Research map / Adversarial robustness and security / Certified and empirical robustness
Support is All You Need for Certified VAE Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CIVET, a certified training method for VAEs that bounds worst-case reconstruction error by bounding a deterministic decoder over box-shaped latent support sets derived from encoder IBP bounds, with no Lipschitz or fixed-variance constraints.
Problem
Certified robustness of variational autoencoders under adversarial input perturbations: worst-case error over an infinite set of stochastic output distributions is hard to bound in a differentiable way for training.
Approach
Bound worst-case VAE error by selecting a box-shaped latent support set that contains probability mass at least (1-delta) for all reachable Gaussian latent distributions (computed from IBP bounds on encoder mean/std), then bounding the deterministic decoder over that support with IBP; combine several delta-supports in a weighted loss.
Key results
- On FIRE at 25% perturbation, CIVET reaches 13.88 dB certified SNR versus -2.35 dB for standard training and 3.17 dB for PGD.
- On MNIST at epsilon 0.1, CIVET certified MSE is 0.0089 versus 0.1426 for standard training and 0.0648 for PGD.
- On CIFAR-10 at 8/255, CIVET certified MSE is 0.0153 versus 0.0340 at 2/255 for standard training; compared with Lipschitz VAE at 8/255 it achieves 0.0153 vs 0.0267 certified and 0.0062 vs 0.0112 baseline MSE.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with PLCHLDR instead of PGD | FIRE VAE · FIRE, ε=25% | Certified SNR: 3.17 dB -> 13.88 dB | Helped |
| Train with PLCHLDR instead of standard training | FIRE VAE · FIRE, ε=25% | Baseline SNR: 17.79 dB -> 15.82 dB | Hurt |
| Train with PLCHLDR instead of PGD | VAE · MNIST, ε=0.1 | Certified MSE: 0.0648 -> 0.0089 | Helped |
| Train with PLCHLDR instead of standard training | VAE · MNIST, ε=0.1 | Baseline MSE: 0.0023 -> 0.0027 | Hurt |
| Train with PLCHLDR instead of PGD | VAE · CIFAR-10, ε=8/255 | Certified MSE: 0.0760 -> 0.0153 | Helped |
| Train with PLCHLDR instead of standard training | VAE · CIFAR-10, ε=8/255 | Baseline MSE: 0.0041 -> 0.0062 | Hurt |
| Train with PLCHLDR instead of Lipschitz VAE | Fully connected VAE · MNIST, ε=0.3 | Certified MSE: 0.0486 -> 0.0507 | Hurt |
| Train with PLCHLDR instead of Lipschitz VAE | Convolutional VAE · CIFAR-10, ε=8/255 | Certified MSE: 0.0267 -> 0.0153 | Helped |
| Increase the size of the delta set (ablation) | PLCHLDR · FIRE, ε=25% | Baseline SNR | Helped |
| Increase the size of the delta set beyond a point (ablation) | PLCHLDR · FIRE, ε=25% | Certified SNR | Hurt |
| Increase the difference between adjacent delta values (ablation) | PLCHLDR · FIRE, ε=25% | Baseline SNR | Helped |
| Increase the difference between adjacent delta values beyond a point (ablation) | PLCHLDR · FIRE, ε=25% | Certified SNR | Hurt |
Surprising findings
- CIVET's clean (baseline) performance is worse than standard training on FIRE and most vision settings, reflecting a robustness-accuracy tradeoff.
- Certified SNR decreases when the delta set includes a very large delta (e.g., 0.65), even though standard SNR improves.
Limitations
- Support sets restricted to interval (box) domain; zonotope or other shapes may give tighter bounds.
- Assumes single-input adversarial attacks and Gaussian latent distributions; RAFA is a universal perturbation.
- Clean performance degrades relative to standard training, and training is roughly 3x-6x slower than standard training.
Experimental setup
Datasets: MNIST CIFAR-10 wireless channel dataset (10,000 samples)
Benchmarks: MNIST CIFAR-10 wireless FIRE channel estimation dataset
Metrics: certified SNR (dB) certified MSE baseline MSE SNR LSA attack MSE MDA attack MSE RAFA attack SNR
Baselines: Standard training PGD adversarial training Lipschitz VAE FIRE RAFA LSA MDA
Builds on: interval bound propagation functional Lagrangian probabilistic verification Lipschitz VAE SABR
Closest papers by meaning
- Simple and Effective VAE Training with Calibrated Decoders (ICML 2021 · similarity 0.89)
- Improving VAEs' Robustness to Adversarial Attack (ICLR 2021 · similarity 0.89)
- Adversarial Symmetric Variational Autoencoder (NeurIPS 2017 · similarity 0.87)
- Trading off Image Quality for Robustness is not Necessary with Regularized Deterministic Autoencoders (NeurIPS 2022 · similarity 0.86)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.85)
- Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders (ICML 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.