summaries: This paper proposes to learn GMM priors in autoencoders, to be able to construct a generative model. They compare the generation quality of the proposed approach with VAEs using the FID metric. One interesting contribution seems to be the fact that they are using a loss function other than the GMM likelihood to fit the GMM.

summaries: The paper proposes a deterministic autoencoder that imposes a GMM on the latent space to learn a complex multimodal latent space. The model uses two regularizers including the KS distance and a constant covariance term to minimize the discrepancy between the marginal CDF of the empirical posterior and the given GMM prior. The authors provide multiple experimental results to show the reconstruction and sampling quality, deep clustering, and the latent model capability to generate discrete and complex structures such as chemical molecules.

summaries: The author(s) motivate and derive a novel deterministic auto-encoder loss that naturally encourages a multi-model latent representation that follows a GMM. The author(s) motivate and derive this loss using the KS test metric and generalize it to multiple dimensions and multiple modes. Their experiments, whereby they ancestrally resample latent codes show an impressive ability to generate realistic samples.

summaries: The paper builds on the ideas of Ghosh et al 2020 [10] pointing out the equivalence between Gaussian prior VAEs and deterministic AEs with noise inputation and further equivalence with regularized deterministic AEs. Since the original paper [10] needed to estimate the latent distribution ex post with a GMM, the authors here propose to use GMM prior directly and translate this into a deterministic AE with more complex regularization derived from univariate Kolmogorov-Smirnof distance combined with another term for covariance matching.They further propose a heuristic to find a reasonable heyper-parameter setting for the two regularizers. Finally, they show on a battery of experiments (generations over standard image datasets, unsupervised clustering, generating discrete structures) the favourable properties of their method.

abstractText: Variational Autoencoders (VAEs) are powerful probabilistic models to learn representations of complex data distributions. One important limitation of VAEs is the strong prior assumption that latent representations learned by the model follow a simple uni-modal Gaussian distribution. Further, the variational training procedure poses considerable practical challenges. Recently proposed regularized autoencoders offer a deterministic autoencoding framework, that simplifies the original VAE objective and is significantly easier to train. Since these models only provide weak control over the learned latent distribution, they require an ex-post density estimation step to generate samples comparable to those of VAEs. In this paper, we propose a simple and end-to-end trainable deterministic autoencoding framework, that efficiently shapes the latent space of the model during training and utilizes the capacity of expressive multi-modal latent distributions. The proposed training procedure provides direct evidence if the latent distribution adequately captures complex aspects of the encoded data. We show in experiments the expressiveness and sample quality of our model in various challenging continuous and discrete domains. An implementation is available at https://github.com/boschresearch/GMM_DAE.

authors:
L. Baringhaus
N. Henze

title: A consistent test for multivariate normality based on the empirical characteristic function

authors:
V. Berger
M. Sebag

title: Variational Auto-Encoder: not all failures are equal

authors:
F.P. Casale
A. V Dalca
L. Saglietti
J. Listgarten
N. Fusi

title: Gaussian process prior variational autoencoders

venue: Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, page 10390–10401, Red Hook, NY, USA

authors:
X. Chen
D.P. Kingma
T. Salimans
Y. Duan
P. Dhariwal
J. Schulman
I. Sutskever
P. Abbeel

title: Variational lossy autoencoder

authors:
B. Dai
D. Wipf

title: Diagnosing and enhancing vae models

authors:
N. Dilokthanakul
P.A.M. Mediano
M. Garnelo
M.C.H. Lee
H. Salimbeni
K. Arulkumaran
M. Shanahan

title: Deep unsupervised clustering with gaussian mixture variational autoencoders

authors:
Z. Ding
Y. Xu
W. Xu
Y. Yang
M. Welling
Z. Tu

title: Guided variational autoencoder for disentanglement learning

venue: 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 7917–7926

authors:
K.G. Dizaji
A. Herandi
C. Deng
W. Cai
H. Huang

title: Deep clustering via joint convolutional autoencoder embedding and relative entropy minimization

venue: Proceedings of the IEEE international conference on computer vision, pages 5736–5745

title: Learning disentangled joint continuous and discrete representations

venue: NeurIPS

authors:
G. Fasano
A. Franceschini

title: A multidimensional version of the Kolmogorov-Smirnov test

venue: Monthly Notices of the Royal Astronomical Society, 225:155–170

authors:
K. Ghasedi
X. Wang
C. Deng
H. Huang

title: Balanced self-paced learning for generative adversarial clustering network

venue: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 4391–4400

authors:
P. Ghosh
M.S.M. Sajjadi
A. Vergari
M.J. Black
B. Schölkopf

title: From variational to deterministic autoencoders

authors:
T Gneiting
A.E. Raftery

title: Strictly proper scoring rules

venue: prediction, and estimation. Journal of the American Statistical Association, 102:359 – 378

title: A three-dimensional extended Kolmogorov-Smirnov test as a useful tool in astronomy

venue: Astronomy and Astrophysics., 188(1):258–264

authors:
P. Goyal
Z. Hu
X. Liang
C. Wang
E.P. Xing
C. Mellon

title: Nonparametric variational auto-encoders for hierarchical representation learning

venue: 2017 IEEE International Conference on Computer Vision (ICCV), pages 5104–5112

authors:
X. Guo
X. Liu
E. Zhu
J. Yin

title: Deep clustering with convolutional autoencoders

venue: Neural Information Processing

authors:
R. Gómez-Bombarelli
D. Duvenaud
J. Hernández-Lobato
J. Aguilera-Iparraguirre
T. Hirzel
R. Adams
A. Aspuru-Guzik

title: Automatic chemical design using a data-driven continuous representation of molecules

venue: ACS Central Science, 4

authors:
J.R. Hershey
Z. Chen
J. Le Roux
S. Watanabe

title: Deep clustering: Discriminative embeddings for segmentation and separation

venue: In 2016 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP),

authors:
M. Heusel
H. Ramsauer
T. Unterthiner
B. Nessler
S. Hochreiter

title: Gans trained by a two time-scale update rule converge to a local nash equilibrium

venue: NIPS

authors:
J. Irwin
T. Sterling

title: Michael M

venue: Mysinger, Erin S. Bolstad, and R. Coleman. Zinc: A free tool to discover chemistry for biology. Journal of Chemical Information and Modeling, 52:1757 – 1768

authors:
Y. Jeong
H.O. Song

title: Learning discrete and continuous factors of data via alternating disentanglement

venue: International Conference on Machine Learning (ICML)

authors:
P. Ji
T. Zhang
H. Li
M. Salzmann
I. Reid

title: Deep subspace clustering networks

venue: Advances in Neural Information Processing Systems, pages 24–33

authors:
W. Jin
R. Barzilay
T. Jaakkola

title: Junction tree variational autoencoder for molecular graph generation

venue: ICML

authors:
D.P. Kingma
M. Welling

title: Auto-encoding variational bayes

authors:
M.J. Kusner
B. Paige
J.M. Hernández-Lobato

title: Grammar variational autoencoder

venue: Proceedings of the 34th International Conference on Machine Learning - Volume 70, ICML’17, page 1945–1954

