# Adversarial Robustness of Flow-Based Generative Models

arXiv: https://arxiv.org/abs/1911.08654 · HTML: https://mlsanity.com/paper/1911.08654/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Nov 2019.

## Built on by (most cited first, 8 of 8)

- [Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples](https://mlsanity.com/paper/2302.04578/) (2023)
- [Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models](https://mlsanity.com/paper/2404.09401/) (2024)
- [Adversarial robustness of amortized Bayesian inference](https://mlsanity.com/paper/2305.14984/) (2023)
- [On the Robustness of Quality Measures for GANs](https://mlsanity.com/paper/2201.13019/) (2022)
- [Adversarial Estimation of Topological Dimension with Harmonic Score Maps](https://mlsanity.com/paper/2312.06869/) (2023)
- [Robust Out-of-Distribution Detection on Deep Probabilistic Generative Models](https://mlsanity.com/paper/2106.07903/) (2021)
- [Maximum Likelihood on the Joint (Data, Condition) Distribution for Solving Ill-Posed Problems with Conditional Flow Models](https://mlsanity.com/paper/2208.11782/) (2022)
- [Multi-Scale Architectures Matter: On the Adversarial Robustness of Flow-based Lossless Compression](https://mlsanity.com/paper/2208.12716/) (2022)

## Abstract (arXiv)

Flow-based generative models leverage invertible generator functions to fit a distribution to the training data using maximum likelihood. Despite their use in several application domains, robustness of these models to adversarial attacks has hardly been explored. In this paper, we study adversarial robustness of flow-based generative models both theoretically (for some simple models) and empirically (for more complex ones). First, we consider a linear flow-based generative model and compute optimal sample-specific and universal adversarial perturbations that maximally decrease the likelihood scores. Using this result, we study the robustness of the well-known adversarial training procedure, where we characterize the fundamental trade-off between model robustness and accuracy. Next, we empirically study the robustness of two prominent deep, non-linear, flow-based generative models, namely GLOW and RealNVP. We design two types of adversarial attacks; one that minimizes the likelihood scores of in-distribution samples, while the other that maximizes the likelihood scores of out-of-distribution ones. We find that GLOW and RealNVP are extremely sensitive to both types of attacks. Finally, using a hybrid adversarial training procedure, we significantly boost the robustness of these generative models.