# Certifiably Robust Variational Autoencoders

arXiv: https://arxiv.org/abs/2102.07559 · HTML: https://mlsanity.com/paper/2102.07559/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 39 references that are in the map.
- First posted on arXiv 15 Feb 2021.

## Builds on (most cited first, 28 of 28)

- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [World Models](https://mlsanity.com/paper/1803.10122/) (2018)
- [Generating Diverse High-Fidelity Images with VQ-VAE-2](https://mlsanity.com/paper/1906.00446/) (2019)
- [Certified Adversarial Robustness via Randomized Smoothing](https://mlsanity.com/paper/1902.02918/) (2019)
- [Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples](https://mlsanity.com/paper/1802.00420/) (2018)
- [An Introduction to Variational Autoencoders](https://mlsanity.com/paper/1906.02691/) (2019)
- [Lipschitz regularity of deep neural networks: analysis and efficient estimation](https://mlsanity.com/paper/1805.10965/) (2018)
- [Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers](https://mlsanity.com/paper/1906.04584/) (2019)
- [Adversarial Risk and the Dangers of Evaluating Against Weak Attacks](https://mlsanity.com/paper/1802.05666/) (2018)
- [Sorting out Lipschitz function approximation](https://mlsanity.com/paper/1811.05381/) (2018)
- [Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks](https://mlsanity.com/paper/1802.04034/) (2018)
- [Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation](https://mlsanity.com/paper/1705.08475/) (2017)
- [DARLA: Improving Zero-Shot Transfer in Reinforcement Learning](https://mlsanity.com/paper/1707.08475/) (2017)
- [From Variational to Deterministic Autoencoders](https://mlsanity.com/paper/1903.12436/) (2019)
- [Towards the first adversarially robust neural network model on MNIST](https://mlsanity.com/paper/1805.09190/) (2018)
- [Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networks](https://mlsanity.com/paper/1911.00937/) (2019)
- [Semi-Amortized Variational Autoencoders](https://mlsanity.com/paper/1802.02550/) (2018)
- [Adversarial examples for generative models](https://mlsanity.com/paper/1702.06832/) (2017)
- [Limitations of the Lipschitz constant as a defense against adversarial examples](https://mlsanity.com/paper/1807.09705/) (2018)
- [The continuous Bernoulli: fixing a pervasive error in variational autoencoders](https://mlsanity.com/paper/1907.06845/) (2019)
- [On Implicit Regularization in β-VAEs](https://mlsanity.com/paper/2002.00041/) (2020)
- [Resisting Adversarial Attacks using Gaussian Mixture Variational Autoencoders](https://mlsanity.com/paper/1806.00081/) (2018)
- [Autoencoding Variational Autoencoder](https://mlsanity.com/paper/2012.03715/) (2020)
- [Adversarial Images for Variational Autoencoders](https://mlsanity.com/paper/1612.00155/) (2016)
- [Adversarial Attacks on Variational Autoencoders](https://mlsanity.com/paper/1806.04646/) (2018)
- [Towards a Theoretical Understanding of the Robustness of Variational Autoencoders](https://mlsanity.com/paper/2007.07365/) (2020)
- [A Closer Look at Accuracy vs. Robustness](https://mlsanity.com/paper/2003.02460/) (2020)
- [Improving VAEs' Robustness to Adversarial Attack](https://mlsanity.com/paper/1906.00230/) (2019)

## Built on by (most cited first, 14 of 14)

- [Adversarial robustness of amortized Bayesian inference](https://mlsanity.com/paper/2305.14984/) (2023)
- [Statistical Guarantees for Variational Autoencoders using PAC-Bayesian Theory](https://mlsanity.com/paper/2310.04935/) (2023)
- [SDP-CROWN: Efficient Bound Propagation for Neural Network Verification with Tightness of Semidefinite Programming](https://mlsanity.com/paper/2506.06665/) (2025)
- [Alleviating Adversarial Attacks on Variational Autoencoders with MCMC](https://mlsanity.com/paper/2203.09940/) (2022)
- [Controlling Posterior Collapse by an Inverse Lipschitz Constraint on the Decoder Network](https://mlsanity.com/paper/2304.12770/) (2023)
- [Model Inversion Attack against Transfer Learning: Inverting a Model without Accessing It](https://mlsanity.com/paper/2203.06570/) (2022)
- [Adversarial Robustness in Unsupervised Machine Learning: A Systematic Review](https://mlsanity.com/paper/2306.00687/) (2023)
- [Whispering Under the Eaves: Protecting User Privacy Against Commercial and LLM-powered Automatic Speech Recognition Systems](https://mlsanity.com/paper/2504.00858/) (2025)
- [Vacant Holes for Unsupervised Detection of the Outliers in Compact Latent Representation](https://mlsanity.com/paper/2306.09646/) (2023)
- [Adversarial Robustness of VAEs across Intersectional Subgroups](https://mlsanity.com/paper/2407.03864/) (2024)
- [PAC-Bayesian Reconstruction Guarantees for Time Series Variational Autoencoders](https://mlsanity.com/paper/2609.05212/) (2026)
- [Variational Autoencoders: A Harmonic Perspective](https://mlsanity.com/paper/2105.14866/) (2021)
- [Support is All You Need for Certified VAE Training](https://mlsanity.com/paper/2504.11831/) (2025)
- [On Adversarial Vulnerability of Vision-Language Models through the Lens of Intermediate Spectral Subspaces](https://mlsanity.com/paper/2607.07375/) (2026)

## Abstract (arXiv)

We introduce an approach for training Variational Autoencoders (VAEs) that are certifiably robust to adversarial attack. Specifically, we first derive actionable bounds on the minimal size of an input perturbation required to change a VAE's reconstruction by more than an allowed amount, with these bounds depending on certain key parameters such as the Lipschitz constants of the encoder and decoder. We then show how these parameters can be controlled, thereby providing a mechanism to ensure textita priori that a VAE will attain a desired level of robustness. Moreover, we extend this to a complete practical approach for training such VAEs to ensure our criteria are met. Critically, our method allows one to specify a desired level of robustness upfront and then train a VAE that is guaranteed to achieve this robustness. We further demonstrate that these Lipschitz--constrained VAEs are more robust to attack than standard VAEs in practice.