Alleviating Adversarial Attacks on Variational Autoencoders with MCMC
Abstract
Variational autoencoders (VAEs) are latent variable models that can generate complex objects and provide meaningful latent representations.
Moreover, they couldbe further used in downstream tasks such as classification.
As previous work hasshown, one can easily fool VAEs to produce unexpected latent representations andreconstructions for a visually slightly modified input.
Here, we examine severalobjective functions for adversarial attacks construction proposed previously andpresent a solution to alleviate the effect of these attacks.
Our method utilizes the
Markov Chain Monte Carlo (MCMC) technique in the inference step that we motivate with a theoretical analysis.
Thus, we do not incorporate any extra costs duringtraining and the performance on non-attacked inputs is not decreased.
We validateour approach on a variety of datasets (MNIST, Fashion MNIST, Color MNIST,
CelebA) and VAE configurations ( β -VAE, NVAE, β -TCVAE), and show that ourapproach consistently improves the model robustness to adversarial attacks.
Introduction
Variational Autoencoders (VAEs) [25, 32] are deep generative models used in various domains.
Recently, it was shown that Variational Autoencoders with a hierarchical structure [31], coupled withskip-connections [28, 35] can generate high-quality images [14, 37].
An interesting trait of VAEs isthat they allow learning meaningful latent space induced by the encoder.
These latent representationsare commonly used in downstream tasks [7, 21].
These motivates us to explore the robustness of theresulting latent representations to understand the capabilities and potential vulnerabilities of VAEsbetter.
Adversarial attacks constitute one way to assess the robustness of a deep neural network.
Robustness to the attacks is a crucial property for VAEs, especially in such applications as anomalydetection [1, 28] or data compression [5, 19].
The main questions on adversarial attacks for VAEs are mainly focused on how they could be formulated and alleviated.
In [17] it is proposed to minimize the KL-divergence between an adversarialinput and a target input to learn an adversarial attack for the vanilla VAE.
Further, in [26] it is shownthat a similar strategy can be used to attack hierarchical VAEs.
To counteract the adversarial attacks,the authors of [40] suggest using a modified VAE objective, namely, β -TCVAE, that increases VAErobustness, especially when coupled with the hierarchical structure.
It was shown in [10] that β -VAEstend to be more robust to adversarial attacks in terms of the r -metric proposed therein.
The authors of[6] presented that the adversarial robustness can be achieved by constraining the Lipschitz constantof the encoder and the decoder.
[11, 12] introduce modifications in the VAE framework that allow forbetter robustness against the adversarial attacks on downstream classification tasks.
In our work, weconsider β -VAE, β -TCVAE and a hierarchical VAE, and outline a defence strategy that improvesrobustness to attacks on the encoder and the downstream classification task.
The proposed method isapplied during inference and, therefore, can be combined with other known techniques to get morerobust latent representations.
[Figure] [Figure]
(cid:101) a point of the latent space but
MCMC we are able to move them closer to the initial position so that
(cid:101) x aHMC is to the initial one (cid:101) x
An adversarial attack on a VAE is usually formulated as an additive perturbation ε of thereal data point x r so that the resulting point isperceived by a model as if it is a totally different image (either during reconstruction or inthe downstream classification task)
In
Figure 1, we depict an example of an attackon the encoder: the point andthe adversarial point x a are almost indistinguishable, but they are encoded into differentregions in the space.
As a result, their reconstructions also significantly
In this paper, we formulate the following hypothesis: An adversarial attack maps the input to a latent region with a lower probabilitymass assigned by the true posterior (proportional to the conditional likelihood times themarginal over latents) and, eventually, weobtain incorrect reconstructions .
Therefore,a potential manner to milden the effect of anattack may rely on running a Markov chainto move the latent representation back to amore probable latent region.
Such a defenceis reasonable because we do not modify thetraining procedure or the model itself, weonly insert a correction procedure.
As a result, we propose to counteract adversarial attacks by enhancing the variational inferencewith Markov Chain Monte Carlo (MCMC)sampling.
The illustrative example depictedin the Figure 1 shows that the latent code of the adversarial input (red circle) moves closer to thelatent code of the reference point (orange circle) after applying the MCMC (purple circle).
The contribution of this work is the following:
• We propose to use an MCMC technique during inference to correct adversarial attacks on VAEs.•
We show theoretically that the application of an MCMC technique could indeed help to counteractadversarial attacks (Theorem 1).• We indicate empirically that the previously proposed strategies to counteract adversarial attacks donot generalize well across
various datasets.•
We show empirically that the proposed approach (i
e., a VAE with an MCMC during inference)outperforms all baselines by a significant margin.
Background
2.1 Variational Autoencoders
Let us consider a vector of observable random variables, x ∈ X D
(e.g., X = R ) sampled from theempirical distribution p e ( x ) , and vectors of latent variables z k ∈ R M k , k = 1 , 2 , . .
, K , where M kis the dimensionality of each latent vector.
First, we focus on a model with K = 1 and the jointdistribution p θ ( x , z ) =
p θ ( x | z ) p ( z ) .
The marginal likelihood is then equal to p θ ( x ) =
(cid:82) p θ ( x , z )d z .
VAEs exploit variational inference [23] with a family of variational posteriors { q ϕ ( z | x ) } , also referred 84 to as encoders, that results in a tractable objective function,
i.e., the Evidence Lower BOund (ELBO):
[Equation]
β -VAE [20] uses a modified objective by weighting the D KL term by β > 0 .
