Source-linked AI summary
Adversarial examples for generative models
Jernej Kos, Ian Fischer, Dawn Song
TL;DR
The paper addresses the lack of adversarial attacks against generative models, asking whether VAEs and VAE-GANs can be induced to reconstruct attacker-chosen outputs. It develops three attack classes and demonstrates vulnerability across MNIST, SVHN, and CelebA, with latent attacks generally strongest but some methods incurring quality or speed limitations.
Problem
Prior adversarial-example research focused mainly on classification, leaving attacks against generative models unexplored despite their learned latent representations and realistic outputs.
Method
The paper trains a classifier over the encoder’s latent space, directly optimizes the VAE loss, or optimizes source-target latent differences to construct adversarial inputs.
Results
Across experiments on VAEs and VAE-GANs, the latent attack consistently performs best, while the classifier attack performs worst; the VAE-loss attack is by far the slowest.
Takeaways & Limitations
VAEs and VAE-GANs can be induced to transform inputs into surprisingly different outputs, supporting adversarial examples as a broader neural-network phenomenon.
Takeaways & Limitations
Classifier-based attacks can produce low-quality reconstructions when the auxiliary classifier confidently misclassifies latent vectors far from the training distribution.
Abstract
from arXiv · showhide
We explore methods of producing adversarial examples on deep generative models such as the variational autoencoder (VAE) and the VAE-GAN. Deep learning architectures are known to be vulnerable to adversarial examples, but previous work has focused on the application of adversarial examples to classification tasks. Deep generative models have recently become popular due to their ability to model input data distributions and generate realistic examples from those distributions. We present three classes of attacks on the VAE and VAE-GAN architectures and demonstrate them against networks trained on MNIST, SVHN and CelebA. Our first attack leverages classification-based adversaries by attaching a classifier to the trained encoder of the target generative model, which can then be used to indirectly manipulate the latent representation. Our second attack directly uses the VAE loss function to generate a target reconstruction image from the adversarial example. Our third attack moves beyond relying on classification or the standard loss for the gradient and directly optimizes against differences in source and target latent representations. We also motivate why an attacker might be interested in deploying such techniques against a target generative network.
1 INTRODUCTION
Adversarial-example research has primarily targeted classifiers, while generative models introduce attacks that can manipulate reconstructed outputs through their learned latent representations. This work addresses that gap by motivating and demonstrating attacks against generative models.
- Adversarial examples are small, carefully crafted input perturbations that can make deep networks produce incorrect outputs while remaining barely visible.
- Prior work mainly studies classification attacks that change an input’s predicted class while preserving human recognition of its original class.
- Deep generative models learn approximations of input distributions and generate previously unseen but plausible outputs across domains including images, video, 3D objects, and audio.
- The paper identifies no prior work attacking generative models and addresses both a plausible attack scenario and attacks that succeed against them.
- Generative models can encode inputs into lower-dimensional latent representations that support compression, denoising, and output manipulation.
- An attacker can exploit the latent bottleneck to make an encoding party believe it transmitted one message while the decoder reconstructs another chosen by the attacker.
2 RELATED WORK AND BACKGROUND
VAEs and VAE-GANs provide learned latent representations for reconstructing inputs, while prior adversarial research supplies optimization frameworks and motivates direct latent-space attacks. The paper situates its generative-model attacks within this background.
- Classical adversarial attacks formulate untargeted and targeted examples as minimizing input distance subject to changed or attacker-selected classifier outputs.
- These attack objectives can be solved with optimizers such as L-BFGS or Adam or approximated with gradient-based methods.
- Attacking a generative model’s latent vector extends hidden-state attacks that search for perturbed inputs matching a target representation.
- The paper distinguishes its approach from concurrent VAE work by considering VAE-GANs and more complex datasets such as CelebA.
- VAEs encode high-dimensional inputs into compressed latent vectors and decode those vectors into reconstructed outputs; VAE-GANs add a discriminator during training.
- The VAE loss combines a KL-divergence term with an expected reconstruction term based on the decoder’s output.
3 PROBLEM DEFINITION
The paper defines a generative-model attack in which an adversary manipulates an input so the target model reconstructs an output from a chosen class. It frames this threat around VAE-based latent compression and specifies attacker capabilities and evaluation.
- The proposed attack scenario uses a shared VAE to transmit compressed latent vectors between a sender and receiver to conserve bandwidth.
- An attacker presents a sender with an image that resembles the intended content, but the receiver reconstructs an attacker-chosen output from the transmitted latent vector.
- The same latent-space vulnerability can arise when sender and receiver are separated by distance or by time, including later retrieval of compressed images.
- The target generative model is assumed to represent semantically meaningful classes in its latent space and generate outputs in the attacker’s target class.
- The attacker may need only a small amount of labeled data for one target class rather than the labeled training dataset.
- The paper proposes classifier-based, VAE-loss, and direct latent-space attacks, with automated evaluation using a classifier trained on encoded representations.
4 ATTACK METHODOLOGY
The paper proposes three attacks on generative models: classifier-based manipulation of latent representations, direct reconstruction targeting with the VAE loss, and direct latent-space optimization.
- Overview: Three attacks target generative models through a classifier on the latent space, the VAE loss, or differences between source and target latent representations.All three methods are technically applicable to architectures using a learned latent representation; the paper focuses on VAE-GANs.
- Classifier attack: The classifier-based attack freezes the generative model, trains fclass on encoder outputs, and then generates adversarial examples against that classifier.The training corpus should approximately match the target model’s input distribution and include labels for at least two classes.
- VAE-loss attack: The VAE-loss attack perturbs a source xs so its reconstruction matches the precomputed reconstruction of a target xt.Each optimization iteration evaluates the full decoder-after-encoder reconstruction of the perturbed input.
- Latent attack: The latent attack directly optimizes the distance between source and target latent representations rather than relying on a classifier or standard generative-model loss.The method computes the target encoding zt and uses a vector-distance loss, with L2 chosen under an approximately Euclidean latent-space assumption.
- Optimization methods: L2 optimization balances input similarity against an attack objective, while the VAE-loss variant requires reconstruction at every optimization step and is slower.The objective uses λ to balance λL(x, x∗) and L(x∗, yt), where L may be Lclassifier, LVAE, or Llatent.
- Measuring attack effectiveness: A reconstruction feedback loop classifies reconstructed adversarial inputs and improves classifier accuracy by 60% on average across the examined attacks.The predicted reconstruction label is compared with the target class, enabling automated filtering of failed examples when classifier precision and recall are sufficiently high.
5 EVALUATION
The evaluation tests three attack methods across generative models and datasets, finding that latent-space attacks generally produce stronger reconstructions than classifier-based attacks. Results also show dataset- and target-dependent variation, while the LVAE attack is substantially slower because it reconstructs at every optimization step.
- Experimental setup: The attacks were evaluated on MNIST, SVHN, and CelebA using VAE and VAE-GAN architectures.Experiments used standard training and validation splits; the VAE-GAN is shown in many results because it produced higher-quality outputs.
- Classifier attack: The targeted classifier attack reduced classifier accuracy to 0% with a 100% target matching rate, but incorrect classifications did not consistently reconstruct to the target class.This indicates that fooling the auxiliary classifier is easier than forcing the generative model to produce the desired reconstruction.
- Latent attack: The latent attack performed much better than the classifier attack, and its advantage remained visible when comparing reconstructed images.The latent attack directly targets the generative model’s latent representation rather than relying only on an attached classifier.
- Limitations: The untargeted latent attack normally failed to generate reasonable adversarial examples because its latent-distance loss was unbounded.The distance between source and adversarial latent representations could continue increasing without a finite minimizing solution.
- Cross-dataset results: On SVHN, 11 out of 12 adversarial examples reconstructed as the target digit 0, while the latent attack outperformed LVAE; both attacks worked equally well on MNIST.The evaluation metrics were weaker on SVHN than on MNIST, but successful attacks remained straightforward for almost all source/target pairs.
- Efficiency: The LVAE attack was by far the slowest because it computed full reconstructions during every optimizer step.The classifier and latent attacks omit reconstruction during adversarial-example optimization and therefore generate examples more quickly.
6 CONCLUSION
The paper demonstrates adversarial attacks against VAEs and VAE-GANs, showing that generative models can be induced to produce surprisingly different outputs. It motivates these attacks as evidence that adversarial examples affect current neural architectures broadly.
- The work explores adversarial examples against VAEs and VAE-GANs and reports that these models are vulnerable to attacks producing surprisingly different outputs.
- The authors motivate why attackers might target generative models and frame the study as groundwork for building more robust networks.
- Future work will examine defenses, robustification, and attacks on models trained with natural-image datasets such as CIFAR-10 and ImageNet.
A.1 MEAN LATENT VECTOR TARGETED ATTACK
The mean latent vector targeted attack constructs a target representation by averaging latent encodings from target-class images. This provides flexibility for specifying stylistic properties while remaining similarly effective to the single-vector variant.
- The attack averages latent representations of many target images to create a target vector for reconstruction.The target vector is produced by encoding selected target images and taking their mean.
- Averaging target images lets attackers combine desired properties such as digit line thickness or slant without possessing one ideal target image.
- For MNIST, the authors use the mean latent vector of all training digits in each class as the target.
- The mean-vector and single-vector variants appear similarly effective, trading the first attack’s simplicity against the second attack’s flexibility.
A.2 EVALUATION RESULTS
Evaluation across MNIST, SVHN, and CelebA compares classifier, LVAE, and latent attacks using reconstructions and attack metrics. Targeted latent and LVAE variants produce target-directed reconstructions, while some classifier and untargeted attacks are ineffective or misleading.
- MNIST: FGS combined with LVAE changes class in none of the VAE reconstructions and only two VAE-GAN reconstructions, making it ineffective.
- MNIST: Classifier accuracy on adversarial examples can approach 100%, yet reconstructions may remain poor, so classifier success does not ensure a successful generative-model attack.
- MNIST and SVHN: Latent attacks use target-class latent vectors and report ASignore−target and AStarget across source-target pairs on MNIST and SVHN.
- MNIST: The L2 optimization classifier attack targeting digit 4 yields AStarget equal to 0 for every source digit.
- MNIST: Random noise with the same magnitude as generated adversarial noise does not significantly change reconstructed images.
- CelebA: Latent and LVAE attacks are also visualized on CelebA through adversarial examples and their VAE-GAN reconstructions.