# Adversarial Robustness of VAEs across Intersectional Subgroups

arXiv: https://arxiv.org/abs/2407.03864 · HTML: https://mlsanity.com/paper/2407.03864/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 10 of its 29 references that are in the map.
- First posted on arXiv 4 Jul 2024.

## Builds on (most cited first, 10 of 10)

- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Auto-Encoding Variational Bayes](https://mlsanity.com/paper/1312.6114/) (2013)
- [Disentangling by Factorising](https://mlsanity.com/paper/1802.05983/) (2018)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Recent Advances in Autoencoder-Based Representation Learning](https://mlsanity.com/paper/1812.05069/) (2018)
- [Adversarial Images for Variational Autoencoders](https://mlsanity.com/paper/1612.00155/) (2016)
- [Certifiably Robust Variational Autoencoders](https://mlsanity.com/paper/2102.07559/) (2021)
- [How many perturbations break this model? Evaluating robustness beyond adversarial accuracy](https://mlsanity.com/paper/2207.04129/) (2022)
- [Semi-FairVAE: Semi-supervised Fair Representation Learning with Adversarial Variational Autoencoder](https://mlsanity.com/paper/2204.00536/) (2022)
- [Improving VAEs' Robustness to Adversarial Attack](https://mlsanity.com/paper/1906.00230/) (2019)

## Built on by (most cited first, 1 of 1)

- [Revealing Hidden Vulnerabilities in Autoencoders through Gradient Signal Restoration](https://mlsanity.com/paper/2505.03646/) (2025)

## Abstract (arXiv)

Despite advancements in Autoencoders (AEs) for tasks like dimensionality reduction, representation learning and data generation, they remain vulnerable to adversarial attacks. Variational Autoencoders (VAEs), with their probabilistic approach to disentangling latent spaces, show stronger resistance to such perturbations compared to deterministic AEs; however, their resilience against adversarial inputs is still a concern. This study evaluates the robustness of VAEs against non-targeted adversarial attacks by optimizing minimal sample-specific perturbations to cause maximal damage across diverse demographic subgroups (combinations of age and gender). We investigate two questions: whether there are robustness disparities among subgroups, and what factors contribute to these disparities, such as data scarcity and representation entanglement. Our findings reveal that robustness disparities exist but are not always correlated with the size of the subgroup. By using downstream gender and age classifiers and examining latent embeddings, we highlight the vulnerability of subgroups like older women, who are prone to misclassification due to adversarial perturbations pushing their representations toward those of other subgroups.