authors:
D.B. Lee
D. Min
S. Lee
S.J. Hwang

title: Meta-GMVAE: Mixture of gaussian VAE for unsupervised meta-learning

venue: International Conference on Learning Representations

authors:
Z. Liu
P. Luo
X. Wang
X. Tang

title: Deep learning face attributes in the wild

venue: In Proceedings of International Conference on Computer Vision (ICCV),

authors:
R. Lopes
I. Reid
P. Hobson

title: The two-dimensional kolmogorov-smirnov test

venue: XI International Workshop on Advanced Computing and Analysis Techniques in Physics Research

authors:
X. Lu
J. Gonzalez
Z. Dai
N. Lawrence

title: Structured variationally auto-encoded optimization

venue: Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 3267–3275

authors:
A. Makhzani
J. Shlens
N. Jaitly
I. Goodfellow

title: Adversarial autoencoders

title: Measures of multivariate skewness and kurtosis with applications

authors:
M.Caron
B. Piotr
A. Joulin
M. Douze

title: Deep clustering for unsupervised learning of visual features

venue: In European Conference on Computer Vision,

authors:
Y. Miao
L. Yu
P. Blunsom

title: Neural variational inference for text processing

venue: Proceedings of The 33rd International Conference on Machine Learning, Proceedings of Machine Learning Research, pages 1727–1736

authors:
S. Mukherjee
H. Asnani
E. Lin
S. Kannan

title: Clustergan: Latent space clustering in generative adversarial networks

venue: Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 4610–4617

authors:
Y. Netzer
T. Wang
A. Coates
A. Bissacco
B. Wu
A. Ng

title: Reading digits in natural images with unsupervised feature learning

authors:
A. Oord
O. Vinyals
K. Kavukcuoglu

title: Neural discrete representation learning

title: Two-dimensional goodness-of-fit testing in astronomy

venue: Monthly Notices of the Royal Astronomical Society, 202(3):615–627

authors:
V. Prasad
D. Das
B. Bhowmick

title: Variational clustering: Leveraging variational autoencoders for image clustering

authors:
Y. Pu
Z. Gan
R. Henao
X. Yuan
C. Li
A. Stevens
L. Carin

title: Variational autoencoder for deep learning of images

venue: labels and captions. In D. Lee, M. Sugiyama, U. Luxburg, I. Guyon, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 29. Curran Associates, Inc.

authors:
A. Razavi
A. Oord
O. Vinyals

title: Generating diverse high-fidelity images with vq-vae-2

authors:
F. Tian
B. Gao
Q. Cui
E. Chen
T.-Y. Liu

title: Learning deep representations for graph clustering

venue: Twenty-Eighth AAAI Conference on Artificial Intelligence

authors:
I. Tolstikhin
O. Bousquet
S. Gelly
B. Schoelkopf

title: Wasserstein auto-encoders

venue: arXiv preprint arXiv:1711.01558

authors:
J.M. Tomczak
M. Welling

title: Vae with a vampprior

venue: AISTATS

authors:
H. Xiao
K. Rasul
R. Vollgraf

title: Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms

authors:
J. Xie
R.Girshick
A. Farhadi

title: Unsupervised deep embedding for clustering analysis

venue: In International conference on machine learning,

authors:
B. Yang
X. Fu
N. D Sidiropoulos
M. Hong

title: Towards k-means-friendly spaces: Simultaneous deep learning and clustering

venue: Proceedings of the 34th International Conference on Machine Learning-Volume 70, pages 3861–3870. JMLR. org

authors:
M. Zhang
S. Jiang
Z. Cui
R. Garnett
Y. Chen

title: D-vae: A variational autoencoder for directed acyclic graphs

authors:
B. Zong
Q. Song

title: M

venue: Renqiang M., W. Cheng, C. Lumezanu, D. k. Cho, and H. Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In ICLR

heading: 1 Introduction

text:
Variational autoencoders (VAEs) constitute one of the popular generative learning frameworks widely used for applications such as image understanding and generation, sentence modeling, and optimizing discrete data and graph-based structures [7, 23, 34, 40, 48]. The VAE framework elegantly combines autoencoders with variational inference [24]. The encoder of the model maps the input data into a lower-dimensional latent space according to a given inference model. The decoder provides a mapping from the latent space back to the original input space. Both are jointly optimized by maximizing a lower bound on the model evidence, regularizing the latent space towards a fixed prior distribution, usually a uni-modal Gaussian. By sampling from the latent space prior, we can utilize the decoder network to efficiently generate new samples from the training distribution. Due to the variational formulation, optimizing the VAE training objective poses significant practical challenges. Further, the over simplistic prior assumption often leads to an unsatisfying trade-off between the quality of reconstructed samples and the prior regularization [2]. Recent work has shown that choosing more flexible priors helps to improve the generative performance of VAEs [44].
Since the initial introduction of VAEs, various novel training objectives have been proposed. One line of work focuses on different regularization techniques derived from alternative probabilistic metrics to shape the latent space of the model during training, e.g. using the Wasserstein distance [43]. In contrast to the KL-divergence, the Wasserstein distance measure induces a metric on probability
35th Conference on Neural Information Processing Systems (NeurIPS 2021).
distributions. Practically, this facilitates smoother convergence even for initially non-overlapping distributions. Further, it overcomes the over-regularization effect in VAEs. To be precise, it prevents the undesired behaviour of multiple data points being mapped to the same latent representation by the encoder. Since closed-form solutions for metrics like the Wasserstein distance can only be derived for very few prior distributions, these approaches rely on numerical approximations during training.
Recent work by Ghosh et al. [12] reinterprets deterministic autoencoders as variational models, even when trained with a deterministic loss. During training, this approach maximizes the negative log-marginal likelihood of the latent samples under a Gaussian normal distribution as a regularization in addition to minimizing the reconstruction loss. Experimental results show that this regularization alone does not suffice to generate high quality samples using the Gaussian prior. To overcome this, Gosh et al. propose to use a multi-modal Gaussian mixture model (GMM) to fit arbitrary, learned latent spaces. While this approach leads to good sampling efficiency and generalization if the post-hoc fit is reasonable, sampling quality can suffer significantly if the learned latent space can not be modeled well by a GMM.
In this work, we propose a deterministic training scheme for autoencoders that is applicable to expressive priors and overcomes the necessity of a post-hoc density estimation step for deterministic training. To be precise, we derive a deterministic regularization loss from the distance metric used in the non-parametric Kolmogorov-Smirnov (KS) test for equality of probability distributions. The resulting training objective can be derived in closed form for a class of expressive multi-modal prior distributions and provides a strong signal to efficiently shape the latent space of the model during training. We chose our experiments to evaluate the proposed approach in terms of sampling quality and expressiveness. In the first line of experiments, we compare the quality of newly generated and reconstructed samples from our model with those from a variety of other VAE variants. In the second line, we investigate our method’s capability to model discrete and complex structured inputs such as arithmetic expressions and molecules. In these domains, VAEs have recently been proposed as a tool for dimensionality reduction in optimization. Applying our regularization scheme effectively utilizes multi-modal prior distributions in this context and significantly improves optimization performance.

