Alleviating Adversarial Attacks on Variational Autoencoders with MCMC
Abstract
Variational autoencoders (VAEs) are latent variable models that can generate complex objects and provide meaningful latent representations.
Moreover, they could be further used in downstream tasks such as classification.
As previous work has shown, one can easily fool VAEs to produce unexpected latent representations and reconstructions for a visually slightly modified input.
Here, we examine several objective functions for adversarial attack construction proposed previously and present a solution to alleviate the effect of these attacks.
Our method utilizes the
Markov Chain Monte Carlo (MCMC) technique in the inference step that we motivate with a theoretical analysis.
Thus, we do not incorporate any extra costs during training, and the performance on non-attacked inputs is not decreased.
We validate our approach on a variety of datasets (MNIST, Fashion MNIST, Color MNIST,
CelebA) and VAE configurations ( β -VAE, NVAE, β -TCVAE), and show that our approach consistently improves the model robustness to adversarial attacks.
Introduction
Variational Autoencoders (VAEs) [27, 34] are latent variable models parameterized by deep neural networks and trained with variational inference.
Recently, it has been shown that VAEs with hierarchical structures of latent variables [33], coupled with skip-connections [30, 37] can generate high-quality images [15, 39].
An interesting trait of VAEs is that they allow learning meaningful latent space that could be further used in downstream tasks [7, 22].
These successes of VAEs motivate us to explore the robustness of the resulting latent representations to better understand the capabilities and potential vulnerabilities of VAEs.
Here, we focus on adversarial attacks on VAEs to verify robustness of latent representations that is especially important in such applications as anomaly detection [1, 30] or data compression [5, 20].
The main questions about adversarial attacks for VAEs are mainly focused on how they could be formulated and alleviated.
In [18], it is proposed to minimize the KL-divergence between an adversarial input and a target input to learn an adversarial attack for the vanilla VAE.
Further, in [28], it is shown that a similar strategy can be used to attack hierarchical VAEs.
To counteract the adversarial attacks, the authors of [42] suggest using a modified VAE objective, namely, β -TCVAE, that increases VAE robustness, especially when coupled with a hierarchical structure.
It was shown in [10] that β -VAEs tend to be more robust to adversarial attacks in terms of the r -metric proposed therein.
The authors of [6] presented that the adversarial robustness can be achieved by constraining the Lipschitz constant of the encoder and the decoder.
[12, 13] introduced modifications in the VAE framework that allow for better robustness against the adversarial attacks on downstream classification tasks.
In our work, we consider β -VAE, β -TCVAE and a hierarchical VAE, and outline a defence strategy that improves robustness to attacks on the encoder and the downstream classification task.
The proposed method is applied during inference and, therefore, can be combined with other known techniques to get more robust latent representations.
[Figure] [Figure]
(cid:101) point latent space but able to them closer the initial position (cid:101) aHMC (cid:101) x
An adversarial attack on a VAE is usually formulated as an additive perturbation ε of the real data point x r so that the resulting point is perceived by a model as if it is a totally different image (either during reconstruction or in the downstream classification task)
In
Figure 1, we depict an example of an attack on the encoder. The reference point x r and the adversarial point x a are almost indistinguishable, but they are encoded into different regions in the latent space.
As a result, their reconstructions also differ significantly.
In this paper, we propose the method motivated by the following hypothesis: An adversarial attack maps the input to a latent region with a lower probability mass assigned by the true posterior (proportional to the conditional likelihood times the marginal over latents) and, eventually, we obtain incorrect reconstructions .
Therefore, a potential manner to alleviate the effect of an attack may rely on running a Markov chain to move the latent representation back to a more probable latent region.
Such a defence is reasonable because we do not modify the training procedure or the model itself, we only insert a correction procedure.
As a result, we propose to counteract adversarial attacks by enhancing the variational inference with Markov Chain Monte Carlo (MCMC) sampling.
The illustrative example depicted in the Figure 1 shows that the latent code of the adversarial input (red circle) moves closer to the latent code of the reference point (orange circle) after applying the MCMC (purple circle).
The contribution of this work is the following:
• We propose to use an MCMC technique during inference to correct adversarial attacks on VAEs.
• We show theoretically that the application of an MCMC technique could indeed help to counteract adversarial attacks (Theorem 1). • We indicate empirically that the previously proposed strategies to counteract adversarial attacks do not generalize well across various datasets.
• We show empirically that the proposed approach (i
e., a VAE with an MCMC during inference) outperforms all baselines by a significant margin.
Background 2.1 Variational Autoencoders
Let us consider a vector of observable random variables, x ∈ X D
(e.g., X = R ) sampled from the empirical distribution p e ( x ) , and vectors of latent variables z k ∈ R M k , k = 1 , 2 , . .
, K , where M k is the dimensionality of each latent vector.
First, we focus on a model with K = 1 and the joint distribution p θ ( x , z ) =
p θ ( x | z ) p ( z ) .
The marginal likelihood is then equal to p θ ( x ) =
(cid:82) p θ ( x , z )d z .
VAEs exploit variational inference [25] with a family of variational posteriors { q ϕ ( z | x ) } , also referred to as encoders, that results in a tractable objective function, i.e., the Evidence Lower BOund (ELBO):
[Equation]
β -VAE [21] uses a modified objective by weighting the D KL term by β > 0 .
In the case of
K > 1 , we consider a hierarchical latent structure with the generative model of the following form:
[Equation]
[Table]
of the family of variational posteriors
However [Table] here we follow the proposition of [37] with the autoregressive inference model, namely, q ϕ ( z 1 , . .
z K | x ) =
q ϕ ( z K | x ) (cid:81)
[Table]
ϕ ( z k | z >k , x ) .
