# Towards a Theoretical Understanding of the Robustness of Variational Autoencoders

arXiv: https://arxiv.org/abs/2007.07365 · HTML: https://mlsanity.com/paper/2007.07365/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jul 2020.

## Built on by (most cited first, 17 of 17)

- [Flow Matching in Latent Space](https://mlsanity.com/paper/2307.08698/) (2023)
- [ProtoVAE: A Trustworthy Self-Explainable Prototypical Variational Model](https://mlsanity.com/paper/2210.08151/) (2022)
- [Certifiably Robust Variational Autoencoders](https://mlsanity.com/paper/2102.07559/) (2021)
- [Alleviating Adversarial Attacks on Variational Autoencoders with MCMC](https://mlsanity.com/paper/2203.09940/) (2022)
- [Diagnosing Vulnerability of Variational Auto-Encoders to Adversarial Attacks](https://mlsanity.com/paper/2103.06701/) (2021)
- [Deep Kernel Methods Learn Better: From Cards to Process Optimization](https://mlsanity.com/paper/2303.14554/) (2023)
- [Prototypical Self-Explainable Models Without Re-training](https://mlsanity.com/paper/2312.07822/) (2023)
- [A Closer Look at the Adversarial Robustness of Information Bottleneck Models](https://mlsanity.com/paper/2107.05712/) (2021)
- [Adversarial robustness of VAEs through the lens of local geometry](https://mlsanity.com/paper/2208.03923/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [Generative Modeling: A Review](https://mlsanity.com/paper/2501.05458/) (2024)
- [Chaotic Variational Auto encoder-based Adversarial Machine Learning](https://mlsanity.com/paper/2302.12959/) (2023)
- [PAC-Bayesian Reconstruction Guarantees for Time Series Variational Autoencoders](https://mlsanity.com/paper/2609.05212/) (2026)
- [Variational Autoencoders: A Harmonic Perspective](https://mlsanity.com/paper/2105.14866/) (2021)
- [Variational and Explanatory Neural Networks for Encoding Cancer Profiles and Predicting Drug Responses](https://mlsanity.com/paper/2407.04486/) (2024)
- [Support is All You Need for Certified VAE Training](https://mlsanity.com/paper/2504.11831/) (2025)
- [Revealing Hidden Vulnerabilities in Autoencoders through Gradient Signal Restoration](https://mlsanity.com/paper/2505.03646/) (2025)

## Abstract (arXiv)

We make inroads into understanding the robustness of Variational Autoencoders (VAEs) to adversarial attacks and other input perturbations. While previous work has developed algorithmic approaches to attacking and defending VAEs, there remains a lack of formalization for what it means for a VAE to be robust. To address this, we develop a novel criterion for robustness in probabilistic models: r-robustness. We then use this to construct the first theoretical results for the robustness of VAEs, deriving margins in the input space for which we can provide guarantees about the resulting reconstruction. Informally, we are able to define a region within which any perturbation will produce a reconstruction that is similar to the original reconstruction. To support our analysis, we show that VAEs trained using disentangling methods not only score well under our robustness metrics, but that the reasons for this can be interpreted through our theoretical results.