In the case of
K > 1 , we consider a hierarchical latent structure with the generative model of the following form:
[Table]
[Equation]
(cid:81)
Kk =
[Equation]
p θ ( z k | z >k ) .
There are various possible formulations 89 of the family of variational posteriors.
However, here we follow the proposition of [35] withthe autoregressive inference model, namely, q ϕ ( z 1 , . . .
, z K | x ) =
q ϕ ( z K | x ) (cid:81)
[Table]
[Equation]
|
[Equation]
x
[Equation]
This formulation was used, among others, in NVAE [37].
Because of the top-down structure, it allowssharing data-dependent information between the inference model and the generative model.
2.2 Adversarial attacks
An adversarial attack is a slightly deformed data point that results in an undesired or unpredictableperformance of a model [18].
In this work, we focus on the attacks that are constructed as an additiveperturbation of the real data point x r (which we will refer to as reference ), namely:
[Equation]
where
[Equation] [Equation]
where δ is the radius of the attack.
The additive perturbation ε is chosen in such a way that theattacked point does not differ from the reference point too much in a sense of a given similaritymeasure.
It is a solution to an optimization problem solved by the attacker.
The optimization problemcould be formulated in various manners by optimizing different objectives and by having specificconstraints and/or assumptions.
Attack construction Let f ( x ) be part of the model available to the attacker.
In the case of VAEs,this, for example, may be an encoder network or an encoder with the downstream classifier in thelatent space.
The attacker uses a similarity measure ∆ to learn an additive perturbation to a referencepoint.
We consider two settings: unsupervised and supervised .
In the former case, the perturbation issupposed to incur the largest possible change in f :
[Equation]
The latter setting requires a target point x t .
The perturbation attempts to match the output for thetarget and the attacked points, namely:
[Equation]
There are different ways to select f and ∆ in the literature.
Furthermore, different L p -norms can beused to restrict the radius of the attack.
Table 1 summarizes recent work on the topic.
In this work, we focus on attacking the encoder and the downstream classification task usingunsupervised adversarial attacks.
In the former, we maximize the symmetric KL-divergence to get thepoint with the most unexpected latent code and, therefore, the reconstruction.
In the latter, the latentcode is passed to a classifier.
The attack is trained to change the class of the point by maximizing thecross-entropy loss.
However, the method we propose in Section 3 is not limited to these setups sinceit is agnostic to how the attack was trained.
Robustness measures To measure the robustness of the VAE as well as the success of the proposeddefence strategy, we focus on two metrics: MSSSIM and Adversarial accuracy.
For latent space attacks we follow [26] in using Multi-Scale Structural Similarity Index Measure( MSSSIM ) [39].
We calculate MSSSIM[ (cid:101) x r , (cid:101) x a ] , i.e., the similarity between reconstructions of x rand the corresponding x a .
We do not report the similarity between a reference and the correspondingadversarial input, since this value is the same for all the considered models (for a given attack radius).
A successful adversarial attack would have a small value of MSSSIM[ (cid:101) x r , (cid:101) x a ] .
For the attacks on the downstream classifier, we follow [11, 12] and calculate the adversarial accuracy.
For a given trained VAE model, we first train a linear classifier using latent codes as features.
Afterwards, the attack is trained to fool the classifier.
Adversarial accuracy is the proportion ofpoints for which the attack was unsuccessful.
Namely, when the predicted class of the reference andcorresponding adversarial point are the same.
Preventing adversarial attacks with MCMC
Assumptions and the hypothesis We consider a scenario in which an attacker has access to the
VAE encoder and, where relevant, to the downstream classification model.
Above, we presentedin detail how an attack could be performed.
We assume that the defender cannot modify thesecomponents, but it is possible to add elements that the attacker has no access to.
We hypothesize that the adversarial attacks result in incorrect reconstructions because the latentrepresentation of the adversarial input lands in a region with a lower probability mass assigned bythe true posterior .
A potential solution to this issue would be to bring the latents "back" to a highlyprobable region.
Since the adversarial attack destroys the input irreversibly, at the first sight it seemsimpossible to reconstruct the latent representation of the reference point.
We aim at showing that thisis possible to some degree theoretically and empirically (see Appendix C.1).
The proposed solution
In order to steer the latents towards high probability regions, we proposeto utilize an MCMC method during inference time.
Since we are not allowed to modify the VAEor its learning procedure, this is a reasonable procedure from the defender’s perspective.
Anotherpositive outcome of such an approach is that in a case of no attack, the latents given by the MCMCsampling will be closer to the mean of the posterior, thus, the reconstruction should be sharper or,at least, not worse.
Note that the variational posterior approximates the true posterior from whichthe MCMC procedure samples.
We propose to sample from q ( t ) ( z | x ) =
[Equation]
where Q ( t ) ( z | z 0 ) is a transition kernel of MCMC with t steps and the target distribution π ( z )
=
p θ ( z | x ) ∝ p θ ( x | z ) p ( z ) .
Alternatively, we can use optimization to find the mode of the posterior,however, MCMC can add extra benefits such as exploration of the typical set and randomness (see Appendix B.3 for details).
To further analyze the proposed approach, we start with showing the following lemma:
Lemma 1 Consider true posterior distributions of the latent code z for a data point x r and itscorrupted version x a .
Assume also that ln p θ ( z | x ) is differentiable at the point x = x r .