heading: 2 Related Work

text:
Since the introduction of VAEs, many follow up works tried to overcome the practical and theoretical limitations of the framework, e.g. [2, 43, 44], and make them applicable to specific applications such as clustering [6, 39] or anomaly detection [49]. We first review some seminal examples of VAE models with different priors and probability metrics for latent regularization. Since our proposed regularization term structures the latent space to a Gaussian mixture model, we also compare it to prior work on deep clustering. Lastly, we discuss VAEs in the context of black-box optimization approaches such as Bayesian Optimization (BO).
VAEs In the standard VAE framework, the prior distribution is commonly assumed to be a Gaussian normal distribution. This might lead to simplified representations learned by the model which is unable to represent the rich semantics in the data distribution. Several methods were proposed to introduce more flexible and expressive priors to the VAE formulation. Casale et al. [3] employ Gaussian process priors to account for correlations between the data samples. In [15], a Bayesian non-parametric prior is used with a hierarchical non-parametric variational autoencoder for video representation learning. Chen et al. [4] use an auto-regressive prior to achieve improved generative performance on image datasets. Berger et al. [2] propose to replace the standard spherical Gaussian prior with a more general version with an arbitrary covariance matrix and learn the correlations by optimizing the evidence lower bound of the model. Although the proposed methods offer competitive performance, they often employ complex architectures [4] to achieve desired performance.
In another line of work, multi-modal priors were utilized in VAE models. Zong et al. [49] propose to use a GMM prior in autoendocers for unsupervised anomaly detection by training an additional network estimating the parameters of the GMM. Lee et al. [27] address unsupervised meta-learning using a GMM prior in VAEs to shape the latent space by employing an extension of the evidence lower bound to complex variational inference schemes. Tomczak et al. [44] propose to replace the GMM prior by a coupling of the posterior and prior of the model. Adversarial autoencoders [31] improve the generative performance of VAEs by incorporating adversarial learning into the VAE framework and offer competitive performance in image generation at an increased computational complexity and
decreased training stability. To account for the over regularization effect of the KL divergence term in the standard VAE framework, [43] minimize the Wasserstein distance between the representations learned by the model and the target prior. Recently introduced regularized autoencoders [12](RAEs), question the variational framework adopted by the VAEs and propose a deterministic approach to achieve comparable or better image generation performance. The authors use the negative log likelihood for regularization, but require a post-hoc step to derive a strong sampling procedure from the model. The state of the art VAE model for high fidelity image generation, VQ-VAE [37, 41], can be also considered as a deterministic autoencoder. Similar to RAEs, training VQ-VAE involves two stages of training relying on complex discrete autoregressive density estimators. Moreover, the training loss of VQ-VAE is non-differentiable due to the quantization of the latent vector.
Our approach elegantly combines the idea of new training objectives with the extension to multimodal priors without increasing training complexity or compromising sampling quality. We derive a strong training signal which can be derived in closed form for multimodal priors. This ensures stable training and reliable regularization of the latent space, improving sampling quality.
Deep Clustering Deep Clustering approaches benefit from well structured latent spaces. Thus, several methods employ Gaussian mixture VAEs for data encoding [6, 39] or establish a GMM-like latent space structure through k-means models in the latent space. For example, Xie et al. [46] train an autoencoder and apply a KL-divergence loss for better k-means clustering while Ghasedi et al. [8] combine the autoencoder reconstruction loss with the relative cluster entropy. Similar approaches have been proposed in the literature [8, 16, 18, 22, 42, 47]. Caron et al. [33] iteratively group points using k-means during optimization. In the context of clustering, generative adversarial networks have been considered in [11, 35]. While we are not considering the clustering task in this paper, we hypothesise that the proposed regularization can be beneficial in this context since it implicitly optimizes for mode assignments.
Structural VAEs and optimization High-dimensional optimization problems in structured discrete input domains are ubiquitous. VAEs have been used in this context to learn low dimensional, continuous representations of high dimensional, structured data like molecules or arithmetic expressions. Recent work proposes to use such representations to perform efficient optimization by running BO in the latent space of VAEs [25, 30]. In this setting, prior knowledge of the structure of the latent space is crucial to allow for an efficient exploration and generation of valid samples. Yet, as discussed above, VAEs can suffer from simplistic prior assumptions. Thus, sampling from the latent space of such models can result in invalid samples, reducing the sampling efficiency of BO [17]. Kusner et al. [25] overcome this issue if data follows a specific grammar. Lu et al. [30] propose a VAE that directly works on parse trees from context-free grammars to represent discrete data. Yet, those only work with unimodal priors which limits the generalization capabilities. Our approach can be readily used to extend these models to better encode structural data and improve BO performance.

heading: 3 Method

text: We introduce a novel loss function to regularize the latent representation learned by deterministic autoencoders towards a given prior distribution. The definition of our loss builds on the non-parametric statistical Kolmogorov-Smirnov (KS) test for equality of one-dimensional probability distributions. We propose a multivariate variant of the distance measure used in the KS test, that allows for gradient based optimization and can easily be applied to expressive multi-modal prior distributions. For ease of exposition, we start with introducing our regularization loss for unimodal Gaussian priors in section 3.1 and extend the formulation to expressive multi-modal Gaussian mixture models in Section 3.2. Finally, in Section 3.3, we provide an explicit way to estimate the weighting parameters of our loss.

heading: 3.1 Uni-Modal latent regularization

text:
The KS test can be used to determine whether a collection of N , one-dimensional samples follow a given reference distribution. It compares the cumulative distribution function (CDF) of the reference distribution with the empirical CDF F̄ (N) of the samples. It is often applied to the class of one-dimensional Gaussian distributions, which has important analytical properties. For spherical Gaussians, the one-dimensional KS test quantifies a distance between the empirical distribution
function of the data and the cumulative distribution function
Φ(z) = 1
σ √ 2π ∫ x −∞ exp −(t− µ)2 2σ2 dt (1)
of the univariate Gaussian Z ∼ N (µ, σ) as supz∈R |F̄ (N)(z)− Φ(z)|. Extending this KS distance to higher dimension is particularly challenging, since it requires matching joint CDFs [10, 14, 38]. Especially in higher dimensions this becomes infeasible [29]. The continuous ranked probability score [13] shares the same theoretical basis as the KS distance. However it tests whether two sets of samples are consistent with each other, i.e., they could originate from the same distribution, and is thus not suitable to regularize a collection of latent samples towards a given prior distribution. Alternative multi-variate normality tests, like the Mardia test [32] and the BEHP test [1] suffer from slow convergence rates.
To derive a regularization loss from the KS distance, we propose to overcome this issue by taking into consideration the marginal CDFs and correlations in the prior distribution separately. Given d-dimensional latent samples z1, . . . , zN , the empirical marginal CDF in dimension j is given by
F̄ (N) j (z) =
1
n N∑ n=1 1[zn]j≤z. (2)
We aim to regularize the latent space of our models by comparing the empirical marginal CDFs with the one-dimensional CDFs of the marginal distributions of the prior. To strengthen the training signal of our regularization scheme and make it suitable for gradient-based optimization, we replace the supremum in the original KS distance by a smoother MSE loss, that compares the distances between those functions at the latent representations. For a uni-modal Gaussian prior with mean µ and covariance matrix Σ, this results in
LKS(z1,...,N ) = 1
d d∑ j=1 MSE ( F̄ (N) j (zj),Φ(z̄j) ) , z̄j = zj − µj [Σ]j,j . (3)
Here, F̄ (N)j (zj) denotes the vector with entries F̄ (N) j ([zi]j) and Φ(z̄j) is defined accordingly. This loss is minimized, if the empirical marginal CDFs of the latent samples match those of the uni-modal Gaussian prior. Using the above loss alone will not account for correlations between different latent dimensions. In the case of a spherical Gaussian prior with identity covariance matrix for example, samples with perfectly correlated Gaussian components [zi]j = [zi′ ]j , will also minimize this objective, see Figure 1. To overcome this problem, we equip our loss with an additional term, that matches covariances between different latent distributions explicitly. Following a similar reasoning to the MSE above, we define an additional loss term,
LCV(z1,...,N ) = 1
d2 d∑ l,j=1 ( [Σ̄]l,j − [Σ]l,j )2 , (4)
where Σ̄ is the empirical covariance matrix of the latent representations and Σ stands for the prior covariance. Compared to the negative log marginal regularization proposed in [12], our loss will actually enforce the latent representations to be spread across the entire support of the Gaussian prior, instead of being minimal when all latent collapse to the origin.

