# Variational Inference with Latent Space Quantization for Adversarial Resilience

## TL;DR

This paper introduces a novel defense mechanism against adversarial attacks using a regularized, quantized latent space in generative models, which enhances robustness across attack types and is computationally efficient.

## Contribution

It proposes a generalized, attack-agnostic defense leveraging variational inference and latent space quantization, improving adversarial resilience without needing classifier access.

## Key findings

- Outperforms state-of-the-art defenses in multiple attack scenarios
- Provides near real-time adversarial robustness
- Effective against both black-box and white-box attacks

## Abstract

Despite their tremendous success in modelling high-dimensional data manifolds, deep neural networks suffer from the threat of adversarial attacks - Existence of perceptually valid input-like samples obtained through careful perturbation that lead to degradation in the performance of the underlying model. Major concerns with existing defense mechanisms include non-generalizability across different attacks, models and large inference time. In this paper, we propose a generalized defense mechanism capitalizing on the expressive power of regularized latent space based generative models. We design an adversarial filter, devoid of access to classifier and adversaries, which makes it usable in tandem with any classifier. The basic idea is to learn a Lipschitz constrained mapping from the data manifold, incorporating adversarial perturbations, to a quantized latent space and re-map it to the true data manifold. Specifically, we simultaneously auto-encode the data manifold and its perturbations implicitly through the perturbations of the regularized and quantized generative latent space, realized using variational inference. We demonstrate the efficacy of the proposed formulation in providing resilience against multiple attack types (black and white box) and methods, while being almost real-time. Our experiments show that the proposed method surpasses the state-of-the-art techniques in several cases.