Then
the
KL-divergence between these two posteriors could be expressed using the small o notation in termsof the radius of the attack, namely:
[Equation]
Proof See Appendix A.
According to Lemma 1, the difference (in the sense of the Kullback-Leibler divergence) between thetrue posteriors for a data point x and its corrupted version x a is proportional to the norm of the noise(attack).
This result is rather intuitive because the stronger is the noise, the larger is the differencebetween the latent representations.
Next, the crucial step to show is whether we can quantify somehow the difference between thedistribution over latents for x a after running MCMC with t steps, q ( t ) ( z | x a ) , and the variationaldistribution for x r , q ϕ ( z | x r ) .
We provide an important upper-bound for the Total Variation distance(TV) 1 between q ( t ) ( z | x a ) and q ϕ ( z | x r ) in the following lemma:
Lemma 2 The Total Variation distance ( TV ) between the variational posterior with MCMC fora given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for a given data point x r ,q ϕ ( z | x r ) , can be upper bounded by the sum of the following three components:
[Equation]
Proof See Appendix A.
The difference expressed by TV
[Equation]
is thus upper-bounded by the following threecomponents:
• The TV between q ( t ) ( z | x a ) and the real posterior for the corrupted image, p θ ( z | x a ) .
Theoretically, if t → ∞ , q ( ∞ ) ( z | x a ) =
p θ ( z | x a ) and, hence, TV
[Equation]
• The second component is the square root of the KL-divergence between the real posteriors
for the image and its corrupted counterpart.
Lemma
1 gives
us
information about this
quantity
• The last element, the square root of D KL [ q ϕ ( z | x r ) ∥
p θ ( z | x r )] , quantifies the approximation
gap [15], i.e., the difference between the best variational posterior from a chosen family, and
the true posterior.
This quantity has no direct connection with adversarial attacks.
However,
as we can see, using a rich family of variational posteriors can help us to obtain a tighterupper-bound.
In other words, taking flexible variational posteriors allows to counteractattacks.
This finding is in line with the papers that propose to use hierarchical VAEs as themeans for preventing adversarial attacks [40].
Eventually, by applying Lemma 1 to Lemma 2, we obtain the following result:
Theorem
The upper bound on the total variation distance between samples from MCMC fora given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for the given real point x r ,q ϕ ( z | x r ) , is the following:
[Equation]
Proof See Appendix A.
As discussed already, the first component gets smaller with more steps of the MCMC.
The secondcomponent could be treated as a bias of the family of variational posteriors.
Finally, there is the lastelement that corresponds to a constant error that is unavoidable.
However, this term decays fasterthan the square root of the attack radius.
Specific implementation of the proposed approach In this paper, we use a specific MCMCmethod, namely, the Hamiltonian Monte Carlo (HMC) [8, 16].
Once the VAE is trained, theattacker calculates an adversarial point x
a using the encoder of the VAE.
After the attack, the latentrepresentation of x a is calculated, z a , and used as the initialization of the HMC.
In the HMC, the target (unnormalized) distribution is p ( x a | z ) p ( z ) .
The Hamiltonian is then theenergy of the joint distribution of z and the auxilary variable p , that is:
[Equation]
When applying the proposed defence to hierarchical models, we update all the latent variables simultaneously.
That is, we have z = { z 1 , . .
, z K } and U ( z )
= − ln p θ ( x a | z ) − (cid:80)
Kk =1 ln p θ ( z k | z k +1 ) .
Input : z , η, L p ∼ N (0 , I ) .
▷ Sample the auxiliary variable z (0) :
=
z , p (0) :
= p .
for l = 1 . . .
, L do ▷ Make L steps of leapfrog .
p ( l ) = p ( l − 1) − η 2 ∇ z U ( z ( l ) ) .
z ( l ) =
z ( l ) + η ∇ p K ( p ( l ) ) .
p ( l ) = p ( l ) − η 2 ∇ z U ( z ( l ) ) .
end for ▷ Accept new point with prob.
α .
α = min (cid:0) 1 , exp (cid:0) − H ( z ( L ) , p ( L ) )
+ H ( z (0) , p (0) )
(cid:1)(cid:1)
z = (cid:26) z ( L ) with probability α, z (0) otherwise .
Return : z
Eventually, the resulting latents from the
HMC are decoded.
The steps of the wholeprocess are presented below:
Then,
T of HMC (Algorithm 1)
the
L leapfrog steps.
The resulting latent code z can be passed tothe decoder to get a reconstruction or to thedownstream classification task.
Experiments
4.1 VAE, β -VAE and β -TCVAE
(a) x r (b) (cid:101) x r (c) x a (d) (cid:101) x a (e) (cid:101) x aHMC
Following [12], weconstruct the Color MNIST dataset from
MNIST by artificially coloring each imagewith seven colors (
except
Models We train vanilla fully convolutional VAEs, as well as β -VAE [20] andβ -TCVAE [13, 24].
Both β -VAE and βTCVAE modify the ELBO objective to encourage disentanglement.
β -VAE weighsthe KL-term in the ELBO with β > 0 .
Itis said that the larger values of β encourage disentangling of latent representations[13] and improve the model robustness asobserved by [10].
β -TCVAE puts a higherweight on the total correlation (TC) term ofthe ELBO.
Penalization of the total correlation was shown to increase the robustnessof VAE adversarial attacks [40].