heading: 3.2 Multi-Modal latent regularization

text:
One advantage of our approach is the applicability to more expressive, multi-modal prior distributions. While the Gaussian distribution has important analytical properties, it suffers from significant limitations when modelling real data sets. In contrast, a linear combination of Gaussians can give rise to very complex densities while still allowing for closed form computations of important quantities, like CDFs and covariances. A d-dimensional K-modal Gaussian mixture model is a weighted superposition of K Gaussian distributions in Rd, that are often referred to as the modes of the model. For k ≤ K, let µk and Σk be the mean and covariance matrix of the k-th mode in the model. Further, let pk > 0 be the weight of the k-th mode. Then, the marginal CDFs of a GMM model can be computed
w ei
gh te
d la
te nt
re gu
la ri
za tio n K S di st an ce
from the CDFs of univariate Gaussians as follows
FGMM,j(z) = K∑ k=1 pkΦ ( z − [µk]j [Σ]j,j ) , (5)
i.e. the marginal CDFs in the GMM are weighted sums of CDFs of one-dimensional Gaussians. The covariance matrix of the GMM can be computed as
ΣGMM = K∑ k=1 pkΣk + K∑ k=1 pk (µk − µ̄) (µk − µ̄) T , µ̄ = 1 k K∑ k=1 µk. (6)
Extending our proposed regularization scheme to multimodal GMMs is straight forward. Our first loss term is defined as
LKS,K(z1,...,N ) = 1
d d∑ j=1 MSE ( F̄ (N) j (zj), FGMM,j(zj) ) . (7)
Similarly, the second loss term is defined to be
LCV,K(z1,...,N ) = 1
d2 d∑ l,j=1 ( [Σ̄]l,j − [ΣGMM]l,j )2 . (8)
The total loss of the model is a combination of the reconstruction loss and a regularization loss, that enforces the latent representations of the encoded data to match a predefined multi-modal prior distribution. The reconstruction loss LREC(x′1,...,N ) equals the mean squared error between inputs xi and their reconstructions x′i. Given positive weights λKS and λCV, our final loss is given by
L(x1,...,N ) = λRECLREC(x′1,...,N ) + λKSLKS,K(z1,...,N ) + λCVLCV,K(z1,...,N ). (9)
Formally, the weights λKS, λCV and λREC are hyperparameters of the model. Nevertheless, we propose an explicit way to set λKS and λCV and a simple heuristic to estimate λREC to avoid an extensive optimization of these weights.

heading: 3.3 Loss weight estimation

text:
Balancing the two regularization losses appropriately poses a key challenge as they potentially vary on very different scales. For example, if modes of the GMM prior are far spread, the covariance LCV,K loss will dominate the marginal CDF LKS,K loss by far. Nevertheless, given a target GMM prior, the
dimension of the latent space and the batch size n used during training, there is a concise way to fix those hyperparameters beforehand. To be precise, for m = 1, . . . ,M samples z(m)1 , . . . , z (m) N from the prior GMM, we propose to set
λ−1KS = 1
M LKS
( z (m) 1,...,N ) , λ−1CV = 1
M LCV
( z (m) 1,...,N ) . (10)
Formally, we can not overcome the necessity of tuning the weight of the reconstruction loss, which has significant impact on performance of the model. Nevertheless, a reasonable approximation to it can be obtained by training an autoencoder model and using the inverse of the best obtained loss for λREC. Using this scaling, all loss terms in our regularization loss will ultimately converge to one if the target prior is matched successfully.

heading: 4 Experiments

text: With our experiments we strive to investigate the potential of the proposed model when compared to other VAE variants in generating new samples, analyse the effect of the defined prior to effectively cluster the latent space and to shape the latent space efficiently in highly structured domains such as discrete spaces. We provide all the experimental settings and hyperparameters used in the Appendix. All experiments were run on a GPU cluster, with single GPU per individual experiments. Since the cluster is part of a carbon-neutral framework, these experiments did not contribute to climate change.

heading: 4.1 Image generation

text:
We consider four dataset, MNIST [26], FASHIONMNIST [45], SVHN [36] and CELEBA [28] to evaluate the proposed method in image generation experiments. The qualitative analysis of the generated samples for MNIST, SVHN amd CELEBA images are shown in Figure 2 along with the reconstructed samples and interpolated samples in the latent space of the trained model. In order to assess the quality of the generated images, we evaluate the Fréchet Inception Distance (FID) [19] for each dataset, see Table 1. For baseline comparison, we evaluate the following models: vanilla variational autoencoder (VAE [24]), Gaussian mixture variational autoencoder (GMVAE) [6], Wasserstein autoencoder (WAE) [43] with MMD loss, 2stage VAEs (2s-VAE) [5], constant variance-VAE (CV-VAE) [12] and regularized autoencoders (RAEs) [12]. We consider the following evaluation metrics: 1. Sampling FID (Samp.) - FID score of the generated random samples (evaluated by generating random samples from the prior distribution of the respective models and by fitting a Gaussian distribution to models trained without any prior assumptions), 2. reconstruction FID (Rec.) - measured by computing the FID between the test samples and their corresponding reconstructions by the model and 3. interpolation FID (Inter.) - measured by computing the FID between the interpolated samples in the latent space and test samples. As pointed out by [12], fitting an ex-post density estimator on the learned embedding after training of VAEs further improves the generation quality. Hence, we also report the FID values by fitting a GMM in the learned latent space of the trained model (GMM column in Table 1, not evaluated for 2s-VAE as they perform ex-post density estimation using another VAE).
As shown in Table 1, our method achieves better FIDs (Samp.) on all datasets considered, when compared to all considered baselines sampled by fitting a single Gaussian in the latent space. We also improved the generation quality as argued above by fitting a mixture of Gaussians in the latent space and achieve better FIDs in MNIST, FASHION MNIST and CELEBA images, whereas for SVHN, WAEs achieved the overall best score. It is also important to note that the proposed method performs comparably or even better without employing the ex-post density estimation. The proposed method also achieves better reconstruction quality than the other VAEs except for SVHN images where RAEs performs better. The interpolation FID indicates the overall structure of the learned latent space and the obtained FID values show that the proposed method shapes the latent space better than the other approaches except for the CELEBA images where RAEs performs slightly better than our method. For a fair comparison, we use the same architecture and experimental settings in all the considered baseline evaluations. Please refer to the Appendix for more details on the experimental settings.

