Adversarial Attacks on Variational Autoencoders

TL;DR

This paper investigates how vulnerable variational autoencoders are to adversarial attacks, proposing a new attack scheme and evaluation framework, and demonstrating that certain architectural features improve resistance.

Contribution

It introduces a novel attack scheme and an evaluation framework for assessing autoencoder robustness against adversarial inputs, with experimental validation on multiple models and datasets.

Findings

DRAW's recurrence and attention mechanisms enhance resistance

Convolutional autoencoders are more vulnerable

Evaluation framework correlates well with qualitative assessments

Abstract

Adversarial attacks are malicious inputs that derail machine-learning models. We propose a scheme to attack autoencoders, as well as a quantitative evaluation framework that correlates well with the qualitative assessment of the attacks. We assess --- with statistically validated experiments --- the resistance to attacks of three variational autoencoders (simple, convolutional, and DRAW) in three datasets (MNIST, SVHN, CelebA), showing that both DRAW's recurrence and attention mechanism lead to better resistance. As autoencoders are proposed for compressing data --- a scenario in which their safety is paramount --- we expect more attention will be given to adversarial attacks on them.