoencoders (VAEs) are latent variable models that can generate complex objects and provide meaningful latent representations. Moreover, they could be further used in downstream tasks such as classification. As previous work has shown, one can easily fool VAEs to produce unexpected latent representations and reconstructions for a visually slightly modified input. Here, we examine several objective functions for adversarial attacks construction proposed previously and present a solution to alleviate the effect of these attacks. Our method utilizes the Markov Chain Monte Carlo (MCMC) technique in the inference step that we motivate with a theoretical analysis. Thus, we do not incorporate any extra costs during training and the performance on non-attacked inputs is not decreased. We validate our approach on a variety of datasets (MNIST, Fashion MNIST, Color MNIST, CelebA) and VAE configurations ($\beta$-VAE, NVAE, $\beta$-TCVAE), and show that our approach consistently improves the model robustness to adversarial attacks.

Alleviating Adversarial Attacks on Variational Autoencoders with MCMC
Anna Kuzina Vrije Universiteit Amsterdam a kuzina@vu.
Max Welling
Jakub M. Tomezak
Universiteit van Amsterdam m wwwlingnuva.....
Vrije Universiteit Amsterdam j m. tomczakêvu. nn1
Abstract
Variational autoencoders (VAEs) are latent variable models that can generate com- plex objects and provide meaningful latent representations. Moreover, they could be further used downstream tasks such as classification. As previous work has shown, easily fool VAËs to produce unexpected latent representations and reconstructions for visually slightly modified input. Here, we examine several objective functions for adversarial attack construction proposed previously and present a solution to alleviate the effect of these attacks. Our method utilizes the Markov Chain Monte Carlo (MCMC) technique in the inference step that we moti- vate with a theoretical analysis. Thus, we do not incorporate any extra costs during training, and the performance on non-attacked inputs is not decreased. We validate our approach on variety of datasets (MNIST, Fashion MNIST, Color MNIST, CelebA) and VAE configurations (A-, NVAE, 3-TCVAE), and show that our approach consistently improves the model robustness to adversarial attacks.
Introduction
are latent variable models parameterized by deep neural networks and trained with variational inference. Recently, it has been shown that VAEs with hicrarchical structures of latent variables [33], coupled with coipeconnettions [30 37,, can generate high-quality images [15 39]. An interesting trait of VAEs is that they allow learning meaningful latent space that could be further used in downstream tasks [2). These successes VAEs motivate explore the robustness of the resulting latent representations to better understand the capabilities and potential vulnerabilities of VAEs. Here, we focus on adversarial attacks on VAEs to verify robustness of latent representations that is especially important in such applications anomaly
Variational Autoencoders (VAEs)
27 34
detection 30 or data compression 5 20
The main questions about adversarial attacks for VAEs are mainly focused on how they could be formulated and alleviated. In [18], proposed to minimize the KL--divrgeecce between an adversarial input and target input to learn adversarial attack for the vanilla VAE. Further, in (28). it is shown that a similar strategy can be used to attack hicrarchical VAEs. To counteract the adversarial attacks, the authors of [42] suggest using modified VAE objective, namely, 3-TCVAE, that increases VAE robustness, especially when coupled with a hierarchical structure. was shown in [10] that V-VAE tend to be more robust to adversarial attacks in terms of the r-metric proposed therein. The authors [6] presented that the adversarial robustness can be achieved by constraining the Lipschitz constant of the encoder and the decoder. [3] introduced modifications the VAE framework that allow for better robustness against the adversarial attacks on downstream classification tasks. In work, we consider 8-VAE, 3-TCVAE and hierarchical VAE, and outline defence strategy that improves robustness to attacks on the encoder and the downstream classification task. The proposed method is applied during inference and, therefore, can be combined with other known techniques to get more robust latent representations.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

An adversarial attack VAE is usually for- mulated as an additive perturbation of the real data point x" so that the resulting point is perceived by a model as if it a totally differ- ent image (either during reconstruction or in the downstream classification task) [18]. In Figure [ we depict an example of attack on the encoder. The reference point x' and the adversarial point x" almost indistin- guishable, but they are encoded into different regions in the latent space. As result, their reconstructions also differ significantly.
6
G
Decode
G
Encode
MCCMC
x
X Juee
6
In this paper, we propose the method moti- vated by the following hypothesis: An adver- sarial attack maps the input to a latent region with a lower probability mass assigned by the true posterior (proportional to the con- ditional likelihood times the marginal over latents) and, eventually, we obtain incorrect reconstructions. Therefore, a potential man- ner to alleviate the effect of an attack may rely on running a Markov chain to move the probable
Encode
MCMC defence
2
X
Decode
Figure 1: An example of an unsupervised encoder attack VAE with 2D latent space and the proposed defence. Given a single reference point x" we learn additive perturbation E, s.t. perturbed input x has the most different latent code and, therefore, the re- construction x observe that a single reference point be mapped to extremely different regions of the latent space but using MCMC we are able to move them closer to the initial position that the reconstruction XIMM is similar to the initial one X".
latent representation back to latent region. Such defence is reasonable because we do not modify the training proce- dure or the model itself, we only insert a cor- rection procedure. As result, counteract adversarial attacks by enhancing the variational inference with Markov Chain Monte Carlo (MCMC) sampling. The illustrative example depieted in the Figure shows that the latent code of the adversarial input (red circle) moves closer the latent code of the reference point (orange circle) after applying the MCMC (purple circle).
propose to
The contribution of this work is the following:
We propose to use an MCMC technique during inference to correct adversarial attacks on VAEs.
We show theoretically that the application of an MCMC technique could indeed help to counteract adversarial attacks (Theorem I
We indicate empirically that the previously proposed strategies to counteract adversarial attacks do not generalize well across various datasets.
We show empirically that the proposed approach (i.c., VAE with MCMC during inference) outperforms all baselines by a significant margin.
2 Background
2.1 Variational Autoencoders
Let us consider a vector of observable random variables, x E X (e.g., X R) sampled from the empirical distribution Pe (x). and vectors of latent variables Z R Ma. 1, 2. K, where Mg is the dimensionality of each latent vector. First, we focus
model with K 1 and the joint distribution (x( 2) p (o(x2/))(22 The marginal likelihood then equal to (x
po(x, 2)d2.
VAFs exploit variational inference (25) with a family of variational posteriors {qa (2[x)) ). also referred as encoders, that results in tractable objective function, i.e., the Evidence Lower BOund (ELBO): L( 0) (x) (()x))))))) In px(x22) DKL. (z<()))]|ppz)]
modified objective by weighting the DxL. term by 8 0. In the case of K 1, we consider a hierarchical latent structure with the generative model of the following form: pa(x Z ....... Zk) po px .alzz,....,.. ..,, ,ZKK | pe (zu (Z+)). There are various possible formulations
3-VAE 2