heading: 4.2 Unsupervised image clustering

text:
We evaluate the potential of our method to naturally cluster the data points in the learned latent space in two dataset, MNIST and FASHION-MNIST. The Gaussian mixture model prior with k
components in our method could be considered as k different classes/clusters to which the data points are mapped by the encoder. We train the model with latent space dimension 10 for both dataset and visualize the random samples generated from each Gaussian component of our prior as shown in Figure 3. The figure shows that visually similar images fall into the same cluster. For a quantitative analysis of the clustering performance, we evaluated the unsupervised classification accuracy (similar to [21]) and compare the performance with JointVAE [9] and CascadeVAE [21]. The observed values are reported in the table in Figure 4. We observed a comparable performance to both baselines. We also observed that the distance between the modes in the GMM prior is a deciding factor in better clustering performance. Figure 4 (right) shows the performance comparison of both image generation
and clustering performance with increasing distance between different modes in the GMM prior. The result shows that with increasing distance, the clustering performance is improved wheres the quality of the generated images gets reduced. Our experimental analysis indicates that natural clustering happens with the multi-modal GMM prior in our method.

heading: 4.3 Modelling discrete data structures

text:
In this section, we investigate the ability of our model to generate complex discrete data structures such as arithmetic expressions and molecules. The objective of this experiments is to analyze the model performance on shaping the latent space of such structured discrete spaces effectively. The learned latent space of the model is traversed to generate new samples with the desired properties by performing Bayesian Optimization (BO). We perform experiments in two sequence optimization problems similar to [25].
Arithmetic Expression Given a dataset of 50, 000 univariate (functions of x) arithmetic expressions following a formal grammar [25], the task is to find the expression that best fits a target dataset. This is done by minimizing log(1 + MSE), where the MSE is computed between values of the generated expression and the target points. For our evaluation, we choose similar target data points as in [25].
Chemical Design Given the ZINC250k dataset of drug molechules [20], the objective is to generate new drug like molecules. The drug likeliness of a molecule is quantified by the water-octanol partition coefficient, which is maximized in our line of experiments.
Results We extend the architecture and experimental settings of [25] to include our proposed losses during training. For baseline comparison, we consider Grammar VAE (GVAE) [25], Character VAE (CVAE) [17], Grammar constant variance VAE (GCVVAE) [12] and Grammar based RAE (GRAE) [12] frameworks. The three best scores found by our method for arithmetic expressions and the molecule experiments are reported in Table 2. Our model performs comparatively better than the considered baselines and achieves the best first score for both tasks. In addition to the optimization performance, it is also important to consider the validity of the new samples generated by the models. A well-structured latent space should yield valid samples following the defined grammar/rules of the used dataset. Our model achieves better validation and average scores as shown in Table 3 except for GCVVAE which achieves a better average score in the arithmetic expression task. All reported values are evaluated by averaging across 5 BO trials.

heading: 4.4 Ablation study and hyperparameter sensitivity analysis

text:
We perform an ablation study on the regularization loss terms in the proposed model. When the model is trained without the KS distance loss for MNIST images, we observed an FID of 49.82 and when trained without the covariance matching loss, we observed an FID of 38.45. These values are significantly worse than the FID that we achieve when training with the weighted combination of both regularization losses i.e 13.11. These empirical evaluations show that the combination of the two regularization terms facilitates a better prior-posterior match and hence better image generation. Please refer to the Appendix for qualitative evaluation of the ablation study on MNIST images.
From a conceptual point of view, the most important hyperparameters of our model are (a) the weights of the different terms in the training objective and (b) the number of components in the prior. In section 3.4, we propose an explicit way how to fix the weights in the loss function. We investigate the sensitivity of our model performance to the number of components in the GMM prior. We trained our model on the MNIST dataset using a GMM prior with 1, 5, 10, 15, 20 and 25 modes respectively. The observed FID scores for the respective number of components are shown in Figure 5. The result show that with increasing number of components in the chosen prior, the performance of our model improves significantly. As a consequence, choosing a large number of components can be beneficial for practical considerations.

heading: 5 Limitations and Future Work

text:
One limitation of our work is the necessity to chose the prior distribution in advance. We showed that fixing a suitable number of modes for the GMM is important to provide better sampling quality. Also, by considering marginal CDFs, we simplified the original distance metric from the KS test. While reducing computational complexity during training, this comes at the cost of an additional loss term. Further, our proposed addition of the KS distance is not suitable for matching higher order moments of the latent representations to the target prior, which at least from a conceptual point of view can lead to a mismatch to the prior. Further, our loss only facilitates matching empirical marginal CDFs of latent representations to the marginal CDFs of the prior evaluated at latent vectors. As a consequence, our regularization loss might be a less stable training signal for small batch sizes in high dimensions.
Using the Frobenius norm in the covariance matching loss reflects our assumption that the latent dimensions should all be independent from each other and should all simultaneously match the prior’s values. The choice for the MSE for covariance matching loss is purely based on its prevalence in the literature. Additionally, this makes all three loss terms (reconstruction loss, KS distance loss and the covariance matching loss) behave similarly, as they are all squares. While we did not investigate any other metrics for matrix comparison in this scenario, exploring other options for the covariance matching is an interesting area for future studies. We have not considered the case where there exists class imbalance in the dataset. We would expect the model to separate the classes if the imbalance is weak and the classes are sufficiently different such that the reconstruction loss outweighs the regularization penalty for the mismatch. Extending our prior to accommodate for this by introducing a weighted GMM prior is also a very interesting direction for future work.

heading: 6 Conclusion

text: Recent studies have illustrated the effectiveness of flexible priors in VAEs to learn more meaningful latent representations. Following recent work that highlights the potential of deterministic alternatives to the variational formulation in VAEs, we propose a simple deterministic autoencoding framework with more powerful regularizers to accommodate for expressive multi-modal priors. In particular, we derive a novel deterministic regularization scheme from a strong metric on probability distributions. The proposed approach can be readily applied to effectively shape the latent space of existing autoencoding frameworks towards multi-modal Gaussian priors. Our experimental evaluations show that the proposed training objective yields comparable sampling quality to those of variational autoencoders and achieves better performance in modelling complex discrete data structures.

title: Shape your Space: A Gaussian Mixture Regularization Approach to Deterministic Autoencoders


summaries: This paper presents a method to detect adversarial examples by disentangling the representation. This is done by training autoencoders over both correct and incorrect class/semantic features. The authors claim that the proposed method outperformed other SOTA methods for adversarial detection and even works against adaptive adversarial attacks.

summaries: The paper propose a new defense mechanism against adversarial attacks based on an autoencoder architecture. The proposed architecture uses self-supervised learning to disentangle the semantic and class features, which enables the autoencoder to discriminate the clean and adversarial examples at test time. The approach was shown to outperforms other autoencoder approach in the experiments, when the attacker as access to only the victim model or both the victim model and autoencoder.

summaries: The paper proposes a novel adversarial example detection strategy based on disentangled latent representations. The main idea is that latents are separated into class features and semantic features. Detection then uses the fact that adversarial samples preserve semantics while at the same time changing class according to some victim model. Training is being performed through a sophisticated combination of losses accounting for begin examples and counterexamples. Experimental results on detecting various kinds of attacks on popular datasets show clear improvements over previous methods. The paper also presents an evaluation of an adaptive attack.

