mlsanityData to 7 Oct 2026

Certifiably Robust Variational Autoencoders

arXiv 2102.07559 ↗First posted 15 Feb 2021stat.ML cs.LGcited by 14

Not on the map. Why?

Abstract (arXiv)

We introduce an approach for training Variational Autoencoders (VAEs) that are certifiably robust to adversarial attack. Specifically, we first derive actionable bounds on the minimal size of an input perturbation required to change a VAE's reconstruction by more than an allowed amount, with these bounds depending on certain key parameters such as the Lipschitz constants of the encoder and decoder. We then show how these parameters can be controlled, thereby providing a mechanism to ensure textita priori that a VAE will attain a desired level of robustness. Moreover, we extend this to a complete practical approach for training such VAEs to ensure our criteria are met. Critically, our method allows one to specify a desired level of robustness upfront and then train a VAE that is guaranteed to achieve this robustness. We further demonstrate that these Lipschitz--constrained VAEs are more robust to attack than standard VAEs in practice.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Builds on 28 of its 39 references that are in the map. First posted on arXiv 15 Feb 2021.

Builds on

28 of 39 references.

References · 28

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2018World Modelscited by 1,444
  3. 2019Generating Diverse High-Fidelity Images with VQ-VAE-2cited by 1,376
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  6. 2019An Introduction to Variational Autoencoderscited by 997
  7. 2018Lipschitz regularity of deep neural networks: analysis and efficient estimationcited by 413
  8. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  9. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  10. 2018Sorting out Lipschitz function approximationcited by 211
  11. 2018Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networkscited by 193
  12. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
16 more
  1. 2017DARLA: Improving Zero-Shot Transfer in Reinforcement Learningcited by 147
  2. 2019From Variational to Deterministic Autoencoderscited by 131
  3. 2018Towards the first adversarially robust neural network model on MNISTcited by 104
  4. 2019Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networkscited by 86
  5. 2018Semi-Amortized Variational Autoencoderscited by 83
  6. 2017Adversarial examples for generative modelscited by 58
  7. 2018Limitations of the Lipschitz constant as a defense against adversarial examplescited by 48
  8. 2019The continuous Bernoulli: fixing a pervasive error in variational autoencoderscited by 40
  9. 2020On Implicit Regularization in β-VAEscited by 34
  10. 2018Resisting Adversarial Attacks using Gaussian Mixture Variational Autoencoderscited by 26
  11. 2020Autoencoding Variational Autoencodercited by 24
  12. 2016Adversarial Images for Variational Autoencoderscited by 19
  13. 2018Adversarial Attacks on Variational Autoencoderscited by 19
  14. 2020Towards a Theoretical Understanding of the Robustness of Variational Autoencoderscited by 17
  15. 2020A Closer Look at Accuracy vs. Robustnesscited by 14
  16. 2019Improving VAEs' Robustness to Adversarial Attackcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 2; 2023: 5; 2024: 1; 2025: 3; 2026: 2.

14 papers.

Sort:

By area:

  1. 2023Adversarial robustness of amortized Bayesian inferencecited by 17
  2. 2023Statistical Guarantees for Variational Autoencoders using PAC-Bayesian Theorycited by 16
  3. 2022Alleviating Adversarial Attacks on Variational Autoencoders with MCMCcited by 10
  4. 2025SDP-CROWN: Efficient Bound Propagation for Neural Network Verification with Tightness of Semidefinite Programmingcited by 10
  5. 2023Controlling Posterior Collapse by an Inverse Lipschitz Constraint on the Decoder Networkcited by 7
  6. 2022Model Inversion Attack against Transfer Learning: Inverting a Model without Accessing Itcited by 4
  7. 2023Adversarial Robustness in Unsupervised Machine Learning: A Systematic Reviewcited by 3
  8. 2025Whispering Under the Eaves: Protecting User Privacy Against Commercial and LLM-powered Automatic Speech Recognition Systemscited by 2
  9. 2023Vacant Holes for Unsupervised Detection of the Outliers in Compact Latent Representationcited by 1
  10. 2024Adversarial Robustness of VAEs across Intersectional Subgroupscited by 1
  11. 2026PAC-Bayesian Reconstruction Guarantees for Time Series Variational Autoencoderscited by 1
  12. 2021Variational Autoencoders: A Harmonic Perspectivecited by 0
2 more
  1. 2025Support is All You Need for Certified VAE Trainingcited by 0
  2. 2026On Adversarial Vulnerability of Vision-Language Models through the Lens of Intermediate Spectral Subspacescited by 0