---

Table Different types of attacks on the VAE. We denote (0(2) the deterministic mapping induced by decoder (=(2)2) and as Pw(yl2) classification model in the latent space (downstream task). Only used during VAE training
REFERENCE
f(x)
A [A, B]
|| l|p
TYPE
Latent Space Attack
6 18
42
(x(-))))
DRa, [A]]8]]
2
Supervised
Unsupervised
28
90((-12))
SKL [A]]
Unsupervised
Encoder Attack
Targeted Output Attack
18
(o(2), 8 (0(+
B1
Supervised
Maximum Damage Attack
110
(o(3), 8 go(tlr)
|| Bl
Unsupervised
Projected Gradient
13
W/D [A, B]
inf
Unsupervised
Descent Attack" Adversarial Accuracy
Po(ul)). qo((1)) CROSS ENTROPY
inf
Unsupervised
of the family of variational posteriors. However, here we follow the proposition of 37 with the autoregressive inference model, namely, 4s (Zi....... Z x) qa (x<x(x) K-
qa (za 2 x). This formulation was used, among others, in NVAE [39]. Because of the top-down structure, allows sharing data-dependent information between the inference model and the generative model.
2.2 Adversarial attacks
An adversarial attack is slightly deformed data point that results in undesired or unpredictable performance model [19]. In this work, we focus on the attacks that are constructed as an additive perturbation of the real data point x" (which we will refer to as reference), namely:
x" =x" where ||=||p - 6,
(1)
(2)
where 5 is the radius of the attack. The additive perturbation & chosen in such a way that the attacked point does not differ from the reference point too much in sense of a given similarity measure. It is a solution to an optimizatinn problem solved by the attacker. The optimization problem could be formulated in various manners by optimizing different objectives and by having specific constraints and/or assumptions.
Attack construction Let f()) ) be part of the model available to the attacker. In the case of VAEs, this, for example, may be encoder network latent space. The attacker uses similarity measure A to learn an additive perturbation to a reference point. We consider two settings: unsupervised and supervised. In the former case, the perturbation supposed to incur the largest possible change in f:
encoder with the downstream classifier in the
arg max A [f(x" fx), |eell,
The latter setting requires a target point x The perturbation attempts to match the output for the target and the attacked points, namely:
arg min A o)) fx), 15
There are different ways to select f and in the literature. Furthermore, different Ly-norms can be used to restrict the radius of the attack. Table I summarizes recent work the topic.
In this work, we focus on attacking the encoder and the downstream classification task using unsupervised adversarial attacks. In the former, we maximize the symmetric KL-divergence to get the point with the most unexpected latent code and, therefore, code is passed to classifier. The attack is trained to change the class of the point by maximizing the cross-entropy loss. However, the method we propose in Section 3 is not limited these setups since it is agnostic to how the attack was trained.
reconstruction.
the latter, latent
3

---

Robustness measures To measure the robustness of the VAE as well as the success of the proposed defence strategy, we focus on two metrics: MSSSIM and Adversarial accuracy.
For latent space attacks we follow [28] in using Multi-Scale Structural Similarity Index Measure (MSSSTM) [4T]. We calculate MSSSTM [[T, xx" i.e., the similarity between reconstructions of x" and the corresponding x". We do not report the similarity between a reference and the corresponding adversarial input, since this value is the same for all the considered models (for a given attack radius). A successful adversarial attack would have a small value of MSSSIM [X", _
For the attacks the downstream classifier, follow 12 13 and caleulate the adversarial accuracy. For a given trained VAE model, we first train a linear classifier using latent codes as features. Afterwards, the attack is trained to fool the classifier. Adversarial accuracy is the proportion of points for which the attack was unsuccessful. Namely, when the predicted class of the reference and corresponding adversarial point are the same.
3 Preventing adversarial attacks with MCMC
Assumptions and the hypothesis We consider scenario in which an attacker has access the VAE encoder and, where relevant, to the downstream classification model. Above, we presented in detail how an attack could be performed. We assume that the defender cannot modify these components, but it is possible to add elements that the attacker has no access to.
We hypothesize that the adversarial attacks result in incorrect reconstructions because the latent representation of the adversarial input lands in a region with a lower probability mass assigned by the true posterior. This motivates to method which brings the latents "back" to highly probable region as potential defence strategy. Since the adversarial attack destroys the input irreversibly, at the first sight it seems impossible reconstruct the latent representation of the reference point. We aim at showing that this is possible to some degree theoretically and empirically (Appendix C.T
The proposed solution In order to steer the latents towards high probability regions, we propose to utilize an MCMC method during inference time. Since we are not allowed to modify the VAE or its learning procedure, this is reasonable procedure from the defender's 's perspective. Another positive outcome of such an approach is that in a case of no attack, the latents given by the MCMC sampling will be closer to the mean of the posterior, thus, the reconstruction should be sharper or, at least, not worse. Note that the variational posterior approximates the true posterior from which the MCMC procedure samples. We propose to sample from y (1) (z|x) = f (2(20) (zo x x)d2o. where Q (z|2)) is a transition kernel of MCMC with steps and the target distribution TT2) = po(z|x) & pe (x p(z). Alternatively, we can optimization to find the mode of the posterior, however, MCMC can add extra benefits such as exploration of the typical set and randomness (see Appendix B.3 for details).
[20
To further analyze the proposed approach, we start with showing the following lemma:
Lemma Consider true posterior distributions of the latent code z for a data point x and its corrupted version x Assume also that In po(xx)) twice differentiable over with continuous
derivatives at the neighbourhood around x = x". Then the KL-divergence between these two posteriors could be expressed using the small notation of the radius of the attack, namely:
DKL xxlx")) (llox)")llpx(xxx)) = =[]]=[]).
(5)
Proof See Appendix
According to Lemma the difference (in the sense of the Kullback-Leible divergence) between the true posteriors for data point x and its corrupted version x" decreases faster than the norm of the attack radius. However, it is important to note that this result is only valid for asymptotically small attack radius.
Next, the crucial step to show is whether we can quantify somehow the difference between the distribution over latents for x" after running MCMC with steps, (2)x") and the variational distribution for x". (=(z)x"). We provide an important upper-bound for the Total Variation distance (TV between ( (z) x*) and go (z)x") in the following lemma:
'The Total Variation fulfills the triangle inequality and it is proper distance measure.