summaries: This paper proposes to detect adversary using learned disentangled auto-encoder. The model can disentangle the class feature and the semantic feature. Class features are easily changed by adversary, while the semantic features cannot. Existing Auto-Encoder cannot disentangle those two types of features, and also has strong generalization ability---high performance on both the adversary and the benign examples, making it hard to detect. Using the proposed disentangled AE, benign example can be reconstructed faithfully while adversary examples cannot. Thanks to the tailored AE, the paper state-of-the-art adversarial detection performance on MNIST, Fashion-MNIST, and CIFAR-10 in most cases.

abstractText: Deep learning models are known to be vulnerable to adversarial examples that are 1 elaborately designed for malicious purposes and are imperceptible to the human 2 perceptual system. Autoencoder, when trained solely over benign examples, has 3 been widely used for (self-supervised) adversarial detection based on the assump4 tion that adversarial examples yield larger reconstruction error. However, because 5 lacking adversarial examples in its training and the too strong generalization ability 6 of autoencoder, this assumption does not always hold true in practice. To alleviate 7 this problem, we explore to detect adversarial examples by disentangled represen8 tations of images under the autoencoder structure. By disentangling input images 9 as class features and semantic features, we train an autoencoder, assisted by a 10 discriminator network, over both correctly paired class/semantic features and in11 correctly paired class/semantic features to reconstruct benign and counterexamples. 12 This mimics the behavior of adversarial examples and can reduce the unnecessary 13 generalization ability of autoencoder. We compare our method with the state-of14 the-art self-supervised detection methods under different adversarial attacks and 15 different victim models (30 attack settings), and it exhibits better performance in 16 various measurements (AUC, FPR, TPR) for most attack settings. Ideally, AUC is 17 1 and our method achieves 0.99+ on CIFAR-10 for all attacks. Notably, different 18 from other Autoencoder-based detectors, our method can provide resistance to the 19 adaptive adversary. 20

authors:
C. Szegedy
W. Zaremba
I. Sutskever
J. Bruna
D. Erhan
I. Goodfellow
R. Fergus

title: Intriguing 300 properties of neural networks

authors:
I.J. Goodfellow
J. Shlens
C. Szegedy

authors:
S.-M. Moosavi-Dezfooli
A. Fawzi
P. Frossard

title: DeepFool: A simple and accurate method to fool 304 deep neural networks

authors:
N. Carlini
D. Wagner

authors:
A. Madry
A. Makelov
L. Schmidt
D. Tsipras
A. Vladu

title: Towards deep learning models resistant to 308 adversarial attacks

authors:
K. Roth
Y. Kilcher
T. Hofmann

title: The odds are odd: A statistical test for detecting adversarial 310 examples

authors:
K. Grosse
P. Manoharan
N. Papernot
M. Backes
P. McDaniel

title: On the (statistical) detection of 312 adversarial examples

authors:
K. Lee
K. Lee
H. Lee
J. Shin

title: A simple unified framework for detecting out-of-distribution samples 314 and adversarial attacks

authors:
D. Hendrycks
K. Gimpel

authors:
J. Tian
J. Zhou
Y. Li
J. Duan

title: Detecting adversarial examples from sensitivity inconsistency of 319 spatial-transform domain

authors:
D. Meng
H. Chen

authors:
C. Chen
J. Liu
Y. Xie
Y.X. Ban
C. Wu
Y. Tao
H. Song

title: Latent Regularized Generative Dual 323 Adversarial Network For Abnormal Detection

authors:
D. Gong
L. Liu
V. Le
B. Saha
M.R. Mansour
S. Venkatesh
A. v. d. Hengel

title: Memorizing normality 325 to detect anomaly: Memory-augmented deep autoencoder for unsupervised anomaly detection

authors:
G. Vacanti
A. Van Looveren

authors:
B. Wójcik
P. Morawiecki
M. Śmieja
T. Krzyżek
P. Spurek
J. Tabor

title: Adversarial examples detection 330 and analysis with layer-wise autoencoders

authors:
Y. Qin
N. Frosst
S. Sabour
C. Raffel
G. Cottrell
G. Hinton

title: Detecting and diagnosing adversarial 332 images with class-conditional capsule reconstructions

authors:
L. Schott
J. Rauber
M. Bethge
W. Brendel

title: Towards the first adversarially robust neural network 334 model on MNIST

authors:
A. Kurakin
I. Goodfellow
S. Bengio

title: Adversarial machine learning at scale

venue: 337 in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3–14, 2017. 338

authors:
J. Lu
T. Issaranon
D. Forsyth

authors:
R. Feinman
R.R. Curtin
S. Shintre
A.B. Gardner

authors:
X. Ma
B. Li
Y. Wang
S. Erfani
S. Wijewickrema
M. Houle
G. Schoenebeck
D. Song
J. Bailey

title: Magnet and "efficient defenses against adversarial attacks" are not robust to 345 adversarial examples

authors:
X. Chen
Y. Duan
R. Houthooft
J. Schulman
I. Sutskever
P. Abbeel

title: Infogan: Interpretable 347 representation learning by information maximizing generative adversarial nets

authors:
M. Sang
W. Xia
J.H. Hansen

title: Deaan: Disentangled embedding and adversarial adaptation network 350 for robust speaker representation learning

authors:
L. Tran
X. Yin
X. Liu

authors:
A. Ilyas
S. Santurkar
D. Tsipras
L. Engstrom
B. Tran
A. Madry

title: Adversarial examples are not 354 bugs, they are features

authors:
C. Xiao
B. Li
J.-Y. Zhu
W. He
M. Liu
D. Song

title: Generating adversarial examples with adversarial 356 networks

authors:
Y. LeCun
L. Bottou
Y. Bengio
P. Haffner

title: Fashion-MNIST: A novel image dataset for benchmarking machine 360 learning algorithms

authors:
A. Krizhevsky
G. Hinton

authors:
J. Rauber
W. Brendel
M. Bethge

title: Foolbox: A python toolbox to benchmark the robustness of 363 machine learning models