In Appendix D.1 we provide details of thearchitecture, optimization, and results onthe test dataset for VAE trained with different values of β .
We note that the optimal value in terms of the negative loglikelihood (NLL) is always β = 1 .
Largervalues of β are supposed to improve robustness in exchange for the reconstruction quality.
When evaluating the robustness of β -VAE and β -TCVAE, we train models withβ ∈ { 2 , 5 , 10 } .
Then, we select the value of β that provides the most robust model in terms of theused metric.
Next, we apply our defence strategy to this model to observe the potential performanceimprovement.
Our implementation.
[Table] [Table]
[Table] [Table]
Attacks on the Encoder In the first setup, we assume that the attacker has access to the encoder ofthe model q ϕ
( z | x ) [6, 17, 40].
We use the projected gradient descent (PGD) with 50 steps to maximizethe symmetric KL-divergence in the unsupervised setting (equation 3).
We train 10 adversarial attacks(with different random initialization) for each of 50 reference points.
See Appendix D.2 for thedetails.
We report similarity between the reconstruction of the adversarial and reference point as ameasure of the robustness (see Section 2.2).
Attacks on the downstream task In this setup, we examine how the proposed approach canaleviate the effect of the attack on the downstream tasks in the latent space.
For this purpose, wefollow the procedure from [11, 12].
Once the VAE is trained, we learn a linear classifier usingthe mean mappings as features.
For the MNIST and Fashion MNIST datasets, we have the 10class classification problem (digits in the former and pieces of clothing in the latter case).
For the
ColorMNIST dataset, we consider two classification tasks: the digit classification (10 classes), andthe color classification (7 classes).
We construct the attack to fool the classifier.
See Appendix D.2for the details.
Results In Tables 2 and 3, we compare our method (VAE + HMC) with the vanilla VAE with othermethods in the literature.
We report more results and the extended comparison in the Appendix
C.2 where we show that our method combined with β -VAE and β -TCVAE leads to the increasedrobustness.
For MNIST and Fashion MNIST (Table 2), we observe that the vanilla VAE with the
HMC is more robust than β -VAE and β -TCVAE.
The latter model was shown to be more robust tothe latent space attack [40].
Still, in our experiments (on different datasets), we could not observe theconsistent improvement over the vanilla VAE, when using it with a single level of latent variables.
In Table 3 we report the result on the ColorMNIST dataset.
Here, we additionally compare theadversarial accuracy for our method with the Smooth Encoders (SE) and Autoencoding Variational
Autoencoder (AVAE) methods [11, 12].
We notice that these methods provide higher adversarial
8 k A 0 .0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
NVAE+HMC NVAE   8 k A 0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
NVAE+HMC NVAE
10 k A 0 .0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
10 k A 0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
[Figure]
accuracy.
However, we have also observed a large discrepancy in terms of the MSE and FID scoresof the model itself compared to our experiments, which we suspect might be a result of a
Lastly, we would like to highlight that our defence strategy can be also combined with all theabove VAE modifications.
One advantage of our approach is that it does not require changing thetraining procedure of a VAE and, as a result, it does not decrease the quality of the generated images.
Moreover, we can apply the same procedure to reconstruct the non-corrupted points and it willimprove the reconstruction error.
This result can be seen in the Tables 2 and 3 and it goes in line
withthe results of the [34], where MCMC was used to improve the VAE performance.
4.2 Hierarchical VAE: NVAE
Model and datasets In this section, we explore the robustness of the deep hierarchical VAE (NVAE)[37], a specific implementation of a hierarchical VAE that works well for high-dimensional data.
Weattack models trained on MNIST and CelebA [27] datasets.
We use the weights of the pre-trainedmodel provided in the official NVAE implementation 3 .
Attacks construction Following [26] we construct adversarial attacks on the hierarchical
VAE by considering higher-level latent variables.
That being said, we use latent variables{ z L − k A ,
z L − k A +1 , . . .
, z L } when constructing an attack (equation 3).
Otherwise, we follow the 291 same procedure we used for VAEs with a single level of latent variables.
We assume that the attackerhas access to the model’s encoder and uses the symmetric KL-divergence as the objective.
The radiusof an attack is measured with the L inf norm.
For optimization, we use the projected gradient descentwith the number of iterations limited to 50 per point.
Further details are reported in the Appendix
D.2.
Results In Figure 3, we present reconstruction similarity of the reference and adversarial pointsfor both datasets.
We observe that the proposed method consistently improves the robustness of themodel to the adversarial attack.
This result is in line with our theoretical considerations where aflexible class of variational posteriors could help to counteract adversarial attacks and, eventually,deacrease the bias of the class of models measured in terms of the KL-divergence.
Additionally,applying the MCMC can further help us to counteract the attack.
In Figure 2 (the two bottom rows),we show how an adversarial point (c) is reconstructed without any defence (d) and with the proposeddefence (e).
In the depicted samples, we have used the top 10 latent variables ( k A = 10 ) to constructthe attack with a radius of 0.05.
4.3 Ablation Study: What if the attacker knows the defence strategy?
In our experiments, we rely on the assumption that the attacker does not take into account the defence strategy that we use.
We that it is reasonable, since the defence requires access to the decoder part of the model, p θ ( x | z ) , which is not necessarily available to the attacker.
Attack radius 0 .0 .1 .
M
SSS
I M [ x r ,x a ] [ e x r , e x a ] 0 .0 .0 .0 .1 .