---

Lemma's The Total Variation distance (TV) between the variational posterior with MCMC for a given corrupted point x", (z)x",, and the variational posterior for a given data point x', [a(2|x"), can be upper bounded by the sum of the following three components:
TV (z)x))
S TV
( (z)x"), po(2)))))
+ V 2 DKL (xl
+ V DKL. (
(6)
Proof See Appendix[A]
The difference expressed by TV (z|x") (z)xx")] is thus upper-bounded by the following three components:
The TV between qd (z x") and the real posterior for the corrupted image, p=(z) Theo- (z (z)x"), (z(x)) 0. The second component is the square root of the KL-divergence between the real posteriors for the image and its corrupted counterpart. Lemma [ gives us information about this quantity.
retically, if oc, (00) (z|x") po(z|x") and, hence, TV (x(x))
The last element, the square root of DKL (z(xx) I[pa (z) x²) ). quantifies the approximation gap [16], i.e., the difference between the best variational posterior from chosen family, and the true posterior. This quantity has no direct connection with adversarial attacks. However, we can see, using rich family of variational posteriors can help us to obtain tighter upper-bound. other words, taking flexible variational posteriors allows counteract attacks. This finding is in line with the papers that propose to use hierarchical VAFs as the means for preventing adversarial attacks [42].
Eventually, by applying Lemma to Lemma
2 we obtain the following result:
The upper bound the total variation distance between samples from MCMC for a given corrupted point x", (z)x"), and the variational posterior for the given real point x", (o(2lx"), is the following:
Theorem
TV go(2x)) SV (x|x"))
v 1 DKL
+ o(V/lel]).
Proof See Appendix
As discussed already, the first component gets smaller with more steps of the MCMC. The second component could be treated as a bias of the family of variational posteriors. Finally, there is the last element that corresponds than the square root of the attack radius for the asymptotically small attack radius.
constant error that is unavoidable. However, this term decays faster
Specific implementation of the proposed approach In this paper, method, namely, the Hamiltonian Monte Carlo (HMC) [8, I7I. Once the VAE is trained, the attacker calculates adversarial point x" using the encoder of the VAE, After the attack, the latent representation of x" is calculated, z", and used as the initialization the HMC.
specific MCMC
In the HMC, the target (unnormalized) distribution is p(x*|2)p(z) The Hamiltonian is then the energy of the joint distribution of z and the auxilary variable p, that
(z. p) (zz) Kp),
(8)
Uzz) = In (x" iz) - In In)(2), K(p) = - -
(9)
(10)
When applying the proposed defence to hicrarchical models, we update all the latent variables simul- taneously. That is, we have z {Zi,..., 2 and U(z) In (x (2) >>
Lk=1 In po lz++)).
5

---

Eventually, the resulting latents from the HMC are decoded. The steps of the whole process are presented below:
Algorithm One Step of HMC.
Input: 2,1) 1
p ~ 1),
D Sample the auxiliary variable
1. (Defender) Train a VAE: (z(2)), p(z).
( = 2, z.p
== P.
po (x|2).
for / i.... .d
D Make L steps of leapfrog.
pd) =p =p'--) VZU(Z
(Attacker) For given x", calculate the at- tack x" using the criterion equation or equa-
z 2 + VDpK(
tion 4
pd - (0) (z
end for
(Defender) Initialize the latent code z where Zp ~ [z|x"). Then, run T steps of HMC (Algorithm [] with the step size Y) and L leapfrog steps.
> Accept new point with prob. a. (- H(( ( + H(z (())))
a min (1, exp
z with probability a,
(0) otherwise.
The resulting latent code z can be passed to the decoder get reconstruction the downstream classification task.
Return:
4 Experiments
4.1 Posterior ratio
We motivate our method by the hypoth- esis that the adversaria attack "shifts" latent code to the region lower poste- rior density, while approach moves it back to a high posterior probability region. In Section 3 we theoretically justify hypothesis, while here we provide an ad- ditional empirical evidence. The true pos- terior p(z[x") is not available due to the cumbersome marginal distribution p(x"), however, we can calculate the ratio of pos- teriors because the marginal will cancel out. In our case, we are interested in calculat- ing the posterior ratio between the refer- ence and adversarial latent codes (z₃ = z", Z2 z² as the baseline, and the posterior ratio between the reference and adversarial
60
logPR(>",2") logPR(>", (2110)))
40
20
0
100
200
Figure 2: Histograms of the log posterior ratios before
HMC (blue) and after HMC (orange) evaluated on the MNIST dataset.
code after applying the HMC (z) = Z2 = MM The lower the posterior ratio, the better. For practical reasons, we use the logarithm of the posterior ratio since the logarithm does not change the monotonicity and turns products to sums:
log PR(Z1: 22) = log Pe (x" (x + p(z)) po (x" (22) - log p(z2)-
(11)
In Figure 2 we show plot with two histograms: one with the posterior ratio between the reference and adversarial latent codes (z) = z", Z2 = z²) in blue, and the second histogram of the posterior ratio between the reference and adversarial code after applying the HMC (z, orange. We observe that the histogram has moved to the left after applying the HMC. This indicates that posterior the adversarial (in the denominator) increasing when the HMC is used. This is precisely the effect we hoped for and this result provides an empirical evidence in favor of our hypothesis. For more details see C.I
Z2 = zHMe) in
4.2 VAE, 3- VAE and 3-TCVAE
All implementation details and hyperparameters are included in the Appendix D and code repository
httpss//ggthabbooo///kaaaaaaaaaa