This formulation was used, among others, in NVAE [39].
Because of the top-down structure, it allows sharing data-dependent information between the inference model and the generative model
[Table]
2.2 Adversarial attacks
An adversarial attack is a slightly deformed data point that results in an undesired or unpredictable performance of a model [19].
In this work, we focus on the attacks that are constructed as an additive perturbation of the real data point x r (which we will refer to as reference ), namely:
[Equation]
where δ is the radius of the attack.
The additive perturbation ε is chosen in such a way that the attacked point does not differ from the reference point too much in a sense of a given similarity measure.
It is a solution to an optimization problem solved by the attacker.
The optimization problem could be formulated in various manners by optimizing different objectives and by having specific constraints and/or assumptions.
Attack construction Let f ( x ) be part of the model available to the attacker.
In the case of VAEs, this, for example, may be an encoder network or an encoder with the downstream classifier in the latent space.
The attacker uses a similarity measure ∆ to learn an additive perturbation to a reference point.
We consider two settings: unsupervised and supervised .
In the former case, the perturbation is supposed to incur the largest possible change in f :
[Equation]
The latter setting requires a target point x t .
The perturbation attempts to match the output for the target and the attacked points, namely:
[Equation]
There are different ways to select f and ∆ in the literature.
Furthermore, different L p -norms can be used to restrict the radius of the attack.
Table 1 summarizes recent work on the topic.
In this work, we focus on attacking the encoder and the downstream classification task using unsupervised adversarial attacks.
In the former, we maximize the symmetric KL-divergence to get the point with the most unexpected latent code and, therefore, the reconstruction.
In the latter, the latent code is passed to a classifier.
The attack is trained to change the class of the point by maximizing the cross-entropy loss.
However, the method we propose in Section 3 is not limited to these setups since it is agnostic to how the attack was trained.
Robustness measures To measure the robustness of the VAE as well as the success of the proposed defence strategy, we focus on two metrics: MSSSIM and Adversarial accuracy.
For latent space attacks we follow [28] in using Multi-Scale Structural Similarity Index Measure ( MSSSIM ) [41].
We calculate MSSSIM[ (cid:101) x r , (cid:101) x a ] , i.e., the similarity between reconstructions of x r and the corresponding x a .
We do not report the similarity between a reference and the corresponding adversarial input, since this value is the same for all the considered models (for a given attack radius).
A successful adversarial attack would have a small value of MSSSIM[ (cid:101) x r , (cid:101) x a ] .
For the attacks on the downstream classifier, we follow [12, 13] and calculate the adversarial accuracy.
For a given trained VAE model, we first train a linear classifier using latent codes as features.
Afterwards, the attack is trained to fool the classifier.
Adversarial accuracy is the proportion of points for which the attack was unsuccessful.
Namely, when the predicted class of the reference and corresponding adversarial point are the same.
Preventing adversarial attacks with MCMC
Assumptions and the hypothesis We consider a scenario in which an attacker has access to the
VAE encoder and, where relevant, to the downstream classification model.
Above, we presented in detail how an attack could be performed.
We assume that the defender cannot modify these components, but it is possible to add elements that the attacker has no access to.
We hypothesize that the adversarial attacks result in incorrect reconstructions because the latent representation of the adversarial input lands in a region with a lower probability mass assigned by the true posterior.
This motivates us to use a method which brings the latents "back" to a highly probable region as a potential defence strategy.
Since the adversarial attack destroys the input irreversibly, at the first sight it seems impossible to reconstruct the latent representation of the reference point.
We aim at showing that this is possible to some degree theoretically and empirically (Appendix C.1).
The proposed solution
In order to steer the latents towards high probability regions, we propose to utilize an MCMC method during inference time.
Since we are not allowed to modify the VAE or its learning procedure, this is a reasonable procedure from the defender’s perspective.
Another positive outcome of such an approach is that in a case of no attack, the latents given by the MCMC sampling will be closer to the mean of the posterior, thus, the reconstruction should be sharper or, at least, not worse.
Note that the variational posterior approximates the true posterior from which the MCMC procedure samples.
We propose to sample from q ( t ) ( z | x ) =
[Equation]
where Q ( t ) ( z | z 0 ) is a transition kernel of MCMC with t steps and the target distribution π ( z )
=
p θ ( z | x ) ∝ p θ ( x | z ) p ( z ) .
Alternatively, we can use optimization to find the mode of the posterior, however, MCMC can add extra benefits such as exploration of the typical set and randomness (see
Appendix B.3 for details).
To further analyze the proposed approach, we start with showing the following lemma:
Lemma 1 Consider true posterior distributions of the latent code z for a data point x and its corrupted version x a .
Assume also that ln p θ ( z | x ) is twice differentiable over x with continuous derivatives at the neighbourhood around x = x r .
Then the KL-divergence between these two posteriors could be expressed using the small o notation of the radius of the attack, namely:
[Equation]
[Equation]
Proof See Appendix A.
According to Lemma 1, the difference (in the sense of the Kullback-Leibler divergence) between the true posteriors for a data point x and its corrupted version x a decreases faster than the norm of the attack radius.
However, it is important to note that this result is only valid for asymptotically small attack radius.
Next, the crucial step to show is whether we can quantify somehow the difference between the distribution over latents for x a after running MCMC with t steps, q ( t ) ( z | x a ) , and the variational distribution for x r , q ϕ ( z | x r ) .