Attack radius 0 .0 .0 .1 .
M
SSS
I M [ x r ,x a ] [ e x r , e x a ]
[Figure]
In this ablation study we verify how the robustness results change if we construct the attack with theaccess to the defence strategy.
We train an adversarial attack with the modified objective 3, whichtakes into account the HMC step.
See Appendix C.3 for more details on the experimental setup.
In Figure 4 we show the experiment results for various attack radii between 0 and 1.
We observe thatconstructing an attack with such an objective is much harder (Figure 4 (b)).
Discussion
Following the previous works on attacking VAEs [6, 10, 11, 12, 17, 40], we only consider theprojected gradient descent as a way to construct the attack.
However, more sophisticated adaptivemethods [3, 36] were proposed to attack discriminative model and can be potentially applied to VAEsas well.
We believe that it is an interesting direction for the future work.
Objective Function For the unsupervised attack on the encoder, we use the symmetric KLdivergence to measure the dissimilarity.
However, other options are possible, e.g., the forwardor reverse KL-divergence or even L 2 distance between the means (see Table 1).
In our comparativeexperiments (see Appendix C.6), we observe that no single objective consistently performs betterthan others.
Attack radius During the attack construction we seek to obtain a point that will have the mostdifferent latent representation or a different predicted class.
However, it is also important that thepoint itself is as similar to the initial reference point as possible.
In Appendix C.4, we visualize howthe attacks of different radii influence the similarity between the adversarial and reference points.
Based on these results, we have chosen the radii which do not allow adversarial points to deviate a lotfrom the reference (as measured by MSSSIM): ∥ ε ∥ inf ≤ 0 .
2 for the MNIST dataset (which goes in 330 line with the previous works [11, 12]) and ∥ ε ∥ inf ≤ 0 .
1 for the CelebA dataset.
[Figure] Number of MCMC steps and Inference Time In our approach,we have to select the number of MCMC steps that the defenderperforms.
This parameter potentially can be critical as it influencesboth the inference time (see Appendix C.7) and the performance(see Appendix C.5).
In Figure 5 we show the trade-off between thereconstruction similarity and the inference time.
The increase in theinference time is cause by a larger number of HMC steps used (weconsider 0, 100, 500 and 1000 steps for this experiment).
Conclusion
In this work, we explore the robustness of VAEs to adversarial attacks.
We propose a theoreticallyjustified method that allows alleviating the effect of attacks on the latent representations by improvingthe reconstructions of the adversarial inputs and the downstream tasks accuracy.
We experimentallyvalidate our approach on a variety of datasets: both grey-scale (MNIST, Fashion MNIST) and colored(ColorMNIST, CelebA) data.
We show that the proposed method improves the robustness of thevanilla VAE models and its various modifications, i.e [Table]
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]2.
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes] See Section 3(b) Did you include complete proofs of all theoretical results?
[Yes] See Section 3 andAppendix A
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e
g., data splits, hyperparameters,
how they
were chosen)?
[Yes] See Appendix D
(c) Did you report error bars (e
g., with respect to the random seed after running experi-
ments multiple times)?
[Yes]
(d) Did you include the total amount of compute and the type of resources used (e
g., type
of GPUs, internal cluster, or cloud provider)?
[No]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes] We use NVAE code
and pretrained that are published on github
(b) Did you mention the license of the assets?
[Yes] The licence allows using code for
non-commercial purposes
(c) Did you include any new assets either in the supplemental material or as a URL?
[N/A]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[N/A]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[N/A]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review
Board (IRB) approvals, if applicable?
[N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount
spent on participant compensation?
[N/A]
A Theory
We consider an attack, which has an additive structure:
[Equation]
11) such that ∥ ε ∥ ≤
[Equation]
12) where δ is a radius of the attack.
In the vanilla VAE setup we will get the latent code by sampling from q ϕ ( z | x ) .
With our approach,instead, we get a sample from the following distribution:
[Equation]
13) where Q ( t ) ( z | z 0 ) is a transition kernel of MCMC with the target distribution π ( z )
=
p θ ( z | x ) ∝p
θ ( x | z ) p ( z ) .
Lemma 1 Consider true posterior distributions of the latent code z for a data point x and itscorrupted version x a .
Assume also that ln p θ ( z | x ) is differentiable at the point x = x r .
Then
the
KL-divergence between these two posteriors could be expressed using the small o notation of theradius of the attack, namely:
[Equation]
Proof
Let us use definition of the KL-divergence:
[Equation]
Let us introduce ln p θ ( z | x )
=
g ( x , z ) .
Assume that this function is differentiable at x = x r .
Then,we can apply Taylor expansion to g ( x , z ) in the point x r which yields:
[Equation]
∥ x − x r ∥ ) .
Then, the log-ratio of two distributions is the following:
[Equation]
[Equation]
Notice that ε T ∇ x g ( x , z ) (cid:12)(cid:12)(cid:12) x r is the dot product between ε and ∇ x g ( x , z ) (cid:12)(cid:12)(cid:12) x r , i.e., ε T ∇ x g ( x , z )
[Equation]
x r =⟨ ε, ∇ x g ( x , z ) (cid:12) (cid:12)(cid:12) x r ⟩ .
We can now plug this into the KL-divergence definition (15):
[Equation] [Equation]
Let us take a closer to look at the term A ( x r ) in the equation above:
[Equation]
where we use Bayes rule in 23, 26, log-derivative trick in 25.