---

Datasets VAEs are trained on the MNIST, Fashion MNIST 44 and Color MNIST datasets. Following [3), we construct the Color MNIST dataset from MNIST by artificially coloring each image with seven colors (all corners of RGB cube except for black).
Models We train vanilla fully convolu- tional VAEs, as well as E-VAE [2] and
9
6
9
5
9
3-TCVAE [4] 261. Both 8-VAE and 3-
TCVAE modify the ELBO objective to en- courage disentanglement. 3-VAE weighs the KL-termm in the ELBO with > O. It is said that the larger values of / encour- age disentangling of latent representations [14] and improve the model robustness observed by 10]. B-TCVAE puts a higher
2
2
2
3
2
weight on the total correlation (TC) term of the ELBO. Penalization of the total correla-
tion was shown to increase the robustness of VAE adversarial attacks [42].
1
8
In Appendix D.I we provide details of the architecture, optimization, and results on the test dataset for VAE trained with dif- ferent values of B. We note that the op- timal value in terms of the negative log- likelihood (NLL) is always 3 = 1. Larger values of 3 are supposed to improve ro- bustness in exchange for the reconstruction quality. When evaluating the robustness of 3-VAE and 3-TCVAR, we train mod- els with 3 {2,5, 5, 10). Then, select the value of B that provides the most robust model in terms of the used metric. Next, we apply our defence strategy to this model to observe the potential performance improve- ment.
(a) x"
(b) x"
(c) x
(d) X
XMMC
Figure 3: Examples of (a) reference points, (b) recon- structions of the reference points, (c) adversarial points, (d) reconstructions of the adversarial points, (e) recon- structions of the ad adversarial points after the proposed defence (HMC). All the adversarial examples are unsu- pervised attacks on the encoder. Last two rows contain examples for the NVAE model discussed in Section 4.3
Table 2: Results for unsupervised attack with radius 0.1 and 0.2 on MNIST and Fashion MNIST datasets. We attack the encoder (left) and the downstream classification task (right). i Our implementation.
MS X t
ADVERSARIAL ACCURACY
1 0.2
MSE 4
Nell
0.1
0.2
0.0
0.1
MNIST
VAE
0.70 (0.02)
0.36 (0.03)
0.90 (0:04)
0.08 (0:04)
0.05 (0.03)
578.7
VAE+ HMC
0.88 (0.01)
0.76 (0.02)
0.76 (0.01)
0.25 (0.03)
0.19 (0.03)
478.1
8- VAE
0.75 (0.01)
0.50 (0.03)
0.90 (0.05)
0.11 (0.04)
0.01 (0.01)
824.2
8-TCVAE
0.70 (0.02)
0.46 (0.03)
0.86 (0.05)
0.05 (0.03)
0.03 (0.02)
828.4 .4
FASHION
MNIST
VAE
0.59 (0.03)
0.47 (0.03)
0.78 (0.06)
0.00 (0.01)
0.01 (0.01)
814.2
VAE+ HMC
0.66 (0:03)
0.54 (0.03)
0.56 (0:01)
0.14 (0:02)
0.13 (0.02)
764.2
V-VAE
0.52 (0:03)
0.41 (0.03)
0.80 (0.05)
0.00 (0.01)
0.00 (0.01)
1021.1
B-TCVAR
0.52 (0.03)
0.42 (0.03)
0.84 (0.05)
0.00 (0:01)
0.02 (0.02)
980.4
Attacks on the Encoder In the first setup, we assume that the attacker has access to the encoder of
the model (2(2) 66 42). We use the projected gradient descent (PGD) with 50 steps to maximize the symmetric KL-divergence in the unsupervised setting (equation 3p. We train 10 adversarial attacks (with different random initialization) for each of 50 reference points. See Appendix D.2 for the details. We report similarity between the reconstruction of the adversarial and reference point as a measure of the robustness (see Section 2.2
7