We provide an important upper-bound for the Total Variation distance (TV) 1 between q ( t ) ( z | x a ) and q ϕ ( z | x r ) in the following lemma
Lemma 2 The Total Variation distance ( TV ) between the variational posterior with MCMC for a given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for a given data point x r , q ϕ ( z | x r ) , can be upper bounded by the sum of the following three components:
[Equation]
Proof See Appendix A
[Equation]
The difference expressed by TV
[Equation]
is thus upper-bounded by the following three components:
• The TV between q ( t ) ( z | x a ) and the real posterior for the corrupted image, p θ ( z | x a ) .
Theoretically, if t → ∞ , q ( ∞ ) ( z | x a ) =
p θ ( z | x a ) and, hence, TV
[Equation]
• The second component is the square root of the KL-divergence between the real posteriors for the image and its corrupted counterpart.
Lemma 1 gives us information about this quantity.
• The last element, the square root of D KL [ q ϕ ( z | x r ) ∥
p θ ( z | x r )] , quantifies the approximation gap [16], i.e., the difference between the best variational posterior from a chosen family, and the true posterior.
This quantity has no direct connection with adversarial attacks.
However, as we can see, using a rich family of variational posteriors can help us to obtain a tighter upper-bound.
In other words, taking flexible variational posteriors allows to counteract attacks.
This finding is in line with the papers that propose to use hierarchical VAEs as the means for preventing adversarial attacks [42].
Eventually, by applying Lemma 1 to Lemma 2, we obtain the following result:
Theorem
The upper bound on the total variation distance between samples from MCMC for a given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for the given real point x r , q ϕ ( z | x r ) , is the following:
[Equation]
Proof See Appendix A.
As discussed already, the first component gets smaller with more steps of the MCMC.
The second component could be treated as a bias of the family of variational posteriors.
Finally, there is the last element that corresponds to a constant error that is unavoidable.
However, this term decays faster than the square root of the attack radius for the asymptotically small attack radius.
Specific implementation of the proposed approach In this paper, we use a specific MCMC method, namely, the Hamiltonian Monte Carlo (HMC) [8, 17].
Once the VAE is trained, the attacker calculates an adversarial point x
a using the encoder of the VAE.
After the attack, the latent representation of x a is calculated, z a , and used as the initialization of the HMC.
In the HMC, the target (unnormalized) distribution is p ( x a | z ) p ( z ) .
The Hamiltonian is then the energy of the joint distribution of z and the auxilary variable p , that is:
[Equation]
When applying the proposed defence to hierarchical models, we update all the latent variables simultaneously.
That is, we have z = { z 1 , . .
, z K } and U ( z )
= − ln p θ ( x a | z ) − (cid:80)
Kk =1 ln p θ ( z k | z k +1 ) .
Input : z , η, L p ∼ N (0 , I ) .
▷ Sample the auxiliary variable z (0) :
=
z , p (0) :
= p .
for l = 1 . . .
, L do ▷ Make L steps of leapfrog .
p ( l ) = p ( l − 1) − η 2 ∇ z U ( z ( l ) ) .
z ( l ) =
z ( l ) + η ∇ p K ( p ( l ) ) .
p ( l ) = p ( l ) − η 2 ∇ z U ( z ( l ) ) .
end for ▷ Accept new point with prob.
α .
α = min (cid:0) 1 , exp (cid:0) − H ( z ( L ) , p ( L ) )
+ H ( z (0) , p (0) )
(cid:1)(cid:1)
z = (cid:26) z ( L ) with probability α, z (0) otherwise .
Return : z
Eventually, the resulting latents from the
HMC are decoded.
The steps of the whole process are presented below: given calculate the attack x a using the criterion equation 3 or equation 4.
( Defender ) Initialize the latent code z := z 0 , where z 0 ∼ q ϕ
Then, run T steps of HMC (Algorithm 1) with the step size η and L leapfrog steps.
The resulting latent code z can be passed to the decoder to get a reconstruction or to the downstream classification task.
Experiments 4.1 Posterior ratio
[Figure] We motivate our method by the hypothesis that the adversarial attack "shifts" a latent code to the region of a lower posterior density, while our approach moves it back to a high posterior probability region. In Section 3 we theoretically justify our hypothesis, while here we provide an additional empirical evidence.
The true posterior p ( z | x r ) is not available due to the cumbersome marginal distribution p ( x r ) , however, we can calculate the ratio of posteriors because the marginal will cancel out.
In our case, we are interested in calculating the posterior ratio between the reference and adversarial latent codes ( z 1 = z r , z 2 = z a ) as the baseline, and the posterior ratio between the reference and adversarial code after applying the HMC ( z 1 = z r , z 2 = z a HMC ).
The lower the posterior ratio, the better.
For practical reasons, we use the logarithm of the posterior ratio since the logarithm does not change the monotonicity and turns products to sums:
[Equation]
In Figure 2 we show a plot with two histograms: one with the posterior ratio between the reference and adversarial latent codes ( z 1 = z r , z 2 = z a ) in blue, and the second histogram of the posterior ratio between the reference and adversarial code after applying the HMC ( z 1 = z r , z 2 = z a HMC ) in orange.
We observe that the histogram has moved to the left after applying the HMC.
This indicates that posterior of the adversarial (in the denominator) is increasing when the HMC is used. This is precisely the effect we hoped for and this result provides an empirical evidence in favor of our hypothesis. For more details see C.1.
