# Defense-VAE: A Fast and Accurate Defense against Adversarial Attacks

arXiv: https://arxiv.org/abs/1812.06570 · HTML: https://mlsanity.com/paper/1812.06570/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Dec 2018.

## Built on by (most cited first, 9 of 9)

- [CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classification](https://mlsanity.com/paper/2502.18176/) (2025)
- [Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Information](https://mlsanity.com/paper/2408.05900/) (2024)
- [Memory Defense: More Robust Classification via a Memory-Masking Autoencoder](https://mlsanity.com/paper/2202.02595/) (2022)
- [DiffDefense: Defending against Adversarial Attacks via Diffusion Models](https://mlsanity.com/paper/2309.03702/) (2023)
- [VQUNet: Vector Quantization U-Net for Defending Adversarial Atacks by Regularizing Unwanted Noise](https://mlsanity.com/paper/2406.03117/) (2024)
- [Chaotic Variational Auto encoder-based Adversarial Machine Learning](https://mlsanity.com/paper/2302.12959/) (2023)
- [Language Guided Adversarial Purification](https://mlsanity.com/paper/2309.10348/) (2023)
- [Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attacks](https://mlsanity.com/paper/2412.03453/) (2024)
- [NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations](https://mlsanity.com/paper/2510.14025/) (2025)

## Abstract (arXiv)

Deep neural networks (DNNs) have been enormously successful across a variety of prediction tasks. However, recent research shows that DNNs are particularly vulnerable to adversarial attacks, which poses a serious threat to their applications in security-sensitive systems. In this paper, we propose a simple yet effective defense algorithm Defense-VAE that uses variational autoencoder (VAE) to purge adversarial perturbations from contaminated images. The proposed method is generic and can defend white-box and black-box attacks without the need of retraining the original CNN classifiers, and can further strengthen the defense by retraining CNN or end-to-end finetuning the whole pipeline. In addition, the proposed method is very efficient compared to the optimization-based alternatives, such as Defense-GAN, since no iterative optimization is needed for online prediction. Extensive experiments on MNIST, Fashion-MNIST, CelebA and CIFAR-10 demonstrate the superior defense accuracy of Defense-VAE compared to Defense-GAN, while being 50x faster than the latter. This makes Defense-VAE widely deployable in real-time security-sensitive systems. Our source code can be found at https://github.com/lxuniverse/defense-vae.