---

Table 3: Results for unsupervised attack with radius 0.1 and 0.2 ColorMNIST dataset. We attack the encoder (left) and the downstream classification task (right).
f Our implementation.
Values reported in [12] VAE implementation and evaluation protocol may differ.
MSSSIM
x
ADVERSARIAL ACCURACY
DIGIT
COLOR
MSEL
FID
|ell
0.1
0.2
0.0
0.1
0.2
0.0
0.1
0.2
VAE
0.36 (0.35)
0.19 mm))
1.00
0.04 (9.08)
0.02 m00)
1.00
0.06 (0:3)
0.06 0000
261
2.1
VAR+ HMC
0.96 caa
mam)
0.42 mo)
0.16 (0.00)
mmy
1.00 (000)
0.68 (0.
(000
3-VAB
0.75 .a.00
0.5
0.88
0.08 (0.04)
0.05 0.03)
1.00 (0.00)
0.21 (0:06)
0.18 00.5
366
2.4
8-ICVAET
0.35 (0.30)
0.23
0.94
0.08
0.05
1.00
0,06 (0,0))
0.05
366
3.0
SEn.1"
NIA
N/A
0.94 (NGA)
0.89 (MA
0.02 (MA))
1.00 (WA))
1.00 (NA))
0.22 (MA)
1372
13.0
SE
NIA
N/A
0.95 (NGA)
0.92 (M/A)
0.87 (Sia)
1.00 (NA)
1.00 (R1A)
1.00 (NAI
1375
11.7
AVAE"
N/A
(NUA)
(NUA)
0.55 (NA)
1.00 (NA)
1.00 (MAA)
(MA))
1372
15.5
AEAE
N/A
N/A
0.97
0.94
0.25
1.00
1.00
0.60
1373
13.9
SEaE-AVAE"
NIA
N/A
0.98 (NG3)
0.94 (N/A)
0.80 (NGA)
1.00 (N/A)
1,00 (87A)
0.83 (MA)
1374
13.9
AVAE-SS
N/A
N/A
0.94 (NGA)
0.73 (W/A)
0.21 (81A)
1.00 (NAA)
1.00 (K1A)
0.57 (MAI
1379
12.4
Attacks on the downstream task In this setup, examine how the proposed approach can aleviate the effect of the attack on the downstream tasks in the latent space. For this purpose, we follow the procedure from [12 [3]. Once the VAE is trained, we learn a linear classifier using the mean mappings as features. For the MNIST and Fashion MNIST datasets, we have the 10- class classification problem (digits in the former and pieces of clothing in the latter case). For the ColorMNIST dataset, we consider two classification tasks: the digit classification (10 classes), and the color classification (7 classes). We construct the attack fool the classifier. See Appendix D..2 for the details.
we compare our method (VAE + HMC) with the vanilla VAE with other methods in the literature. We report more results and the extended comparison in the Appendix C.2 where we show that our method combined with 3- VAE and 3-TCVAE leads to the increased robustness. For MNIST and Fashion MNIST (Table 2) we observe that the vanilla VAE with the HMC is more robust than 3-VAE and 3-TCVAE. The latter model was shown to be more robust to the latent space attack 42 Still, in experiments (on different datasets), could not observe the consistent improvement over the vanilla VAE, when using it with a single level of latent variables.
Results In Tables and 3.
In Table we report the result on the ColorMNIST dataset. Here, additionally compare the adversarial accuracy for our method with the Smooth Encoders (SE) and Autoencoding Variational Autoencoder (AVAE) methods 22 B3 We notice that these methods provide higher adversarial accuracy. However, we have also observed a large discrepancy in terms of the MSE and FID scores of the model itself compared to experiments, which we suspect might be a result of mistake in
12 13
Lastly, we would like to highlight that our defence strategy can be also combined with all the above VAE modifications. One advantage of our approach is that it does not require changing the training procedure of a VAE and, result, it does not decrease the quality of the generated images, Moreover, we can apply the same procedure to reconstruct the non-corrupted points and it will improve the reconstruction error. This result can be seen in the Tables 2 and X the results of the 336, where MCMC was used to improve the VAE performance.
and it goes in line with
4.3 Hierarchical VAE: NVAE
Model and datasets In this section, explore the robustness of the deep hierarchical VAE (NVAB) [3). a specific implementation of a hierarchical VAE that works well for eigh-dimensional data. We attack models trained on MNIST and CelebA [29] datasets. We use the weights of the pre-trained model provided in the official NVAE implementatior"
we construct adversarial attacks on the hierarchical VAE by considering higher-level latent variables. That being said, we use latent variables
Attacks construction Following 28
P We have gotten touch with the authors, who are kindly working with us to address this issue 'The code and model weights were taken from https: //tp::///ii /ttgttttttuttteeegg Coom///labs////eaao NVAE
8

---

||a| int = 0.1
|||| Inf = 0.2
|| inf = 0.05
|/e lnf 0.1
MSSSS [x .91
MSSSIMIX xP
0.0
10
0//
03
XVME BMC
SWAR - JMC
0.2
04
NVAK
WAAE
000
(a) The reconstruction similarity for MNIST
(b) The reconstruction similarity for CelebA
Figure 4: The robustness improvement for the hierarchical model (NVAE) on (a) MNIST and (b)
CelebA for two different attack radii. Higher values correspond to more robust representations.
1.0
1.0
MSSSIM
MSSSIM
0.9
0.5
0.8
,2
[P _F9
.2
0.7
0.2
0.4
0.6
0.8
1.0
0.2
0.4
0.6
0.8
1.0
Attack radius
Attack radius
(a) attacker does not know the defence strategy
(b) An attacker knows the defence strategy
Figure 5: Robustness to adversarial attack (with HMC defence). We report similarity of the reference and adversarial point (blue) and their reconstructions (orange).
(ZL-KA: ZL-kA+1,- 2 when constructing an attack (equation 3). Otherwise, we follow the same procedure we used for VAEs with a single level of latent variables. We assume that the attacker has access the model's encoder and uses the symmetric KL-divergence as the objective. The radius of an attack is measured with the Linf norm. For optimization, we use the projected gradient descent with the number of iterations limited to per point. Further details are reported the Appendix D.2
Results In Figure we present reconstruction similarity of the reference and adversarial points for both datasets. We observe that the proposed method consistently improves the robustness of the model to the adversarial attack. This result is in line with theoretical considerations where flexible class of variational posteriors could help to counteract adversarial attacks and, eventually, deacrease the bias of the class of models measured in terms of the KL-divergence. Additionally, applying the MCMC can further help us to counteract the attack. In Figure (the two bottom rows), show how adversarial point (c) is reconstructed without any defence (d) and with the proposed defence (e). In the depicted samples, we have used the top 10 latent variables (kA = 10) to construct the attack with radius of 0.05.
4.4 Ablation Study: What if the attacker knows the defence strategy?
In our experiments, we rely on the assumption that the attacker does not take into account the defence strategy that use. We believe that is reasonable, since the defence requires access the decoder part of the model, po z), which is not necessarily available to the attacker.
In this ablation study we verify how the robustness results change if construet the attack with the access to the defence strategy. We train an adversarial attack with the modified objective which takes into account the HMC step. See Appendix C.3 for details the experimental setup.
In Figure we show the experiment results for various attack radii between and 1. We observe that constructing attack with such objective is much harder (Figure 5 (b)).