We have shown that A ( x r ) = 0 , therefore, from equation 21 we have:
[Equation]
■
Lemma 2 The Total Variation distance (TV) between the variational posterior with MCMC for agiven corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for a given data point x r , q ϕ ( z | x r ) ,can be upper bounded by the sum of the following three components:
[Equation]
Proof
Total variation is a proper distance, thus, the triangular inequality holds for it.
For the proof, we applythe triangular inequality twice.
First, we use the triangle inequality for TV
[Equation]
,namely:
[Equation]
Second, we utilize the triangle inequality for TV
[Equation]
, that is:
[Equation]
Combining the two gives us the following upper bound on the initial total variation:
[Equation]
Moreover, the Total Variation distance is a lower bound of the KL-divergence (by Pinsker inequality):
[Equation]
Applying Pinsker inequality to 37 and 38 yields:
[Equation]
■
Theorem
The upper bound on the total variation distance between samples from MCMC for agiven corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for the given real point x , q ϕ ( z | x ) ,is the following:
[Equation]
Proof
Combining Lemma 1 and 2 we get:
TV
[Equation]
Lemma
TV
[Equation]
Note that
[Equation]
that gives us the final expression:
TV
[Equation]
B Background on MCMC
B.1 Sampling from an unnormalized density with MCMC
Markov Chain Monte Carlo (MCMC) is a class of methods that are used to obtain samples fromthe density p ( v ) (also referred to as target ), which is only known up to a normalizing constant.
That is, we have access to ˜ p ( v ) , such that p ( v ) =
˜ p ( v ) Z and Z is a typically unknown and hard toestimate normalizing constant.
Thus, we construct a Markov Chain with samples { v ( t ) }
Tt =
so thatthey mimic the samples from p ( v ) .
To ensure they are proper samples, the stationary distribution ofthe constructed Markov Chain should be the target distribution p ( v ) .
The most popular way of constructing such Markov Chains is the Metropolis-Hastings (MH) method.
The majority of the MCMC methods used in practice can be formulated as a special case of the MH[2].
In the MH method, we introduce a proposal distribution q ( v t +1 | v t ) to obtain a new sample andthen accept it with the following probability:
[Equation]
If the point is not accepted, we reuse the previous point, i.e., v t
[Equation]
1 = v t .
It can be proven that theresulting chain of correlated samples converges in the distribution to the target density [2].
It is worth mentioning that the performance of the method strongly depends on the choice of theproposal distribution.
In higher dimensional spaces, it is especially important to incorporate theinformation about the geometry of the target distribution into the proposal density to improve theconvergence time.
The Hamiltonian Monte-Carlo (HMC) [29] is known to be one of the most efficient
MCMC methods.
It uses gradient of a target distribution in the proposal to incorporate the informationabout the geometry of the space.
The idea of the HMC is to introduce an auxiliary variable p with a known density (usually assumedto be the standard Gaussian) and the joint distribution formulated as follows:
[Equation] [Equation]
with:
[Equation]
We obtain samples ( v , p ) using the Hamiltonian dynamics [29] that describes how the v and pchange over time for the given Hamiltonian H ( v , p ) =
U ( v ) + K ( p ) , namely:
[Equation]
[Equation]
For the practical implementation, these continuous-time equations are approximated by discretizingthe time using L small steps of size η .
The discretization method that is often used is called theleapfrog .
B.2 The MCMC used in this paper
In this paper, we use the MCMC to sample from the posterior distribution p θ ( z | x a ) .
That is, in ourcase v = z and ˜ p
( v ) =
p θ ( x a | z ) p ( z ) .
The HMC is a widely applied method to sampling from anunknown posterior distribution in deep learning in general [22] and in VAEs specifically [33, 34].
This default implementation is only compatible with the continuous latent space.
A possible extension to discrete latent spaces Some VAEs operate on discrete latent spaces, avery popular example would be a VQ-VAE [38].
However, the classical HMC that we use in ourexperiments is not able to sample from a discrete distribution.
Therefore, other MCMC methodsshould be used in this case, such as population-based MCMC [4], modifications of HMC[30] or
Langevin Dynamics [42].
B.3 Mode optimization
In this work we hypothesise that adversarial attacks move latent codes to the region of low probabilityand we use HMC to get a sample from the high posterior probability region.
However, anotherstrategy can be to find the posterior mode instead. Here we explain, what was our motivation to notuse this approach. Posterior modes similarity Ideally, we would like to obtain a sample from the variational posteriorq ϕ ( z | x r ) , because our decoder was trained to produce reconstructions from such latent codes.
At thesame time, VAE was trained to match this variational posterior to the true one p θ ( z | x r ) .
However,both these distributions are not available to us, since we observe attacked point x a instead of thereference x r .
Instead, we sample from p θ ( z | x a ) and show theoretically that the resulting samples are close (interms of total variation distance) to the "goal" ones.
However, that does guarantee that their modesare the same.
Therefore, obtaining the mode of p θ ( z | x a ) is not necessarily a mode of q ϕ ( z | x r ) .
Thus,the fact that the HMC allows us to “wander” around that mode may be beneficial.
Concentration of measure During reconstruction, we get a sample from q ( z | x ) and pass it to thedecoder, thus, a mode can actually be a bad latent code for these purposes.
Instead, ideally, we wantto get a sample from the typical set where most of the probability mass is concentrated.
In theory, the
HMC allows us to do that.