text:
Deep learning models are known to be vulnerable to adversarial examples that are1 elaborately designed for malicious purposes and are imperceptible to the human2 perceptual system. Autoencoder, when trained solely over benign examples, has3 been widely used for (self-supervised) adversarial detection based on the assump-4 tion that adversarial examples yield larger reconstruction error. However, because5 lacking adversarial examples in its training and the too strong generalization ability6 of autoencoder, this assumption does not always hold true in practice. To alleviate7 this problem, we explore to detect adversarial examples by disentangled represen-8 tations of images under the autoencoder structure. By disentangling input images9 as class features and semantic features, we train an autoencoder, assisted by a10 discriminator network, over both correctly paired class/semantic features and in-11 correctly paired class/semantic features to reconstruct benign and counterexamples.12 This mimics the behavior of adversarial examples and can reduce the unnecessary13 generalization ability of autoencoder. We compare our method with the state-of-14 the-art self-supervised detection methods under different adversarial attacks and15 different victim models (30 attack settings), and it exhibits better performance in16 various measurements (AUC, FPR, TPR) for most attack settings. Ideally, AUC is17 1 and our method achieves 0.99+ on CIFAR-10 for all attacks. Notably, different18 from other Autoencoder-based detectors, our method can provide resistance to the19 adaptive adversary.20
1 Introduction21
In 2013, the seminal work [1] reported that, during model test time, deep neural networks can be22 easily fooled by adversarial attacks that add tiny perturbation to inputs. Since then, adversarial23 attacks and defenses have drawn significant research attention [2–9]. On the one hand, attackers are24 persistently developing new strategies to construct adversarial examples; on the other hand, defenders25 are struggling to cope with all existing and forthcoming attacks [10].26
Most of the existing defense methods [6–9, 11] are trained with supervision, and these methods work27 well when defending against adversarial attacks they were originally trained for. However, it is widely28 regarded that supervised methods cannot generalize well to adversarial examples from (existing)29 unseen attacks, let alone examples from new attacks.30
Self-supervised based defense, in comparison with supervised defense, requires only benign examples31 for its training. As a typical example, the works in [12, 13] utilize the encoder of an autoencoder32 (AE) to draw the manifold of benign examples and then the decoder network for reconstruction, as33 shown in Fig. 1(a). Since the manifold is learnt from benign examples only and the AE is trained to34 minimize Reconstruction Errors (RE) for benign examples, thus the encoding of adversarial example35 will likely be out-of-distribution and the associated RE is larger.36
Submitted to 35th Conference on Neural Information Processing Systems (NeurIPS 2021). Do not distribute.
It is soon realized that this is not always true because AE has very strong generalization ability [14]:37 examples with various kinds of small perturbations can be reconstructed with small RE. This is38 desirable if the perturbed examples are benign. However, adversarial examples are just specific39 perturbed versions of benign examples and the malicious perturbations can be also made very small40 in many attacks (i.e., now their encodings will reside in the light gray area of Fig. 1(a)). When41 this happens, all REs are mixed and it leads to high false negative or false positive rate (FNR/FPR)42 during detection. To refine the volume of the manifold drawn by AE and reduce its unnecessary43 generalization ability on adversarial examples, there exist a number of variants [15–18], as will be44 reviewed in detail in Sec. 2.2.45
As a better solution to this problem, we propose a self-supervised disentangled representation based46 reconstruction (DRR) method to detect adversarial examples. DRR possesses the advantage of47 supervised defense, even though it does not have access to any adversarial examples in training. This48 is achieved through mimicking the behavior of adversarial examples by encoding and decoding a49 special class of examples (counterexamples in this work), which is the reconstruction of semantic50 feature from one example and class feature from an uncorrelated example. The rationale is based on51 the very fact of adversarial examples: they cause misclassification without changing semantics52 (contained in its benign counterparts).53
With this fact, we disentangle, with the help of the victim model and an auxiliary encoder, the54 representation of images as two parts: class-dependent and class-independent (i.e., class feature55 and semantic feature). After disentangling, we then train a decoder to reconstruct benign examples56 by combining class/semantic features from the same benign image, as well as counterexamples by57 combining class/semantic features from different benign images (i.e., images with different labels).58 During detection, as shown in Fig. 1(b), DRR will faithfully disentangle any benign image to paired59 class/semantic features and its adversarial counterpart to unpaired class/semantic features, whose60 associated REs are significantly different as desired.61
This paper makes the following contributions: 1) We use disentangled representation for adversarial62 detection, which makes it possible for the detector to mimic the behavior of adversarial examples in63 the self-supervised framework. 2) We design DRR via an AE structure, but it reduces the unnecessary64 generalization capability of AE on adversarial examples. 3) We achieve state-of-the-art adversarial65 detection performance on MNIST, Fashion-MNIST, and CIFAR-10 in most cases. Specifically, the66 Area Under Curve of Receiver Operation Characteristic (ideal AUC of ROC value is 1) is 0.99+ on67 CIRFAR-10.68
2 Background and Related Works69 2.1 Constructing Adversarial Examples70
The existence of adversarial examples in deep neural networks is first pointed out by [1], who find maliciously designed imperceptible perturbations can fool deep models to misclassify. Let F(·) be a general neural model and C(·) be the layers before softmax of the model, then evaluating the test example x is simply a softmax classification over the logits c = C(x), i.e., y = F(x) = softmax(c). The (untargeted) adversarial example xadv derived from x satisfies
xadv = x+ δadv,F(xadv) 6= F(x), and ‖δadv‖ < , (1)
where δadv is the adversarial perturbation, is the maximum magnitude of δadv under certain norm71 compliance. Commonly used norm could be L1, L2, and Linf , so we also focus on detecting72 adversarial examples bounded by these norms.73
In the current literature, Fast Gradient Sign Method (FGSM) is the first widely used method in74 generating adversarial examples [2]. Basic Iterative Method (BIM) [19] and Projected Gradient75 Descent (PGD) [5] improve FGSM by iterating the building block of it according to different criteria76 to find the optimized perturbation. DeepFool [3] and CW [4] do not directly rely on gradient but they77 instead optimize (the norm of) δadv, which are usually more stealthy than FGSM and its variants.78
Another line of research for constructing adversarial examples is called adaptive attacks [20]. Under79 an adaptive attack, the attacker also has white-box access to possible defense mechanisms, and80 his goal is to find an optimal δadv that solves Eq. (1) and circumvents the defense mechanisms81 simultaneously. All the attacks above can have their adaptive versions by considering different82 defenses.83
2.2 Detecting Adversarial Examples84
Adversarial detection is an effective way to prevent adversarial examples, and it can be classified85 as supervised and unsupervised methods considering whether adversarial examples are needed for86 training. For the case of supervised detectors, their detecting capability depends on how to capture87 the differences between adversarial and benign examples. Techniques range from studying statistical88 properties [6–8], training traditional machine learning classifiers [21, 22] and deep classifiers [9, 11,89 16, 23]. It is widely accepted that supervised methods cannot generalize well to adversarial examples90 produced by unseen attacks. For example, a supervised detector trained with PGD adversarial91 examples is likely to fail to detect examples produced by CW. However, it is also known that92 supervised detectors are robust to adaptive attacks, i.e., a detector trained with PGD will likely detect93 examples produced by the adaptive PGD attack [11, 23].94
For the case of unsupervised detectors, their detecting capability depends on how to embed and95 represent benign examples to a different manifold (other than the natural spatiotemporal domain)96 thus adversarial perturbations will be magnified with embedding (without even seeing them at all).97 MagNet, proposed in [12], firstly uses an autoencoder to draw the manifold of benign examples, and98 it is regarded that the distance between the adversarial and benign examples are large via embedding99 and reconstruction.100