All implementation details and hyperparameters are included in the Appendix D and code repository 2 . Datasets VAEs are trained on the MNIST, Fashion MNIST [44] and Color MNIST datasets. Following [13], we construct the Color MNIST dataset from MNIST by artificially coloring each image with seven colors (all corners of RGB cube except for black).
[Figure]
Models We train vanilla fully convolutional VAEs, as well as β -VAE [21] and β -TCVAE [14, 26].
Both β -VAE and βTCVAE modify the ELBO objective to encourage disentanglement.
β -VAE weighs the KL-term in the ELBO with β > 0 .
It is said that the larger values of β encourage disentangling of latent representations [14] and improve the model robustness as observed by [10].
β -TCVAE puts a higher weight on the total correlation (TC) term of the ELBO.
Penalization of the total correlation was shown to increase the robustness of VAE adversarial attacks [42].
In Appendix D.1 we provide details of the architecture, optimization, and results on the test dataset for VAE trained with different values of β .
We note that the optimal value in terms of the negative loglikelihood (NLL) is always β = 1 .
Larger values of β are supposed to improve robustness in exchange for the reconstruction quality.
When evaluating the robustness of β -VAE and β -TCVAE, we train models with β ∈ { 2 , 5 , 10 } .
Then, we select the value of β that provides the most robust model in terms of the used metric.
Next, we apply our defence strategy to this model to observe the potential performance improvement.
Our implementation
[Table]
Attacks on the Encoder In the first setup, we assume that the attacker has access to the encoder of the model q ϕ ( z | x ) [6, 18, 42].
We use the projected gradient descent (PGD) with 50 steps to maximize the symmetric KL-divergence in the unsupervised setting (equation 3).
We train 10 adversarial attacks (with different random initialization) for each of 50 reference points.
See Appendix D.2 for the details.
We report similarity between the reconstruction of the adversarial and reference point as a measure of the robustness (see Section 2.2). Our [Table] Values
[Table] in [12], VAE implementation and evaluation protocol may [Table] Attacks on the downstream task In this setup, we examine how the proposed approach can aleviate the effect of the attack on the downstream tasks in the latent space.
For this purpose, we follow the procedure from [12, 13].
Once the VAE is trained, we learn a linear classifier using the mean mappings as features.
For the MNIST and Fashion MNIST datasets, we have the 10class classification problem (digits in the former and pieces of clothing in the latter case).
For the
ColorMNIST dataset, we consider two classification tasks: the digit classification (10 classes), and the color classification (7 classes).
We construct the attack to fool the classifier.
See Appendix D. for the details.
Results In Tables 2 and 3, we compare our method (VAE + HMC) with the vanilla VAE with other methods in the literature.
We report more results and the extended comparison in the Appendix
C.2 where we show that our method combined with β -VAE and β -TCVAE leads to the increased robustness.
For MNIST and Fashion MNIST (Table 2), we observe that the vanilla VAE with the
HMC is more robust than β -VAE and β -TCVAE.
The latter model was shown to be more robust to the latent space attack [42].
Still, in our experiments (on different datasets), we could not observe the consistent improvement over the vanilla VAE, when using it with a single level of latent variables.
In Table 3 we report the result on the ColorMNIST dataset.
Here, we additionally compare the adversarial accuracy for our method with the Smooth Encoders (SE) and Autoencoding Variational
Autoencoder (AVAE) methods [12, 13].
We notice that these methods provide higher adversarial accuracy.
However, we have also observed a large discrepancy in terms of the MSE and FID scores of the model itself compared to our experiments, which we suspect might be a result of a mistake in [12, 13].
Lastly, we would like to highlight that our defence strategy can be also combined with all the above VAE modifications.
One advantage of our approach is that it does not require changing the training procedure of a VAE and, as a result, it does not decrease the quality of the generated images.
Moreover, we can apply the same procedure to reconstruct the non-corrupted points and it will improve the reconstruction error.
This result can be seen in the Tables 2 and 3 and it goes in line with the results of the [36], where MCMC was used to improve the VAE performance. 4.3 Hierarchical VAE: NVAE Model and datasets In this section, we explore the robustness of the deep hierarchical VAE (NVAE) [39], a specific implementation of a hierarchical VAE that works well for high-dimensional data.
We attack models trained on MNIST and CelebA [29] datasets.
We use the weights of the pre-trained model provided in the official NVAE implementation 4 .
Attacks construction Following [28] we construct adversarial attacks on the hierarchical
VAE by considering higher-level latent variables.
That being said, we use latent variables
8 k A 0 .0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
NVAE+HMC NVAE   8 k A 0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
NVAE+HMC NVAE
10 k A 0 .0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
10 k A 0 .0 .0 .0 .
M SSS
I M [ e x r , e x a ] || ε || inf = 0 .
[Figure]
[Figure]
M
SSS
I M [ [Figure]
[ e
[Figure] e [Figure] { z L − k A ,
z L − k A +1 , . . .
, z L } when constructing an attack (equation 3).
Otherwise, we follow the same procedure we used for VAEs with a single level of latent variables.
We assume that the attacker has access to the model’s encoder and uses the symmetric KL-divergence as the objective.
The radius of an attack is measured with the L inf norm.
For optimization, we use the projected gradient descent with the number of iterations limited to 50 per point.
Further details are reported in the Appendix
D.2.
Results In Figure 4, we present reconstruction similarity of the reference and adversarial points for both datasets.
We observe that the proposed method consistently improves the robustness of the model to the adversarial attack.
This result is in line with our theoretical considerations where a flexible class of variational posteriors could help to counteract adversarial attacks and, eventually, deacrease the bias of the class of models measured in terms of the KL-divergence.
Additionally, applying the MCMC can further help us to counteract the attack.
In Figure 3 (the two bottom rows), we show how an adversarial point (c) is reconstructed without any defence (d) and with the proposed defence (e).
In the depicted samples, we have used the top 10 latent variables ( k A = 10 ) to construct the attack with a radius of 0.05.
4.4 Ablation Study: What if the attacker knows the defence strategy?
In our experiments, we rely on the assumption that the attacker does not take into account the defence strategy that we use.
We believe that it is reasonable, since the defence requires access to the decoder part of the model, p θ ( x | z ) , which is not necessarily available to the attacker.
[-I M [ x r ,x a ] [ e x r , e x a ] 0 .0 .0 .0 .1 . 
-]
In this ablation study we verify how the robustness results change if we construct the attack with the access to the defence strategy.
We train an adversarial attack with the modified objective 3, which takes into account the HMC step.
See Appendix C.3 for more details on the experimental setup.
In Figure 5 we show the experiment results for various attack radii between 0 and 1.
We observe that constructing an attack with such an objective is much harder (Figure
Discussion
Following the previous works on attacking VAEs [6, 10, 12, 13, 18, 42], we only consider the projected gradient descent as a way to construct the attack.
However, more sophisticated adaptive methods [3, 38] were proposed to attack discriminative model and can be potentially applied to VAEs as well.
We believe that it is an interesting direction for the future work.
Objective Function For the unsupervised attack on the encoder, we use the symmetric KLdivergence to measure the dissimilarity.
However, other options are possible, e.g., the forward or reverse KL-divergence or even L 2 distance between the means (see Table 1).
In our comparative experiments (see Appendix C.6), we observe that no single objective consistently performs better than others.
Attack radius During the attack construction we seek to obtain a point that will have the most different latent representation or a different predicted class.
However, it is also important that the point itself is as similar to the initial reference point as possible.
In Appendix C.4, we visualize how the attacks of different radii influence the similarity between the adversarial and reference points.
Based on these results, we have chosen the radii which do not allow adversarial points to deviate a lot from the reference (as measured by MSSSIM): ∥ ε ∥ inf ≤ 0 .
2 for the MNIST dataset (which goes in line with the previous works [12, 13]) and ∥ ε ∥ inf ≤ 0 .
1 for the CelebA dataset.
[Figure]
Number of MCMC steps and Inference
Time In our approach, we have to select the number of MCMC steps that the defender performs.
This parameter potentially can be critical as it influences both the inference time (see Appendix C.7) and the performance (see Appendix C.5).
In Figure 6 we show the trade-off between the reconstruction similarity and the inference time.
The increase in the inference time is cause by a larger number of HMC steps used (we consider 0, 100, 500 and 1000 steps for this experiment).
Conclusion
In this work, we explore the robustness of VAEs to adversarial attacks.
We propose a theoretically justified method that allows alleviating the effect of attacks on the latent representations by improving the reconstructions of the adversarial inputs and the downstream tasks accuracy.
We experimentally validate our approach on a variety of datasets: both grey-scale (MNIST, Fashion MNIST) and colored (ColorMNIST, CelebA) data.
We show that the proposed method improves the robustness of the vanilla VAE models and its various modifications, i.e., β -VAE, β -TCVAE and NVAE.
Acknowledgements
Anna Kuzina is funded by the Hybrid Intelligence Center, a 10-year programme funded by the Dutch
Ministry of Education, Culture and Science through the Netherlands Organisation for Scientific
Research.
Experiments were carried out on the Dutch national e-infrastructure with the support of
SURF Cooperative
A Theory
We consider an attack, which has an additive structure:
[Equation]
where δ is a radius of the attack.
In the vanilla VAE setup we will get the latent code by sampling from q ϕ ( z | x ) .
With our approach, instead, we get a sample from the following distribution:
[Equation]
where Q ( t ) ( z | z 0 ) is a transition kernel of MCMC with the target distribution
π ( z [Equation] = p
[Equation]
p θ ( x | z ) p ( z ) .
Lemma 1 Consider true posterior distributions of the latent code z for a data point x and its corrupted version x a .
Assume also that ln p θ ( z | x ) is twice differentiable over x with continuous derivatives at the neighbourhood around x = x r .
Then the KL-divergence between these two posteriors could be expressed using the small o notation of the radius of the attack, namely:
[Equation]
Proof
Let us use definition of the KL-divergence:
[Equation]
Let us introduce ln p θ ( z | x )
=
g ( x , z ) .
Assume that this function is differentiable at x = x r .
Then, we can apply Taylor expansion to g ( x , z ) in the point x r which yields: [Equation] [Equation]
The remainder term in the Lagrange form can be written as
[Equation]
[Equation]
Under the assumption that g is twice differentiable with the continuous derivatives on the segment around x = x r the remainder term asymptotically converges to zero with x → x r .
[Equation]
[Equation]
Then, the log-ratio of two distributions is the following:
[Equation]
+ o (
[Equation]
∥
[Equation]
[Equation]
Notice that ε T ∇ x g ( x , z ) (cid:12)(cid:12) (cid:12) x r is the dot product between ε and ∇ x g ( x , z ) (cid:12)(cid:12) (cid:12) x r , i.e., ε T ∇ x g ( x
[Equation]
z ) (cid:12)(cid:12) (cid:12) x r = ⟨ ε, ∇ x g ( x , z ) [Equation] (cid:12) x r ⟩ .