Randomness The HMC adds a source of randomness to our defence strategy that potentially makesit harder to attack.
{+This is supported by our experiment in Section 4.
+}
C Additional resultsC.1 Posterior ratio
We motivate our method by the hypothesis that the adversarial attack "shifts" a latent code to theregion of a lower posterior density, while our approach moves it back to a high posterior probabilityregion.
In Section 3 we theoretically justify our hypothesis, while here we provide an additionalempirical evidence.
In order to verify our claim that applying an MCMC method allows us to counteract attacks bymoving a latent code from a region of a lower posterior probability mass to a region of a higherdensity, we propose to quantify this effect by measuring the ratio of posteriors for z 1 and z 2 .
Thetrue posterior p ( z | x r ) is not available due to the cumbersome marginal distribution p ( x r ) , however,we can calculate the ratio of posteriors because the marginal will cancel out, namely:
[Equation]
[Equation]
In our case, we are interested in calculating the posterior ratio between the reference and adversariallatent codes ( z 1 =
z r , z 2 =
z a ) as the baseline, and the posterior ratio between the reference andadversarial code after applying the HMC ( z 1 = z r , z 2 =
z a HMC ).
The lower the posterior ratio,the better.
For practical reasons, we use the logarithm of the posterior ratio (the logarithm does notchange the monotonicity and turns products to sums):
[Equation]
We present results on the log-posterior-ratio calculated on the MNIST dataset.
In Figure 6 we show aplot with two histograms: one with the posterior ratio between the reference and adversarial latentcodes ( z 1 = z r , z 2 =
z a ) in blue, and the second histogram of the posterior ratio between thereference and adversarial code after applying the HMC ( z 1 =
z r , z 2 =
z a HMC ) in orange.
We observe that the histogram has moved to the left after applying the HMC.
This indicates thatposterior of the adversarial (in the denominator) is increasing when the HMC is used.
This is preciselythe effect we hoped for and this result provides an empirical evidence in favor of our hypothesis.
[Figure]
[Equation]
Experimental Details For this experiment we construct 500 adversarial attacks with the radius0.1 on the encoder of the VAE trained on MNIST dataset.
We run 500 HMC steps with the samehyperparameters as mentioned in Table 8 to obtain z aHMC .
Statistical Analisys We performed a two-sample Kolmagorov-Smirnov test with the null hypothesisthat two histograms are drawn from the same distribution.
As an alternative hypothesis is that theunderlying distributions are different.
Choosing the confidence level of 95% results in the rejectionof the null hypothesis (p-value is equal to 0.029) in favour of the alternative: two histograms werenot drawn from the same distribution.
C.2 Detailed results for β -VAE and β -TCVAE
In this section we report extended results for MNIST, FashionMNIST and ColorMNIST datasets.
We train VAE, β -VAE and β -TCVAE on three datasets: MNIST, FashionMNIST and ColorMNIST.
Then, we compare the robustness to adversarial attack with and without HMC.
We present all theresult with the standard error in Table 4 .
On Figures 7, 8 we show visually how HMC improve therobustness for each dataset and model.
[Table]
[Figure]
[Figure] [Equation] [Figure] [Equation]
[Figure]
[Equation]
C.3 What if the attacker knows the defence strategy?
In our experiments we relied on the assumption that attack does not take into account the defencestrategy that we use.
We believe that it is reasonable, since defence requires access to the decoderpart of the model ( p θ ( x | z ) ), which is not necessarily available to the attacker.
However, one may assume that the defence strategy is known to the attacker.
In this case, it isreasonable to verify whether the robustness results change.
In the conducted experiment we showthat it is vastly more complicated to attack the encoder with taking the MCMC defence into account.
We train the unsupervised attack (3).
The attack has access to the encoder and MCMC defence:
[Equation]
Then, given the attack radius δ , we train the attack using the following objective:
[Equation]
The similarity results of these attacks are plotted in Figure 10.
We observe that the reconstructedreference and adversarial points have approximately the same similarity (measured by MSSSIM) asthe initial points x r and x a , which indicates that the attacks were unsuccessful.
However, if we use the same objective, but omit the MCMC step (e.g t = 0 in eq. 62 and 63), then,as observed in Figure 9, the attack becomes much more successful (Figure 9 (a)), but we can fix itwith the proposed defence (Figure 9 (b)).
It is interesting to compare how the attacked points look in both cases, especially as we increasethe radius of the attack.
In Figure 11, we plot attack on two reference points for radius values in{ 0 . 1 , 0 . 6 , 0 . 8 , 1 . 0 } .
When the attacker does not use MCMC (left), it just learns to add more and morenoise to the image, which eventually makes it meaningless.
When we use MCMC during an attack, the situation is different.
The adversarial input is almostindistinguishable from the reference point for a small radius.
After each gradient update, the attackerruns a new MCMC, which moves point closer to the region of high posterior probability, but mayfollow a different trajectory every time.
Eventually, it makes it harder to learn an additive perturbationε .
However, as we increase the attack radius, we observe a very interesting effect.
Instead ofmeaningless noise, the attacker learns to change the digit.
For instance, we see how 4 is transformedinto 0 in the first example and into 9 in the second.
This way, the attacker ensures that the MCMCwill move the latent far away from the reference latent code, which now has a different posteriordistribution.
[Figure]
SSS
[Figure]
M [ x r ,x a ] [ e x r , e x a ]
[Figure]
[Figure]
Attack radius 0 .0 .0 .1 .