---

Discussion
421. we only consider the projected gradient descent as a way to construct the attack. However, more sophisticated adaptive methods 38 were proposed attack discriminative model and can be potentially applied to VAEs as well. We believe that it is an interesting direction for the future work.
Following the previous works on attacking VAEs 6 10 12
13
18
Objective Function For the unsupervised attack the encoder,
the symmetric KL.- divergence to measure the dissimilarity. However, other options are possible, c.g., the forward or reverse KL-divergence even L2 distance between the means (see Table In our comparative experiments (see Appendix C.6), we observe that no single objective consistently performs better than others.
Attack radius During the attack construction we seek to obtain a point that will have the most different latent representation point itself is as similar to the initial reference point as possible. In Appendix C.4 we visualize how the attacks of different radii influence the similarity between the adversarial and reference points. Based on these results, we have chosen the radii which do not allow adversarial points to deviate lot from the reference (as measured by MSSSIM): ||e]lint 0.2 for the MNIST dataset (which goes in line with the previous works [3) and ||e]liut S 0.1 for the CelebA dataset.
different predicted class. However, it is also important that the
Number MCMC steps and Inference Time In our approach, we have to select the number of MCMC steps that the de-
MSSSIM Xa]
fender performs. This parameter potentially can be critical it influences both the in-
ference time (see Appendix (C7) and the
0.6
MNIST
performance (see Appendix C.5). Figure 6 we show the trade-off between the recon- struction similarity and the inference time.
Color MNIST
0.4
0.000
0.025
0.050
0.075
0.100
The increase in the inference time is cause by a larger number of HMC steps used (we consider 0, 100, 500 and 1000 steps for this experiment).
Inference time (sec.)
Figure 6: Trade-off between robustness and inference time.
Conclusion
In this work, explore the robustness of VAEs adversarial attacks. We propose theoretically justified method that allows alleviating the effect of attacks on the latent representations by improving the reconstructions of the adversarial inputs and the downstream tasks accuracy. We experimentally validate our approach on a variety of datasets: both grey-scale (MNIST, Fashion MNIST) and colored (ColorMNIST, CelebA) data. We show that the proposed method improves the robustness of the vanilla VAE models and its various modifications, i.e., 3-VAE, 3-TCVAE and NVAE.
Acknowledgements
Anna Kuzina is funded by the Hybrid Intelligence Center, a 10-year programme funded by the Dutch Ministry of Education, Culture and Science through the Netherlands Organisation for Scientific Research. Experiments were carried out on the Dutch national e-infrastructure with the support of SURF Cooperative
References
[1] An and S. Cho. Variational autoencoder based anomaly detection using reconstruction probability. Special Lecture on IE, 2(1):1-18, 2015.
[2] C. Andrieu, N. De Freitas, Doucet, and M. Jordan. An introduction to meme for machine learning. Machine learning, 50(1):5-43, 2003.
10

---

[3] A. Athalye. N. Carlini, and D. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. International conference on machine learning, pages 274-283. PMLR, 2018.
[4] I. A. Auzina and J. M. Tomezak. Approximate bayesian computation for discrete spaces. Entropy, 2313):112, 2021.
[5] Ballé, D. Minnen, S. Singh, J. Hwang, and N. Johnston. Variational image compression with scale hyperprior. In International Conference on Learning Representations, 2018.
[6] B. Barrett, A. Camuto, M. Willetts, and T. Rainforth. Certifiably robust variational autoencoders. International Conference on Artificial Intelligence and Statistics, pages 3663-3683, 2022.
[7] Y. Bengio, A. Courville, and P. Vincent. Representation learning: A review and new perspectives. IEEE transactions on pattern analysis and machine intelligence, 15(8):1798-188) 1828, 2013.
[8] M. Betancourt. A conceptual introduction to hamiltonian monte carlo. arXiv preprint
wrXiv:1701.0245 2017.
[9] Y. Burda, R. Grosse, and R. Salakhutdinov. Importance weighted autoencoders. In Interna- tional Conference on Learning Representations, 2016.
[10] A. Camuto, M. Willetts, S. Roberts, C. Holmes, and T. Rainforth. Towards a theoretical understanding of the robustness of variational autoencoders. In International Conference on Artificial Intelligence and Statistics, pages 3565-3573, PMLR, 2021.
[1]] A. L. Caterini, A. Doucet, and D. Sejdinovic. Hamiltonian variational auto-encoder. Advances in Neural Information Processing Systems, 31, 2018.
[12] T. Cemgil, S. Ghaisas, K. Dvijotham, S. Gowal, and P. Kohli.
The autoencoding variational autoencoder. Advances in Neural Information Processing Systems, 33, 2020.
[13] T. Cemgil, S. Ghaisas, K. D. Dvijotham, and Kohli. Adversarially robust representations with smooth encoders. In International Conference on Learning Representations. openreview.ner, 2019.
[14] R. T. Chen, X. Li, R. B. Grosse, and D. K. Duvenaud. Isolating sources of disentanglement in variational autoencoders. Advances in neural information processing systems, 31, 2018.
[15] R. Child. Very deep VAEs generalize autoregressive models and can outperform them on images. In International Conference on Learning Representations, 2021.
[16] C. Cremer, X. Li, and D. Duvenaud. Inference suboptimality in variational autoencoders. In International Conference Machine Learning, pages 1078-1086. PMLR, 2018.
[17] S. Duane, A. D. Kennedy, J. Pendleton, and D. Roweth. Hybrid monte carlo. Physics letters
B, 195(2):216-222, 1987.
[18] G. Gondim-Ribeire P. Tabacof, and E. Valle. Adversarial attacks on variational autocncoders. ArXiv Preprint, June 2018.
[19] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
[20] A. Habibian, T. v. Rozendaal, J. M. Tomezak, and T. S. Cohen. Video compression with rate-distortion autoencoders. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 7033-7042, 2019.
[21] I. Higgins, L. Matthey, A. Pal, C. Burgess, X. Glorot, M. Botvinick, S. Mohamed, and A. Ler- chner. beta-vae: Learning basic visual concepts with constrained variational framework. International Conference on Learning Representations (ICLR), 2017.
[22] I. Higgins, A. Pal, A. Rusu, L. Matthey, C. Burgess, A. Pritzel, M. Botvinick, C. Blundell, and A. Lerchner. Darla: Improving zero-shot transfer in reinforcement learning. In International Conference on Muchine Learning, pages 1480-1490. PMLR, 2017.
[23] M. D. Hoffman. Learning deep latent gaussian models with markov chain monte carlo. In International conference muchine learning, pages 1510-1519, PMLR, 2017.
[24] P. Izmailov, S. Vikram, M. D. Hoffman, and A. G. G. Wilson What are bayesian neural network posteriors really like? In International conference on machine learning, pages 4629 4649- PMLR, 2021.
11

