See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/311299197

Adversarial Images for Variational Autoencoders

Article · December 2016

DOI: 10.48550/arXiv.1612.00155

CITATIONS READS
57 863

3 authors, including:

Pedro Tabacof Julia Tavares

State University of Campinas (UNICAMP) Federal University of Uberlândia
7 PUBLICATIONS 334 CITATIONS 12 PUBLICATIONS 222 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Pedro Tabacof on 11 December 2016.

The user has requested enhancement of the downloaded file.

 Adversarial Images for Variational Autoencoders

Pedro Tabacof, Julia Tavares and Eduardo Valle

RECOD Lab. — DCA / School of Electrical and Computer Engineering (FEEC)
University of Campinas (Unicamp)
Campinas, SP, Brazil
{tabacof, juliaat, dovalle}@dca.fee.unicamp.br
arXiv:1612.00155v1 [cs.NE] 1 Dec 2016

Abstract

We investigate adversarial attacks for autoencoders. We propose a procedure that

distorts the input image to mislead the autoencoder in reconstructing a completely
different target image. We attack the internal latent representations, attempting to
make the adversarial input produce an internal representation as similar as possible
as the target’s. We find that autoencoders are much more robust to the attack
than classifiers: while some examples have tolerably small input distortion, and
reasonable similarity to the target image, there is a quasi-linear trade-off between
those aims. We report results on MNIST and SVHN datasets, and also test regular
deterministic autoencoders, reaching similar conclusions in all cases. Finally, we
show that the usual adversarial attack for classifiers, while being much easier, also
presents a direct proportion between distortion on the input, and misdirection on
the output. That proportionality however is hidden by the normalization of the
output, which maps a linear layer into non-linear probabilities.

1 Introduction
Adversarial attacks expressly optimize the input to “fool” models, e.g., in image classification, the
adversarial input — while visually tantamount to an ordinary original image — leads to mislabelling
with high confidence.
Here, we explore adversarial images for autoencoders — models optimized to reconstruct their inputs
from compact internal representations. In an autoencoder, the attack targets not a single label, but a
whole reconstruction. Our contributions include:

• An adversarial attack on variational — and, for comparison, deterministic — autoencoders. Our

attack aims not only at disturbing the reconstruction, but at fooling the autoencoder into recon-
structing a completely different target image;
• A comparison between attacks for autoencoders and for classifiers, showing that while the former
is much harder, in both cases the amount of distortion on the input is proportional to the amount
of misdirection on the output. For classifiers, however, such proportionality is hidden by the
normalization of the output, which maps a linear layer into non-linear probabilities.

Evaluating generative models is hard [1], there are no clear-cut success criteria for autoencoder
reconstruction, and therefore, neither for the attack. We attempt to bypass that difficulty by analyzing
how inputs and outputs differ across varying regularization constants.
The seminal article of Szegedy et al. [2] introduced adversarial images, showing how to force a deep
network to misclassify an image by applying nearly imperceptible distortions. Goodfellow et al. [3]
exploited the linear nature of deep convolutional networks to both attempt explaining how adversarial
samples arise, and to propose a much faster technique to create them. Tabacof and Valle [4] explored

Workshop on Adversarial Training, NIPS 2016, Barcelona, Spain.

the geometry of adversarial regions, showing that they appear in relatively dense regions of the input
space, and that shallow, simple classifiers tend to be more robust to them.
The existence of adversarial images lead to interesting questions on their significance, and even
usefulness. Training models to resist adversarial attacks was advanced as a form of regularization [3,
5]. Gu et al. [6] used autoencoders to pre-process the input and try to reinforce the network against
adversarial attacks, finding that although in some cases resistance improved, attacks with small
distortions remained possible. A more recent trend is training adversarial models, in which one
attempts to generate “artificial” samples (from a generative model) and the other attempts to recognize
those samples [7]. Makhzani et al. [8] employ such scheme to train an autoencoder.
Although autoencoders appear in the literature of adversarial images as an attempt to obtain robustness
to the attacks [6], and in the literature of adversarial training as models that can be trained with the
technique [8], we are unaware of any attempts to create attacks targeted to them. In the closest related
literature, Sara Sabour et al. [9] show that adversarial attacks can not only lead to mislabelling,
but also manipulate the internal representations of the network. In this paper, we show that an
analogous manipulation allows us to attack autoencoders, but that those remain much more resistant
than classifiers to such attacks.

2 Autoencoders and Variational Autoencoders

Autoencoders are models that map their input into a compact latent representation, and then, from
such representation, build back the input (discounting some distortion). Therefore, autoencoders
are trained to minimize the distortion between their input and their (reconstructed) output — plus
regularization terms. The model comprises two parts: an encoder, which maps the input into the latent
representation; and a decoder, which maps such representation into an output as close to the input
as possible. In regular autoencoders, the training loss function may be as simple as the `2 -distance
between input and output.

Figure 1: Autoencoders are models able to map their input into a (deterministic or stochastic) latent
representation, and then to map such representation into an output similar to the input; those two
maps form the two halves of the model: the encoder and the decoder.

Famous variants include sparse autoencoders, which use `1 -regularization [10], and denoising
autoencoders, which use implicit regularization by feeding noise to the input, while keeping the
original input in the reconstruction loss term [11]. An important offshoot are models with similar
encoder–decoder structure, but which seek not to reconstruct the input, but to produce an output
related to it (e.g., a segmentation map) [12].
A modern variant of growing popularity, variational autoencoders [13] interpret the latent repre-
sentation through a Bayesian lens, thus offering a theoretical foundation for the reconstruction and
regularization objectives. Variational autoencoders are probabilistic generative models, where we
find the probability distribution of the data by marginalizing over the latent variables:
Z Z
pθ (x) = pθ (x, z)dz = pθ (x|z)p(z)dz (1)

The likelihood pθ (x|z) is the probabilistic explanation of the observed data: in practice, often it is
simply the output of the decoder network under a noise consideration (e.g. additive Gaussian noise for

2
RGB pixels). The subscript θ comprises all decoder parameters, while z is the latent representation,
over which we marginalize. The representation prior p(z) is often the standard normal N (0, I) [13],
but might be instead a discrete distribution (e.g. Bernoulli) [14], or even some distribution with
geometric interpretation (“what” and “where” latent variables) [15]. Since the integration above is
often intractable, we maximize its variational lower bound...

Eqφ (z|x) [log pθ (x|z)] − KL(qφ (z|x) k p(z)) = −KL(qφ (z|x) k p(z|x)) [≤ log p(x)] (2)

...which is the Kullback–Leibler (KL) divergence between the approximate and the (unknown) exact
posterior. Thus, maximizing the variational lower bound may also be interpreted as finding the best
posterior approximation. In the context of variational autoencoders, such approximate posterior is
usually an uncorrelated multivariate normal determined by the encoder network (with parameters φ):

qφ (z|x) = N (µφ (x), exp(σφ2 (x))) (3)

We can approximate the likelihood expectation Eqφ (z|x) [log pθ (x|z)] by Monte Carlo. As the prior
and the approximated posterior are normal distributions, their KL divergence has analytic form [13].
We can use the reparameterization trick to reduce the variance of the gradient estimator [16].
The encoder and the decoder may be any neural network: a multilayer perceptron [13], a convolu-
tional network [17], or even LSTMs. The latter are a recent development — recurrent variational
autoencoders — which use soft attention to encode and decode patches from the input image [18, 19].
Simulating a chain of samples from the latent variables and likelihood allows to denoise images, or
to impute missing data (inpaint images) [20]. The latent variables of a variational autoencoder also
allow visual analogy and interpolation [17].

3 Adversarial Images for Autoencoders

Adversarial procedures minimize an adversarial loss to mislead the model (e.g., misclassification),
while distorting the input as little as possible. If the attack is successful, humans should hardly be
able to distinguish between the adversarial and the regular inputs [2, 4]. We can be even more strict,
and only allow a distortion below the input quantization noise [3, 9].
To build adversarial images for classification, one can maximize the misdirection towards a certain
wrong label [2, 4] or away from the correct one [3]. The distortion can be minimized [2, 4] or
constrained to be small [3, 9]. Finally, one often requires that images stay within their valid space
(i.e., no pixels “below black or above white”).
In autoencoders, there is not a single class output to misclassify, but instead a whole image output
to scramble. The attack attempts to mislead the reconstruction: if a slightly altered image enters
the autoencoder, but the reconstruction is wrecked, then the attack worked. A more dramatic attack
— the one we attempt in this paper — would be to change slightly the input image and make the
autoencoder reconstruct a completely different valid image (Fig. 2).
Our attack consists in selecting an original image and a target image, and then feeding the network
the original image added to a small distortion, optimized to get an output as close to the target
image as possible (Fig. 2). Our attempts to attack the output directly failed: minimizing its distance
to the target only succeeded in blurring the reconstruction. As autoencoders reconstruct from the
latent representation, we can attack it instead. The latent layer is the information bottleneck of
the autoencoder, and thus particularly convenient to attack. We used the following adversarial
optimization:

min ∆(za , zt ) + Ckdk

d
s.t. L ≤ x+d ≤ U (4)
za = encoder(x + d)

where d is the adversarial distortion; za and zt are the latent representations, respectively, for the
adversarial and the target images; x is the original image; x + d is the adversarial image; L and U

3
Figure 2: Adversarial attacks for autoencoders add (ideally small) distortions to the input, aiming at
making the autoencoder reconstruct a different target. We attack the latent representation, attempting
to match it to the target image’s.

are the bounds on the input space; and C is the regularizing constant the balances reaching the target
and limiting the distortion.
We must choose a function ∆ to compare representations. For regular autoencoders a simple `2 -
distance sufficed; however, for variational autoencoders, the KL-divergence between the distributions
induced by the latent variables not only worked better, but also offered a sounder justification. In our
variational autoencoders, the z∗ are uncorrelated multivariate normal distributions with parameters
given by the encoder:

encoder(x) ∼ N (Mφ (x), Σφ (x)) (5)

where M and Σ are the representation mean vector, and (diagonal) covariance matrix output by the
last layer of the encoder network; while φ are the autoencoder parameters — learned previously by
training it for its ordinary task of reconstruction. During the entire adversarial procedure, φ remains
fixed.

4 Data and Methods

We worked on the binarized MNIST [21] and SVHN datasets [22]. The former allows for very fast
experiments and very controlled conditions; the latter, while still allowing to manage a large number
of experiments, provides much more noise and variability. Following literature [13], we modeled
pixel likelihoods as independent Bernoullis (for binary images), or as independent normals (for RGB
images). We used Parmesan and Lasagne [23] for the implementation1 .
The loss function to train the variational autoencoder (equation 2) is the expectation of the likelihood
under the approximated posterior plus the KL divergence between the approximated posterior and the
prior. We approximate the expectation of the likelihood with one sample of the posterior. We extract
the gradients of the lower bound using automatic differentiation and maximize it using stochastic
gradient ascent via the ADAM algorithm [24]. We used 20 and 100 latent variables for MNIST and
SVHN, respectively. We parameterized the encoder and decoder as fully-connected networks in
the MNIST case, and as convolutional and deconvolutional [25] networks in the SVHN case. After
the training is done, we can use the autoencoder to reconstruct some image samples through the
latent variables, which are the learned representation of the images. An example of a pair of input
image/reconstructed output appears in Fig. 1.
1
The code for the experiments can be found at https://github.com/tabacof/adv_vae

4
For classification tasks, the regularization term C (Eq. 4) may be chosen by bisection as the smallest
constant that still leads to success [4]. Autoencoders complicate such choice, for there is no longer
a binary criterion for success. Goodfellow et al. [3] and Sabour et al.[9] optimize differently,
choosing for ∆ an `∞ -norm constrained to make the distortion imperceptible, while maximizing the
misdirection. We found such solution too restrictive, leading to reconstructions visually too distinct
from the target images. Our solution was instead to forgo a single choice for C, and analyze the
behavior of the system throughout a series of values.
In our experiments, we pick at random 25 pairs of original/target images (axis “experiment” in
graphs). For each pair, we span 100 different values for the regularization constant C in a logarithmic
scale (from 2−20 to 220 ), measuring the `2 -distance between the adversarial input and the original
image (axis “distortion”), and the `2 -distance between the reconstructed output and the target image
(axis “adversarial−target”). The “distortion” axis is normalized between 0.0 (no attack) and the
`2 -distance between the original and target images in the pair (a large distortion that could reach the
target directly). The “adversarial−target” is normalized between the `2 -distance of the reconstruction
of the target and the target (the best expected attack) and the `2 -distance of the reconstruction of the
original and the target (the worst expected attack). The geometry of such normalization is illustrated
by the colored lines in the graphs of Fig. 3. For variational autoencoders, the reconstruction is
stochastic: therefore, each data point is sampled 100 times, and the average is reported.
For comparison purposes, we use the same protocol above to generate a range of adversarial images
for the usual classification tasks on the same datasets. The aim is to contrast the behavior of adversarial
attacks across the two tasks (autoencoding / classification). In those experiments we pick pairs of
original image / adversarial class (axis “experiment”), and varying C (from 2−10 to 220 ), we measure
the distortion as above, and the probability (with corresponding logit) attributed to the adversarial
(red lines) and to the original classes (blue lines). The axes here are no longer normalized, but we
center at 0 in the “distortion” axis the transition point between attack failure and success — the point
where red and blue lines cross.

5 Results and Discussion

We found that generating adversarial images for autoencoders is a much harder task than for classifiers.
If we apply little distortion (comparable to those used for misleading classifiers), the reconstructions
stay essentially untouched. To get reconstructions very close to the target’s, we have to apply heavy
distortions to the input. However, by hand-tuning the regularization parameter, it is possible to
find trade-offs where the reconstruction approaches the target’s and the adversarial image will still
resemble the input (two examples in Fig. 3).
The plots for the full set of 25 original/target image pairs appear in Fig. 4. All series saturate when
the latent representation of the adversarial image essentially equals the target’s. That saturation
appears well before the upper distortion limit of 1.0, and provides a measure of how resistant the
model is to the attack: Variational Autoencoders appear slightly more resistant than Deterministic
Autoencoders, and MNIST much more resistant than SVHN. The latter is not surprising, since large
complex models seem, in general, more susceptible to adversarial attacks. Before the “hinge” where
the attack saturates, there is a quasi-linear trade-off between input distortion and output similarity to
target, for all combinations of dataset and autoencoder choice. We were initially hoping for a more
non-linear behavior, with a sudden drop at some point in the scale, but data suggests that there is a
give-and-take for attacking autoencoders: each gain in the attack requires a proportional increase in
distortion.
The comparison with the (much better-studied) attacks for classifiers, showed, at the beginning, a
much different behavior: when we contrasted the probability attributed to the adversarial class vs. the
distortion imposed on the input, we observed the non-linear, sudden change we were expecting (left
column of Fig. 6). The question remained, however whether such non-linearity was intrinsic, or
whether it was due to the highly non-linear nature of the probability scale. The answer appears
in the right column of Fig. 6, where, with a logit transformation of the probabilities, the linear
behavior appears again. It seems that the attack on classifiers show, internally, the same linear
give-and-take present in autoencoders, but that the normalization of the outputs of the last layer into
valid probabilities aids the attack: changes in input lead to proportional changes in logit, but to much
larger changes in probability. That makes feasible for the attack on classifiers to find much better

5
Figure 3: Top row: MNIST. Bottom row: SVHN. The figures on the left show the trade-off be-
tween the quality of adversarial attack and the adversarial distortion magnitude, with changing
regularization parameter (implicit in the graphs, chosen from a logarithmic scale). The figures on
the right correspond to the points shown in red in the graphs, illustrating adversarial images and
reconstructions using fully-connected, and convolutional variational autoencoders (for MNIST and
SVHN, respectively).

sweet spots than the attack on autoencoders (Fig. 5). Goodfellow et al. [3] suggested that the linearity
of deep models make them susceptible to adversarial attacks. Our results seems to reinforce that such
linearity plays indeed a critical role, with “internal” success of the attack being proportional to the
distortion on inputs. On classification networks, however, which are essentially piecewise linear until
the last layer, the non-linearity of the latter seems to compound the problem.

6 Conclusion
We proposed an adversarial method to attack autoencoders, and evaluated their robustness to such
attacks. We showed that there is a linear trade-off between how much the adversarial input is similar to
the original input, and how much the adversarial reconstruction is similar to the target reconstruction —
frustrating the hope that a small change in the input could lead to drastic changes in the reconstruction.
Surprisingly, such linear trade-off also appears for adversarial attacks on classification networks, if
we “undo” the non-linearity of the last layer. In the future, we intend to extend our empirical results
to datasets with larger inputs and more complex networks (e.g. ImageNet) — as well as to different
autoencoder architectures. For example, the DRAW variational autoencoder [18] uses feedback from
the reconstruction error to improve the reconstruction — and thus could be more robust to attacks.
We are also interested in advancing theoretical explanations to illuminate our results.

Acknowledgments
We thank Brazilian agencies CAPES, CNPq and FAPESP for financial support. We gratefully
acknowledge the support of NVIDIA Corporation with the donation of the Tesla K40 GPU used for
this research. Eduardo Valle is partially supported by a Google Awards LatAm 2016 grant, and by a
CNPq PQ-2 grant (311486/2014-2).

6
Figure 4: Plots for the whole set of experiments in MNIST and SVHN. Top: variational autoencoders
(VAE). Bottom: deterministic autoencoders (AE). Each line in a graph corresponds to one experiment
with adversarial images from a single pair of original/target images, varying the regularization
parameter C (like shown in Fig. 3). The “distortion” and “adversarial−target” axes show the trade-
off between cost and success. The “hinge” where the lines saturate show the point where the
reconstruction is essentially equal to the target’s: the distortion at the hinge measures the resistance
to the attack.

7
Figure 5: Examples for the classification attacks. Top: MNIST. Bottom: SVHN. Left: probabilities.
Middle: logit transform of probabilities. Right: images illustrating the intersection point of the curves.
The adversarial class is ‘4’ for MNIST, and ‘0’ for SVHN. The red curve shows the probability/logit
for the adversarial class, and the blue curve shows the same for the original class: the point where the
curves cross is the transition point between failure and success of the attack.

Figure 6: Plot of whose set of experiments for classifiers. Top: MNIST. Bottom: SVHN. Left:
probabilities. Right: logit transform of probabilities. Each experiment corresponds to one of the
graphs shown in Fig. 5, centered to make the crossing point between the red and blue lines stay at 0
in the “distortion” axis.

8
 References
[1] Lucas Theis, Aäron van den Oord, and Matthias Bethge. A note on the evaluation of generative models.
arXiv preprint arXiv:1511.01844, 2015.
[2] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and
Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
[3] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.
arXiv preprint arXiv:1412.6572, 2014.
[4] Pedro Tabacof and Eduardo Valle. Exploring the space of adversarial images. arXiv preprint
arXiv:1510.05328, 2015.
[5] Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, Ken Nakae, and Shin Ishii. Distributional smoothing
by virtual adversarial examples. arXiv preprint arXiv:1507.00677, 2015.
[6] Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples.
arXiv preprint arXiv:1412.5068, 2014.
[7] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron
Courville, and Yoshua Bengio. Generative adversarial nets. In Advances in Neural Information Processing
Systems, pages 2672–2680, 2014.
[8] Alireza Makhzani, Jonathon Shlens, Navdeep Jaitly, and Ian Goodfellow. Adversarial autoencoders. arXiv
preprint arXiv:1511.05644, 2015.
[9] Sara Sabour, Yanshuai Cao, Fartash Faghri, and David J Fleet. Adversarial manipulation of deep represen-
tations. arXiv preprint arXiv:1511.05122, 2015.
[10] Andrew Ng. Sparse autoencoder. CS294A Lecture notes, 72:1–19, 2011.
[11] Pascal Vincent, Hugo Larochelle, Isabelle Lajoie, Yoshua Bengio, and Pierre-Antoine Manzagol. Stacked
denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion.
The Journal of Machine Learning Research, 11:3371–3408, 2010.
[12] Hyeonwoo Noh, Seunghoon Hong, and Bohyung Han. Learning deconvolution network for semantic
segmentation. In Computer Vision (ICCV), 2015 IEEE International Conference on, 2015.
[13] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114,
2013.
[14] Diederik P Kingma, Shakir Mohamed, Danilo Jimenez Rezende, and Max Welling. Semi-supervised
learning with deep generative models. In Advances in Neural Information Processing Systems, pages
3581–3589, 2014.
[15] SM Eslami, Nicolas Heess, Theophane Weber, Yuval Tassa, Koray Kavukcuoglu, and Geoffrey E Hinton.
Attend, infer, repeat: Fast scene understanding with generative models. arXiv preprint arXiv:1603.08575,
2016.
[16] Diederik P Kingma, Tim Salimans, and Max Welling. Variational dropout and the local reparameterization
trick. arXiv preprint arXiv:1506.02557, 2015.
[17] Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with deep
convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434, 2015.
[18] Karol Gregor, Ivo Danihelka, Alex Graves, and Daan Wierstra. Draw: A recurrent neural network for
image generation. arXiv preprint arXiv:1502.04623, 2015.
[19] Karol Gregor, Frederic Besse, Danilo Jimenez Rezende, Ivo Danihelka, and Daan Wierstra. Towards
conceptual compression. arXiv preprint arXiv:1604.08772, 2016.
[20] Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approxi-
mate inference in deep generative models. arXiv preprint arXiv:1401.4082, 2014.
[21] Yann LeCun, Corinna Cortes, and Christopher JC Burges. The mnist database of handwritten digits, 1998.
[22] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits
in natural images with unsupervised feature learning. 2011.
[23] Sander Dieleman, Jan Schlüter, Colin Raffel, Eben Olson, Søren Kaae Sønderby, Daniel Nouri, Daniel
Maturana, Martin Thoma, Eric Battenberg, Jack Kelly, et al. Lasagne: First release., August 2015.
[24] Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint
arXiv:1412.6980, 2014.
[25] Matthew D Zeiler, Dilip Krishnan, Graham W Taylor, and Rob Fergus. Deconvolutional networks. In
Computer Vision and Pattern Recognition (CVPR), 2010 IEEE Conference on, pages 2528–2535. IEEE,
2010.

View publication stats