{+MSSSIM [ x r ,x a ] [ e x r , e x a ] 0 .0 .0 .0 .1 . 
 Attack radius 0 .0 .0 .1 . M SSS I+}
M [ x r ,x a ] [ e x r , e x a ] [Figure] [Figure] (cid:101)
[Figure]
(cid:101)
[Figure]
(cid:101)
[Figure] (cid:101) [Figure] C.
Which attack radius should be considered?
In out experiments, we use attacks with the radius 0 . 1 and 0 .
2 for all the models except for CelebAdataset, where radii 0 .
05 and 0 .
1 were considered.
Here, we provide additional experiment to justifythis choice.
In Figure 12 (a) we show the similarity between the reference point and the adversarialpoint.
We observe that for CelebA the similarity drops faster than for the MNIST.
Further, if we lookat the example plotted in Figure 13, we can clearly notice that with the radius 0 .
2 CelebA image isalready containing a lot of noise.
At the same time, we observe (Figure 12 (b)) that reconstructionsimilarity, which indicates the success of the attack, drops relatively fast when the radius of the attackincreases.
[Figure] [Figure]
Figure
C.5 How many HMC steps are required for a defence?
One of the main hyperparameters of the proposed approach is number of steps of MCMC that thedefender does.
We have conducted experiments with MNIST and Color MNSIT dataset to see howthe robustness metrics change when we increase number of HMC steps from 0 to 200.
As we cansee from the Figure 14, there is always a considerable jump between 0 steps (no defence) and 100steps (lowest number of steps considered).
However, as we continue making steps, we do not observefurther improvement of the metrics.
[Figure]
Accuracy p (y | z a ) ↓
[Figure]
C.6 Comparison of objective functions
This section compares different objective functions that can be used to construct adversarial attackson VAE.
In general, in both supervised and unsupervised setting, we need to measure the differencebetween variational posterior in the adversarial point q
( z | x a ) and a point from the dataset (either atarget or reference point).
We consider a Gaussian encoder, and the simplest way to compare two
Gaussian distributions is to measure the distance between their means.
To take into account thevariances, we can use the KL-divergence.
It is a non-symmetric metric.
Thus, we have two options: touse the forward or reverse KL.
Finally, it is also possible to consider the symmetrical KL divergencethat is an average between the two.
[Figure]
[Table]
[Figure]
[Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure]
In Figure 15, we measure how successful the attacks are in terms of the proposed metrics.
We usearrows in the plot titles to indicate desirable values of the metric for a successful attack.
We comparesupervised and unsupervised attacks on VAE trained on MNIST and fashion MNIST datasets.
Weobserve that there is no single objective function that consistently outperforms others.
C.7 Inference Time
Even though our approach does not require changing the training procedure, it has influence onthe inference time.
In practice, this can be a limiting factor.
Therefore, in Table 5 we report thecomputational overhead during the inference time.
We measure the inference time in seconds per testpoint without HMC ( T = 0 ) and for different budgets ( T = { 100 , 500 , 1000 } ).
[Table]
D Details of the experiments
D.1 Training VAE models
Architecture We use the same fully convolutional architecture with latent dimension 64 for MNIST,
FashionMNISt and ColorMNIST datasets.
In Table 6, we provide detailed scheme of the architecture.
We use Conv(3x3, 1->32) to denote convolution with kernel size 3x3 , 1 input channel and 32output channels.
We denote stride of the convolution with s , padding with p and dilation with d . [Table]
The same notation applied for the transposed convolutions ( ConvTranspose ).
ColorMNIST has 3input channels, so the first convolutional layer in the encoder and the last of the decoder are slightlydifferent.
In this cases values for ColorMNIST are report in parenthesis with the red color.
[Table]
[Table] ->1(3),s=2,p=1) log σ 2 z ← Conv(3x3,128->64,s=2,p=1) µ x ← Sigmoid() ( Identity() )
Optimization We use Adam to perform the optimization.
We start from the learning rate 5 e − 4and reduce it by the factor of 2 if the validation loss does not decrease for 10 epochs.
We train amodel for 300 epochs with the batch size 128.
In Table 7, we report the values of the test metrics for
VAEs trained on MNIST, Fashion MNIST and Color MNIST.
For calculating the FID score, we use torchmetrics library: https://torchmetrics.readthedocs.io/en/latest/references/modules.html#frechetinceptiondistance .
[Table]
[Table] [Table]
[Table]
D.2 Adversarial Attacks and Defence Hyperparameters
In Table 8, we report all the hyperparameter values that were used to attack and defend VAE models.
In all the experiments we randomly select reference points from the test dataset.
We also ensure thatthe resulting samples are properly stratified — include an even number of points from each of theclasses.
For each reference point, we train 10 adversarial inputs with the same objective function butdifferent initialization.
We use projected gradient descent to learn the adversarial attacks.
Optimization parameters were thesame for all the datasets and models.
They are presented in Table 8.
We choose HMC to defend the model against the trained attack.
We perform T steps of HMC withthe step size η and L leapfrog steps.
Where indicated, we adapt the step size after each step of HMCusing the following formula:
[Equation]
(64) where α t is the acceptance rate at step t .
This way we increase the step size if the acceptance rate ishigher than 90% and decrease it otherwise.
When adaptive steps size is used, a value in the tableindicates the η 0 .
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure]