Adversarial Images for Variational Autoencoders

By Pedro Tabacof, Julia Tavares, Eduardo Valle. 2016

92 citations recorded by the source corpus.

We investigate adversarial attacks for autoencoders. We propose a procedure that distorts the input image to mislead the autoencoder in reconstructing a completely different target image. We attack the internal latent representations, attempting to make the adversarial input produce an internal representation as similar as possible as the target's. We find that autoencoders are much more robust to the attack than classifiers: while some examples have tolerably small input distortion, and reasonable similarity to the target image, there is a quasi-linear trade-off between those aims. We report results on MNIST and SVHN datasets, and also test regular deterministic autoencoders, reaching similar conclusions in all cases. Finally, we show that the usual adversarial attack for classifiers, while being much easier, also presents a direct proportion between distortion on the input, and misdirection on the output. That proportionality however is hidden by the normalization of the output, which maps a linear layer into non-linear probabilities.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Adversarial Examples for Generative Models (2017, methodology): “A variant of this attack has also been applied to VAE models in the concurrent work of [19] 4 , which uses the KL divergence between the latent representation of the source and target images to generate the adversarial example.”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, methodology): “[87] proposed adversarial examples for generative models.”
Do Deep Generative Models Know What They Don't Know? (2018, background): “Adversarial attacks on generative models have been studied by (at least) Tabacof et al. (2016) and Kos et al. (2018), but these methods of attack require access to the model.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[127] investigated adversarial attacks for autoencoders [152], and proposed a technique to distort input image (to make it adversarial) that misleads the autoencoder to reconstruct a completely different image.”
Disentangling Adversarial Robustness and Generalization (2018, background): “Finally, adversarial examples have been applied to a wide variety of tasks, also beyond computer vision, e.g., [26, 18, 93, 47, 35, 54, 3, 16].”
GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models (2023, background): “Specifically, [39, 85] found that adversarial attack methods that are effective at attacking classifiers are significantly less effective at attacking autoencoders.”
Say What I Want: Towards the Dark Side of Neural Dialogue Models (2019, background): “[24] try to find the weakness of an object detection system; in [25, 26], researchers study the robustness of generative models, and novel methods to make adversarial examples for deep reinforcement learning based models are introduced in [27, 28].”