We can now plug this into the KL-divergence definition (16):
[Equation]
{+Note that for (24) to hold we need to make sure that E z R 
+}
=
o ( ∥ ε ∥ ) .
As follows from (18), this requirement is satisfied if E z ∇ 2 xx g ( x + θ ( x − x r ) , z ) is bounded around x = x r .
Let us take a closer to look at the term A ( x r ) in the equation above:
[Equation]
where we use Bayes rule in 26, 29, log-derivative trick in 28.
We have shown that A ( x r ) = 0 , therefore, from equation 24 we have:
[Equation]
33) ■
Lemma 2 The Total Variation distance (TV) between the variational posterior with MCMC for a given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for a given data point x r , q ϕ ( z | x r ) , can be upper bounded by the sum of the following three components:
[Equation]
Proof
Total variation is a proper distance, thus, the triangular inequality holds for it.
For the proof, we apply the triangular inequality twice.
First, we use the triangle inequality for TV
[Equation]
namely:
[Equation]
Second
[Equation]
we utilize the triangle inequality for TV
[Equation]
that is:
[Equation]
Combining the two gives us the following upper bound on the initial total variation:
[Equation]
Moreover
[Equation]
the Total Variation distance is a lower bound of the KL-divergence (by Pinsker inequality):
[Equation]
Applying Pinsker inequality to 40 and 41 yields:
[Equation]
Theorem
The upper bound on the total variation distance between samples from MCMC for a given corrupted point x a , q ( t ) ( z | x a ) , and the variational posterior for the given real point x , q ϕ ( z | x ) , is the following:
[Equation]
Proof
Combining Lemma 1 and 2 we get:
[Equation]
Note that
[Equation]
that gives us the final expression:
TV
[Equation]
■
B Background on MCMC B.1 Sampling from an unnormalized density with MCMC
Markov Chain Monte Carlo (MCMC) is a class of methods that are used to obtain samples from the density p ( v ) (also referred to as target ), which is only known up to a normalizing constant.
That is, we have access to ˜ p ( v ) , such that p ( v ) =
˜ p ( v ) Z and Z is a typically unknown and hard to estimate normalizing constant.
Thus, we construct a Markov Chain with samples { v ( t ) }
Tt [-=
-]=1 so that they mimic the samples from p ( v ) .
To ensure they are proper samples, the stationary distribution of the constructed Markov Chain should be the target distribution p ( v ) .
The most popular way of constructing such Markov Chains is the Metropolis-Hastings (MH) method.
The majority of the MCMC methods used in practice can be formulated as a special case of the MH [2].
In the MH method, we introduce a proposal distribution q ( v t +1 | v t ) to obtain a new sample and then accept it with the following probability:
[Equation]
If the point is not accepted, we reuse the previous point, i.e., v t +1 = v t .
It can be proven that the resulting chain of correlated samples converges in the distribution to the target density [2].
It is worth mentioning that the performance of the method strongly depends on the choice of the proposal distribution.
In higher dimensional spaces, it is especially important to incorporate the information about the geometry of the target distribution into the proposal density to improve the convergence time.
The Hamiltonian Monte-Carlo (HMC) [31] is known to be one of the most efficient
MCMC methods.
It uses gradient of a target distribution in the proposal to incorporate the information about the geometry of the space.
The idea of the HMC is to introduce an auxiliary variable p with a known density (usually assumed to be the standard Gaussian) and the joint distribution formulated as follows:
[Equation]
We obtain samples ( v , p ) using the Hamiltonian dynamics [31] that describes how the v and p change over time for the given Hamiltonian H ( v , p ) =
U ( v ) + K ( p ) , namely:
[Equation]
For the practical implementation, these continuous-time equations are approximated by discretizing the time using L small steps of size η .
The discretization method that is often used is called the leapfrog .
B.2 The MCMC and Variational Autoencoders
In this paper, we use the MCMC to sample from the posterior distribution p θ ( z | x a ) .
That is, in our case v = z and ˜ p
( v ) =
p θ ( x a | z ) p ( z ) .
The HMC is a widely applied method to sampling from an unknown posterior distribution in deep learning (e.g. [24]).
A lot of effort was already done in combining variational inference with MCMC (and more specifically with HMC).
Hamiltonian Variational Inference [36, 43] was proposed in order to obtain a more flexible variational approximation.
Different approaches were proposed to use HMC during VAE training.
[23] approximate the gradients of the likelihood and avoid the use of variational approximation.
[11] propose an unbiased estimate for the ELBO gradient, which allows training Hamiltonian Variational Autoencoder.
[35] propose an alternative objective, which uses a contrastive divergence instead of standard KL-divergence.
In this work we are not changing the training procedure, instead, we propose to only use HMC during evaluation.
A possible extension to discrete latent spaces Some VAEs operate on discrete latent spaces, a very popular example would be a VQ-VAE [40].
However, the classical HMC that we use in our experiments is not able to sample from a discrete distribution.
Therefore, other MCMC methods should be used in this case, such as population-based MCMC [4], modifications of HMC[32] or
Langevin Dynamics [45].
B.3 Mode optimization
In this work we hypothesise that adversarial attacks move latent codes to the region of low probability and we use HMC to get a sample from the high posterior probability region.
However, another strategy can be to find the posterior mode instead.
Here we explain, what was our motivation to not use this approach.
Posterior modes similarity Ideally, we would like to obtain a sample from the variational posterior q ϕ ( z | x r ) , because our decoder was trained to produce reconstructions from such latent codes.
At the same time, VAE was trained to match this variational posterior to the true one p θ ( z | x r ) .