---

[25] M. I. Jordan, Z. Ghahramani, T. S. Jaakkola, and L. K. Saul. An introduction to variational methods for graphical models. Machine learning, 37(2):183-233 1999.
[26] H. Kim and A. Mnih. Disentangling by factorising. In International Conference on Machine Learning, pages 2649-2658. PMLR, 2018.
[27] D. P. Kingma and M. Welling. Auto- variational bayes. In International Conference on Learning Representations. ICLR 2014, 2014.
[28] A. Kuzina, M. Welling, and J. M. Tomczak. Diagnosing vulnerability of variational auto- encoders to adversarial attacks. ICLR, RobustML. workshop, 2021.
[29] Z. Liu, P. Luo, X. Wang, and X. Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
[30] L. Maaløe, M. Fraccaro, V. Liévin, and O. Winther. BIVA: A very deep hierarchy of latent variables for generative modeling. In Advances in Neural Information Processing Systems, Feb. 2019.
[31] R. M. Neal et al. Meme using hamiltonian dynamics. Handbook of markov chain monte carlo, 2(11); 2011.
[32] A. Nishimura, D. B. Dunson, and J. Lu. Discontinuous hamiltonian monte carlo for discrete parameters and discontinuous likelihoods. Biometrika, 107(2):365-380, 2020.
[33] R. Ranganath, D. Tran, and D. Blei. Hierarchical variational models. In Proceedings of The 33rd International Conference on Machine Learning, volume 48 of Proceedings of Machine Learning Research, pages 324-333, New York, New York, USA, 2016. PMLR.
[34] D. J. Rezende, S. Mohamed, and D. Wierstra. Stochastic backpropagation and approximate inference in deep generative models. In International Conference on Machine Learning, pages 1 1286. PMLR, 2014.
[35] F. Ruiz and M. Titsias. A contrastive divergence for combining variational inference and meme. In International Conference on Machine Learning, pages 5537-5545. PMLR, 2019.
[36] T. Salimans, D. Kingma, and M. Welling. Markov chain monte carlo and variational inference: Bridging the gap. In International conference on machine learning, pages 1 1218-1226. PMLR, 2015.
[37] C. K. Sønderby, T. Raiko, L. Maalø S. R. K. Se nderby, and O. Winther. Ladder variational autoencoders. In Advances in Neural Information Processing Systems, volume 29, pages 7738-3746. Curran Associates, Inc., 2016.
[38] F. Tramer, N. Carlini, W. Brendel, and A. Madry. On adaptive attacks to adversarial example defenses. Advances in Neural Information Processing Systems, 33:1633-1645, 2020.
[39] A. Vahdat and J. Kautz. NVAE: A deep hierarchical variational autoencoder. In Neural Information Processing Systems (NeurIPS), 2020.
[40] A. Van Den Oord, O. Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems, 30, 2017.
[41] 7. Wang, F. P. Simoncelli, and A. C. Bovik. Multiscale structural similarity for image quality assessment. In The Thrity-Seventh Asilomar Conference on Signals, Systems Computers. 2003, volume 2, pages I 1398- 1402. Ieee, 2003.
[42] M. Willetts, A. Camuto, T. Rainforth, S. Roberts, and C. Holmes. Improving VAEs' robustness adversarial attack. In International Conference on Learning Representations, 2021.
[43] C. Wolf, M. Karl, and P. van der Smagt. Variational inference with hamiltonian monte carlo. arXiv preprint arXiv: 00000 2016.
[44] H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mnist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint arxiv: 2017.
[45] R. Zhang, X. Liu, and Q. Liu. A langevin-like sampler for discrete distributions, In International Conference on Machine Learning, pages 26375-26396. PMLR, 2022.
12

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes] See Section
(b) Did you include complete proofs of all theoretical results? [Yes] See Section and Appendix A
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or URL)? [Yes]
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See Appendix D
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes]
(d) Did you include the total amount of compute and the type of resources used (c.g., type of GPUs, internal cluster, cloud provider)? [No]
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] We use NVAE code and pretrained that are published on github
(b) Did you mention the license of the assets? [Yes] The licence allows using code for non-commercial purposes
(c) Did you include any assets either in the supplemental material as URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you' 're using/curating? [N/A]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
13


Reviews:
[{"review_id": "y1i19AhjjR0", "reviewer": "Reviewer_knXo", "summary": "The paper presents the hypothesis that adversarial attacks on VAEs push the latent code into low probability areas. According to this hypothesis, the attack can be mitigated by pushing back the latent code into more probable region of the latent space. To do so, MCMC is applied in inference time. The results demonstrate that the images generated by the decoder from the \"corrected\" code are indeed more accurate as reconstructions. ", "questions": "What is the sensitivity of the method to the percentage of corrected examples?", "limitations": "Yes. ", "rating": 7, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper propose a simple hypothesis, which opens an avenue into a simple mitigation technique. The paper is clearly written, and the approach seems to be theoretically justified and empirically convincing. The proposed method has the advantage of being applied post-hoc on a pretrained model without having to modify the encoder or re-train it. \n\nIt would be beneficial to more directly assess the original hypothesis, i.e., to what extent the latent codes produced by the model after the attack are less probable? In addition, it would be beneficial to consider alternative correction methods, e.g. performing a k-means clustering on the latent space and pushing each point towards the center of each assigned cluster. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "l_z9jZlkxpM", "reviewer": "Reviewer_d2M4", "summary": "This paper proposes Hamiltonian Monte Carlo (HMC) strategy for defending pre-trained encoder of VAE from adversarial attacks. \nThe authors provides theoretical analysis to substantiate the proposed method, which alleviating the adversarial attacks. \nAlso, the authors conduct experiments on various benchmark datasets to show the robustness of the proposed defending strategy.", "questions": "- What is $t$ in $q^t$, the number of MCMC steps?\n- In the argument in Line 172-173, true posterior $p_\\theta (z|x^a)$ is unknown. How can one tell $q^t (z|x^a) \\rightarrow p_\\theta (z|x^a)$ as $t \\rightarrow \\infty$, if $t$ implies the number of MCMC steps? I might miss something, but since Theorem 3 takes huge part of this paper, hence I respectfully ask the authors to address the question with theoretical backups.\n- The $\\beta$-VAEs are not designed for defending the adversarial attacks, rather they are for the disentangling purpose. I'm not sure if comparing VAE+HMC against $\\beta$-VAEs is a fair comparison.\n- Can the same strategy be applied to VAEs with other priors with explicit distributions? For example, priors of discrete probabilities such as Dirichlet distribution or Softmax computation after Gaussian sampling. Or, exponential families in general.\n- What is the input scale? 0-1 for every experiment?\n- In the caption of Table 2: radius 0.1 **(top)** and 0.2 **(bottom)**, perhaps typos?\n- What is AVAE-SS in Table 3?\n- How does the performance change when apply the proposed HMC method to the other VAE variants in Table 3?\n- Typo in Line 332, a dash -.\n", "limitations": "The authors discussed the limitation of their work in Section 5, and it seems there are no potential negative societal impact on their work.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "- The work studies on interesting and significant topic, and the approach seems very simple to apply. I do believe that this kind of work gives positive social impact, for example, attacks like vicious data generation.\n- The result also seems promising, including the one in Section 4.3. However, it would be much better if the authors also provide the qualitative result, the one in Figure 2, on high-resolution images regarding the experiment on NVAE.\n- HMC seems unfamiliar in recent deep learning community, and it would be better to add the gentle explanation about HMC in the background section. \n- My concern (and also questions) on the paper is pointed at Question #2 and #3, which I might have not fully understood. Please read below questions.\n- The paper is generally well-written, but some details are missing which are the keys to understand the entire paper. See Question section below.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "gC-3P45k6n2", "reviewer": "Reviewer_yegK", "summary": "This paper proposes a defense against supervised and unsupervised adversarial attacks in VAEs – in the former a classifier trained on the latent space of the encoder is attacked, and in the later the latent codes themselves are attacked such that the decoded image looks different. The defense is motivated by the hypothesis that adversarial codes are located at low probability regions of the posterior distribution’s support, and consequently an effective defense is to move any code to a high probability region. The paper achieves this by using a particular MCMC approach – Hamiltonian Monte Carlo – as a post-processing sampling step on the codes generated by the encoder of a VAE. The theoretical results support the validity of the approach, and the empirical results show that it is effective in reducing the success of an adversary in both supervised and unsupervised attacks across several datasets.", "questions": "1. Is Figure 1 an illustration or an actual experiment? If it's an experiment, the “we observe...” part in the caption needs some more evidence, such as reporting posterior probability ratio assigned to reference codes over perturbed codes. This will also directly support your hypothesis.\n\n2. In Algorithm 1, inside the for loop, $z^l$ should have superindex l-1 in the right side of the first and second line, and $p^l$ should be a temporary variable except in the left side of the last line (since it is overwriting itself)? Also, it is important to report the suggested or default values (used in your experiments) for the hyperparameters inside Algorithm 1's definition.\n\n3. Theorem 3 should be Theorem 1?\n\n4. What are the time, computation and memory costs of the proposed defense? How do they scale with the architecture (particularly in case of hierarchical VAEs)?\n\n5. Can you comment on the applicability of the defense on VQVAE, or conditional VAEs with discrete latents?\n", "limitations": "Limitations are sufficiently discussed, except for the time and computation costs mentioned above.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The paper's proposed defense is simple and effective, and the theoretical analysis sufficiently backs up the defense. To my knowledge, this particular defense is novel, and it can be very significant given that it is independent of the VAE architecture and causes minor degradations in the generative quality. The paper also takes care to study the effect of several hyperparameters and design choices.\n\nA main concern for me is the lack of a discussion on the inference time. The proposed defense will inevitably be slower than baseline VAEs due to the sequential sampling process, which typically takes 1000 steps per Table 7 in Appendix C.2, and requires at least 100 steps per Figure 12 in Appendix B.4. The analysis presented in Tables 2 and 3 would be much more substantial if the inference time is included. I also think that the choice of the particular MCMC algorithm – HMC – needs to be discussed in more detail versus other sampling strategies, given its central role in the proposed defense.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "RduP2JlXEz", "reviewer": "Reviewer_bo5D", "summary": "The paper proposes to defend against adversarial attacks on variational autoencoders by doing Hamiltonian Monte Carlo in the latent space to move the attacked sample back to a more high probability region. The authors compare the effects across different datasets and attack methodologies and show that it improves robustness. Additionally, the authors produce theoretical results that show that doing HMC should help against attacks. ", "questions": "If the logic is that samples from low density latent spaces are worse why is HMC used which just aims to produce independent samples. Wouldn't instead an optimisation technique that tries to maximize the posterior be more helpful? HMC might even reduce the posterior of the sample. \n\nI find the results in Section 4.3. very surprising. How does knowing the defence make the attacker so much weaker? I would expect the opposite. Do the authors have any insight on this?\n\nSmall comments: \n- Since MSSSIM and the Adv. accuracy have arrows pointing up it would be good to add arrows pointing down for MSE and FID in Table 2 and 3.\n- It would be better to have MSSSIM as the y-axis label than the title in Figure 4.", "limitations": "The authors emphasize that their method only changes the inference and not the training compared to other defenses. While this has obvious advantages the paper should also discuss the downsides, e.g. that in practical applications often you would trade longer training time if it avoids a computationally demanding MCMC step for every inference call. ", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\n\nThe paper explains the method well and compares it with several other methods in detail.\nThe theory part gives a good explanation as to why the method can lead to improved robustness.\nA method that only changes the inference part has the huge advantage that it can be retrofitted to trained models which can be very helpful when it is hard to retrain a model or in cases where the model can't be changed.\nUsing MCMC to improve robustness is an interesting direction that can be very helpful for the community if further explored.\n\n**Weaknesses**\n\nThe paper claims multiple times that because training isn't changed the performance for non-attacked inputs won't be decreased. I don't understand that logic, as the inference defence would have to be applied to non-attacked inputs as well, as usually you won't know beforehand if the image has been attacked or not. In lines 145-146 even claim that it could improve results for non-attacked images. Looking at all the results it seems like this is never tested. Figure 1 doesn't apply MCMC to the non-attacked input, and the MSE and FID values in Table 2 and 3 are exactly the same for VAE and VAE + HMC which seems unlikely if MCMC was used. If the results are really not decreased for non-attacked samples then this should be shown.\nWhile the method increases robustness, the robust accuracy is very low in some cases compared to other methods e.g. just 0.16 or 0.11 for ColorMNIST accuracy in Table 3 compared to other methods getting values around over 0.9 or 0.8 respectively. While the authors show that these methods result in high MSE and FID errors this might not be relevant in some applications. It would be interesting to include nominal accuracy in the results to show if the increased robustness leads to lower nominal accuracy for these methods. This would also again be interesting to see if the HMC steps have an effect on nominal accuracy.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept