# Resisting Adversarial Attacks using Gaussian Mixture Variational Autoencoders

arXiv: https://arxiv.org/abs/1806.00081 · HTML: https://mlsanity.com/paper/1806.00081/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 May 2018.

## Built on by (most cited first, 26 of 26)

- [Adversarial purification with Score-based generative models](https://mlsanity.com/paper/2106.06041/) (2021)
- [Guided Diffusion Model for Adversarial Purification](https://mlsanity.com/paper/2205.14969/) (2022)
- [Reveal of Vision Transformers Robustness against Adversarial Attacks](https://mlsanity.com/paper/2106.03734/) (2021)
- [Enhancing Adversarial Robustness via Score-Based Optimization](https://mlsanity.com/paper/2307.04333/) (2023)
- [Certifiably Robust Variational Autoencoders](https://mlsanity.com/paper/2102.07559/) (2021)
- [Interpolated Joint Space Adversarial Training for Robust and Generalizable Defenses](https://mlsanity.com/paper/2112.06323/) (2021)
- [GenLabel: Mixup Relabeling using Generative Models](https://mlsanity.com/paper/2201.02354/) (2022)
- [It Is All About Data: A Survey on the Effects of Data on Adversarial Robustness](https://mlsanity.com/paper/2303.09767/) (2023)
- [Detecting Localized Adversarial Examples: A Generic Approach using Critical Region Analysis](https://mlsanity.com/paper/2102.05241/) (2021)
- [InvGAN: Invertible GANs](https://mlsanity.com/paper/2112.04598/) (2021)
- [Identifying Adversarially Attackable and Robust Samples](https://mlsanity.com/paper/2301.12896/) (2023)
- [Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training](https://mlsanity.com/paper/2106.05453/) (2021)
- [Wavelet Regularization Benefits Adversarial Training](https://mlsanity.com/paper/2206.03727/) (2022)
- [Understanding Neural Coding on Latent Manifolds by Sharing Features and Dividing Ensembles](https://mlsanity.com/paper/2210.03155/) (2022)
- [Attribute-Guided Encryption with Facial Texture Masking](https://mlsanity.com/paper/2305.13548/) (2023)
- [A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks](https://mlsanity.com/paper/2310.06468/) (2023)
- [VQUNet: Vector Quantization U-Net for Defending Adversarial Atacks by Regularizing Unwanted Noise](https://mlsanity.com/paper/2406.03117/) (2024)
- [Your VAR Model is Secretly an Efficient and Explainable Generative Classifier](https://mlsanity.com/paper/2510.12060/) (2025)
- [Deep-RBF Networks for Anomaly Detection in Automotive Cyber-Physical Systems](https://mlsanity.com/paper/2103.14172/) (2021)
- [Random Sampling for Diffusion-based Adversarial Purification](https://mlsanity.com/paper/2411.18956/) (2024)
- [LDC-VAE: A Latent Distribution Consistency Approach to Variational AutoEncoders](https://mlsanity.com/paper/2109.10640/) (2021)
- [MSS-PAE: Saving Autoencoder-based Outlier Detection from Unexpected Reconstruction](https://mlsanity.com/paper/2304.00709/) (2023)
- [Adaptive Attractors: A Defense Strategy against ML Adversarial Collusion Attacks](https://mlsanity.com/paper/2306.01400/) (2023)
- [Boosting Adversarial Robustness using Feature Level Stochastic Smoothing](https://mlsanity.com/paper/2306.06462/) (2023)
- [On the Adversarial Robustness of Generative Autoencoders in the Latent Space](https://mlsanity.com/paper/2307.02202/) (2023)
- [On Neural Network approximation of ideal adversarial attack and convergence of adversarial training](https://mlsanity.com/paper/2307.16099/) (2023)

## Abstract (arXiv)

Susceptibility of deep neural networks to adversarial attacks poses a major theoretical and practical challenge. All efforts to harden classifiers against such attacks have seen limited success. Two distinct categories of samples to which deep networks are vulnerable, "adversarial samples" and "fooling samples", have been tackled separately so far due to the difficulty posed when considered together. In this work, we show how one can address them both under one unified framework. We tie a discriminative model with a generative model, rendering the adversarial objective to entail a conflict. Our model has the form of a variational autoencoder, with a Gaussian mixture prior on the latent vector. Each mixture component of the prior distribution corresponds to one of the classes in the data. This enables us to perform selective classification, leading to the rejection of adversarial samples instead of misclassification. Our method inherently provides a way of learning a selective classifier in a semi-supervised scenario as well, which can resist adversarial attacks. We also show how one can reclassify the rejected adversarial samples.