However, both these distributions are not available to us, since we observe attacked point x a instead of the reference x r .
Instead, we sample from p θ ( z | x a ) and show theoretically that the resulting samples are close (in terms of total variation distance) to the "goal" ones.
However, that does guarantee that their modes are the same.
Therefore, obtaining the mode of p θ ( z | x a ) is not necessarily a mode of q ϕ ( z | x r ) .
Thus, the fact that the HMC allows us to “wander” around that mode may be beneficial.
Concentration of measure During reconstruction, we get a sample from q ( z | x ) and pass it to the decoder, thus, a mode can actually be a bad latent code for these purposes.
Instead, ideally, we want to get a sample from the typical set where most of the probability mass is concentrated.
In theory, the
HMC allows us to do that.
Randomness The HMC adds a source of randomness to our defence strategy that potentially makes it harder to attack.
This is supported by our experiment in Section [-4.
-]4.
C Additional results C.1 Posterior ratio
We motivate our method by the hypothesis that the adversarial attack "shifts" a latent code to the region of a lower posterior density, while our approach moves it back to a high posterior probability region.
In Section 3 we theoretically justify our hypothesis, while here we provide an additional empirical evidence.
In order to verify our claim that applying an MCMC method allows us to counteract attacks by moving a latent code from a region of a lower posterior probability mass to a region of a higher density, we propose to quantify this effect by measuring the ratio of posteriors for z 1 and z 2 .
The true posterior p ( z | x r ) is not available due to the cumbersome marginal distribution p ( x r ) , however, we can calculate the ratio of posteriors because the marginal will cancel out, namely:
[Equation]
In our case, we are interested in calculating the posterior ratio between the reference and adversarial latent codes ( z 1 =
z r , z 2 =
z a ) as the baseline, and the posterior ratio between the reference and adversarial code after applying the HMC ( z 1 = z r , z 2 =
z a HMC ).
The lower the posterior ratio, the better.
For practical reasons, we use the logarithm of the posterior ratio (the logarithm does not change the monotonicity and turns products to sums):
[Equation]
We present results on the log-posterior-ratio calculated on the MNIST dataset.
In Figure 7 we show a plot with two histograms: one with the posterior ratio between the reference and adversarial latent codes ( z 1 = z r , z 2 =
z a ) in blue, and the second histogram of the posterior ratio between the reference and adversarial code after applying the HMC ( z 1 =
z r , z 2 =
z a HMC ) in orange.
We observe that the histogram has moved to the left after applying the HMC.
This indicates that posterior of the adversarial (in the denominator) is increasing when the HMC is used.
This is precisely the effect we hoped for and this result provides an empirical evidence in favor of our hypothesis.
[Figure]
Experimental Details For this experiment we construct 500 adversarial attacks with the radius 0.1 on the encoder of the VAE trained on MNIST dataset.
We run 500 HMC steps with the same hyperparameters as mentioned in Table 8 to obtain z aHMC .
Statistical Analisys We performed a two-sample Kolmagorov-Smirnov test with the null hypothesis that two histograms are drawn from the same distribution.
As an alternative hypothesis is that the underlying distributions are different.
Choosing the confidence level of 95% results in the rejection of the null hypothesis (p-value is equal to 0.029) in favour of the alternative: two histograms were not drawn from the same distribution.
C.2 Detailed results for β -VAE and β -TCVAE
In this section we report extended results for MNIST, FashionMNIST and ColorMNIST datasets.
We train VAE, β -VAE and β -TCVAE on three datasets: MNIST, FashionMNIST and ColorMNIST.
Then, we compare the robustness to adversarial attack with and without HMC.
We present all the result with the standard error in Table 4 .
On Figures 8, 9 we show visually how HMC improve the robustness for each dataset and model.
[Table]
[Figure] [Figure] [Equation]
C.3 What if the attacker knows the defence strategy?
In our experiments we relied on the assumption that attack does not take into account the defence strategy that we use.
We believe that it is reasonable, since defence requires access to the decoder part of the model ( p θ ( x | z ) ), which is not necessarily available to the attacker.
However, one may assume that the defence strategy is known to the attacker.
In this case, it is reasonable to verify whether the robustness results change.
In the conducted experiment we show that it is vastly more complicated to attack the encoder with taking the MCMC defence into account.
We train the unsupervised attack (3).
The attack has access to the encoder and MCMC defence:
[Equation]
where Q ( t ) ( z | z 0 ) is MCMC kernel.
Then, given the attack radius δ , we train the attack using the following objective:
[Equation]
The similarity results of these attacks are plotted in Figure 11.
We observe that the reconstructed reference and adversarial points have approximately the same similarity (measured by MSSSIM) as the initial points x r and x a , which indicates that the attacks were unsuccessful.
However, if we use the same objective, but omit the MCMC step (e.g t = 0 in eq. 65 and 66), then, as observed in Figure 10, the attack becomes much more successful (Figure 10 (a)), but we can fix it with the proposed defence (Figure 10 (b)).
It is interesting to compare how the attacked points look in both cases, especially as we increase the radius of the attack.
In Figure 12, we plot attack on two reference points for radius values in { 0 . 1 , 0 . 6 , 0 . 8 , 1 . 0 } .
When the attacker does not use MCMC (left), it just learns to add more and more noise to the image, which eventually makes it meaningless.
When we use MCMC during an attack, the situation is different.
The adversarial input is almost indistinguishable from the reference point for a small radius.
After each gradient update, the attacker runs a new MCMC, which moves point closer to the region of high posterior probability, but may follow a different trajectory every time.
Eventually, it makes it harder to learn an additive perturbation ε .
However, as we increase the attack radius, we observe a very interesting effect.
Instead of meaningless noise, the attacker learns to change the digit.
For instance, we see how 4 is transformed into 0 in the first example and into 9 in the second.
This way, the attacker ensures that the MCMC will move the latent far away from the reference latent code, which now has a different posterior distribution.
[Figure]
Attack radius 0 .0 .0 .1 .
MSSSIM [ x r ,x a ] [ e x r , e x a ] 0 .0 .0 .0 .1 .
Attack radius 0 .0 .0 .1 .
M
SSS I
M [ x r ,x a ] [ e x r , e x a ]
[Figure] [Figure]
(cid:101)
[Figure]
(cid:101)
[Figure]
x
[Figure]
(cid:101) x
[Figure]
(cid:101) x
[Figure]
HMC
[Figure]
C.4 Which attack radius should be considered?
In out experiments, we use attacks with the radius 0 . 1 and 0 .
2 for all the models except for CelebA dataset, where radii 0 .
05 and 0 .
1 were considered.
Here, we provide additional experiment to justify this choice.
In Figure 13 (a) we show the similarity between the reference point and the adversarial point.
We observe that for CelebA the similarity drops faster than for the MNIST.
Further, if we look at the example plotted in Figure 14, we can clearly notice that with the radius 0 .
2 CelebA image is already containing a lot of noise.
At the same time, we observe (Figure 13 (b)) that reconstruction similarity, which indicates the success of the attack, drops relatively fast when the radius of the attack increases.
[Figure] [Figure]
Figure
C.5 How many HMC steps are required for a defence?
One of the main hyperparameters of the proposed approach is number of steps of MCMC that the defender does.
We have conducted experiments with MNIST and Color MNSIT dataset to see how the robustness metrics change when we increase number of HMC steps from 0 to 200.
As we can see from the Figure 15, there is always a considerable jump between 0 steps (no defence) andsteps (lowest number of steps considered).
However, as we continue making steps, we do not observe further improvement of the metrics.
[Figure]
Accuracy p (y | z a ) ↓
[Figure]
C.6 Comparison of objective functions
This section compares different objective functions that can be used to construct adversarial attacks on VAE.
In general, in both supervised and unsupervised setting, we need to measure the difference between variational posterior in the adversarial point q
( z | x a ) and a point from the dataset (either a target or reference point).
We consider a Gaussian encoder, and the simplest way to compare two
Gaussian distributions is to measure the distance between their means.
To take into account the variances, we can use the KL-divergence.
It is a non-symmetric metric.
Thus, we have two options: to use the forward or reverse KL.
Finally, it is also possible to consider the symmetrical KL divergence that is an average between the two.
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table] [Figure] [Table] [Figure]
[Table]
[Figure]
[Table]
[Figure] [Table] [Figure] [Table]
Accuracy.
In Figure 16, we measure how successful the attacks are in terms of the proposed metrics.
We use arrows in the plot titles to indicate desirable values of the metric for a successful attack.
We compare supervised and unsupervised attacks on VAE trained on MNIST and fashion MNIST datasets.
We observe that there is no single objective function that consistently outperforms others.
C.7 Inference Time
Even though our approach does not require changing the training procedure, it has influence on the inference time.
In practice, this can be a limiting factor.
Therefore, in Table 5 we report the computational overhead during the inference time.
We measure the inference time in seconds per test point without HMC ( T = 0 ) and for different budgets ( T = { 100 , 500 , 1000 } ).
[Table]
D Details of the experiments D.1 Training VAE models
Architecture We use the same fully convolutional architecture with latent dimension 64 for MNIST,
FashionMNISt and ColorMNIST datasets.
In Table 6, we provide detailed scheme of the architecture.
We use Conv(3x3, 1->32) to denote convolution with kernel size 3x3 , 1 input channel andoutput channels.
We denote stride of the convolution with s , padding with p and dilation with d .
The same notation applied for the transposed convolutions ( ConvTranspose ).
ColorMNIST hasinput channels, so the first convolutional layer in the encoder and the last of the decoder are slightly different.
In this cases values for ColorMNIST are report in parenthesis with the red color.
[Table]
Optimization We use Adam to perform the optimization.
We start from the learning rate 5 e −and reduce it by the factor of 2 if the validation loss does not decrease for 10 epochs.
We train a model for 300 epochs with the batch size 128.
In Table [Table] we report the values of the test metrics for
VAEs trained on MNIST, Fashion MNIST and Color MNIST.
For calculating the FID score, we use torchmetrics library: https://torchmetrics.
readthedocs
[Table] [Table]
D.2 Adversarial Attacks and Defence Hyperparameters
In Table [Figure] we report all the hyperparameter values that were used to attack and defend VAE models.
In all the experiments we randomly select reference points from the test dataset.
We also ensure that the resulting samples are properly stratified — include an even number of points from each of the classes.
For each reference point, we train 10 adversarial inputs with the same objective function but different initialization.
We use projected gradient descent to learn the adversarial attacks.
Optimization parameters were the same for all the datasets and models.
They are presented in Table 8.
We choose HMC to defend the model against the trained attack.
We perform T steps of HMC with the step size η and L leapfrog steps.
Where indicated, we adapt the step size after each step of HMC using the following formula:
[Equation]
[Equation]
where α t is the acceptance rate at step t .
This way we increase the step size if the acceptance rate is higher than 90% and decrease it otherwise.
When adaptive steps size is used, a value in the table indicates the η 0 .
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]