However, the embedding manifold induced by autoencoder is not always desirable for detection,101 since autoencoder has too strong generalization capability [14]. Further to MagNet, the work [15]102 trains a variant of autoencoder by adding logits of the victim model into the loss function to refine103 the volume of the embedded manifold. The work [16] proposes to directly use parameters fixed104 victim model as the encoder, and the victim models’ logits as high-level representations/embedding.105 Different from the works above which treat the manifold of all benign examples as a whole, [17, 18]106 propose a class-conditional model to embed and reconstruct benign examples for even better refining107 the (embedding) manifold. However, it is reported in [17] that this method still only reacts to108 relatively large (adversarial) perturbation over simple datasets. Compared with supervised detectors,109 self-supervised detectors may generalize better to unseen attacks but they are vulnerable to adaptive110 attacks [12, 14, 16]. For example, it is shown in [24] that the detector of [12] fails to resist adaptive111 attacks at all.112
2.3 Disentangled Representation113
Disentangled representation is firstly advocated by InfoGAN in [25], which encourages the learning114 of interpretable and meaningful representations of inputs for manipulating specific features. The115 work in [26] disentangles speaker-related representation to synthesis voices of different speakers.116 The work in [27] uses disentangled representation to address pose discrepancy problem among face117 images.118
This paper uses disentangled representations for adversarial detection. It is pointed out [28] that119 there are many features in an image, and in adversarial attack, not all features are equally easy to120 be manipulated. Specifically, the class an image belongs to, which does not depend on all semantic121 features it has, is a concrete example. In this concern, we disentangle representations of an image122
into semantic feature and class feature. Semantic features can be easily manipulated by the attackers123 (through adversarial perturbation) but the perturbed features are similar to the original version (even124 after embedding if the perturbation is tiny enough). In contrast, class features cannot be directly125 manipulated (by attackers), but they are fragile to adversarial perturbation and robust to natural126 perturbation of the semantic features.127
3 DRR for Adversarial Detection128
This section presents the details of how to train DRR and use DRR to detect adversarial examples. For129 detection, as discussed earlier and shown in Fig. 1(b), an incoming test example x will be encoded130 and decoded as x′, then the RE ‖x′ − x‖2 is compared to a threshold value. If the RE is larger, then131 it is considered as adversarial; otherwise, it is not. Ideally, this threshold should be universal (on a132 given dataset) for all possible attacks (even for new attacks). However, for existing detectors, the133 threshold value is related to the used attack methods. This makes it hard to determine a universal134 threshold for existing detectors and to compare with them. For this reason, we use ROC curve of135 each attack strategy as the metric for evaluation in Sec. 4. But it is worth mentioning that it is easy to136 set a universal threshold for DRR for all the considered attacks.137
We then move to how to train DRR. As depicted in Fig. 2, assisted by the parameter-fixed victim138 model V, DRR first extracts class and semantic features from one benign example xi to train the139 encoder En and decoder De. Then DRR takes the class feature from another benign example xj140 (j 6= i and xj’s label is different to xi) and combines it with the semantic feature from xi to mimic141 the behavior of adversarial examples. The two encoding-decoding processes are further enhanced142 with the discriminator D. The details of how to design the loss functions of the modular networks are143 presented in detail below.144
First and foremost, we examine how to disentangle an input image x to semantic feature s and145 class feature c for our detection purpose. For s, which represents the semantics of x, we use a146 general encoder network En to derive it, i.e., s = En(x). This is because it is widely accepted that147 high-dimensional input x resides in a low-dimensional manifold, and it is a commonly used method148 in the area of representation learning. For c, which represents the class feature of x, we choose to use149 the logits from the victim model1 V, i.e., c = C(x). Aligned with the encoder-decoder structure and150 the discussion in Sec. 2.3, the rationale for this choice is two-sided: 1) Different from the one-hot151 encoding of the label of x, C(x) contains richer information for the subsequent decoding process; 2)152 Regardless of how the concrete adversarial example xadv is constructed, C(xadv) must be different153 enough from C(x) to induce the final erroneous classification.154
With these features available, a decoder network De is then used to reconstruct x′ from s and c (of x), i.e., x′ = De(s, c). The natural requirement for En and De is that, for a generic image xi from the benign dataset, the reconstructed version x′i should be similar to xi. Moreover, we need to reserve the generalization capability over benign examples. For this purpose, an Gaussian noise vector ni, each of the i.i.d. component follows N (0, δ2), is used for data augmentation, i.e., x̂i = xi + ni. Thus, the
1We hereinafter abuse the notation V in Fig. 2 to denote victim model without the final softmax layer as this will not cause ambiguity.
associated loss is
L1 = ExiMSE(xi, x̂′i), (2) where x̂′i = De (En(x̂i),C(x̂i)), MSE is the mean squared error and E is the expectation.155 Different from the normal AE based detection and its variants, we also require the class features, after encoding and decoding of xi or its noisy version x̂i, are still aligned. So, another loss function associated with xi is
L2 = Exi [MSE(ci, c′i) +MSE(ĉi, ĉ′i)] , (3) where ci = C(xi), c′i = C(x ′ i), ĉi = C(x̂i) and ĉ ′ i = C(x̂ ′ i). It is worth mentioning that we use the156
layer normalized version of ci/c′i and ĉi/ĉ ′ i to calculate this cost in the experiment to avoid numeric157 instability and ease the task of hyperparameter tuning. This finishes our discussion of how to train En158 and De with paired semantic feature and class feature from benign examples (the red box with solid159 line in Fig. 2).160
We then move to the training of DRR with unpaired semantic feature and class feature, as depicted by161 the red box with dashed line in Fig. 2. As emphasized in Sec. 2.2, the drawback of AE based detection162 is AE generalizes too well and the refinement of the manifold drawn by AE is not always effective,163 especially on attacks that directly optimize the norm of the adversarial perturbation. The solution164 is now straightforward since we can mimic the behavior of adversarial examples by constructing165 counterexamples from unpaired semantic feature and class feature to better refine the manifold drawn166 by En and De.167
For another benign example xj with j 6= i, we extract its class feature via cj = C(xj). To obtain a168 counterexample, the semantic feature si from xi and the class feature cj from xj are then passed to169 De to get x′i,j = De (En(xi),C(xj)). Recall that our original purpose is to refine the manifold drawn170 by the encoder and decoder, so the loss function here should satisfy the following two requirements:171
• The decoded x′i,j should not converge to x′i (and thus xi) because convergence indicates that172 counterexamples and benign examples are mixed, which is contrary to our original detection173 purpose;174
• The decoded x′i,j should not be far away from x′i, since out-of-distribution examples do not175 really improve the detection capability of autoencoder.176
For these reasons, we choose to use a soft hinge function as the loss, i.e.,
L3 = Exi ∑ j,j 6=i max(0, d− ∥∥x′i,j − x′i∥∥2)  , (4) where d is a hyperparameter used to control the farthest allowable distance between counter and177 benign examples. This soft hinge function (passively) meets the second requirements list above: its178 gradient equals 0 when
∥∥x′i,j − x′i∥∥2 > d.179 To further reduce the unnecessary generalization capability of the encoder-decoder network, we enforce class feature consistency over the counterexamples and their noisy versions. This is achieved by using the following loss function:
L4 = Exi ∑ j,j 6=i MSE(cj , ĉ ′ j)  , (5) where ĉ′j = De(x̂ ′ i,j) with x̂ ′ i,j = x ′ i,j+nj (the component of nj also follows the Gaussian distribution180 N (0, δ2)).181 Inspired by [29], we treat the overall encoder-decoder (though assisted with the parameter-fixed victim model V) as a generator and then couple it with the last component of DRR, i.e., a discriminator network D. So (En+De) and D form the structure of generative adversarial networks (GAN), whose loss function is
LGAN = Exi [logD(xi)] +Exi [log(1− D(De(En(xi),V(xi))))] +Exi,xj [log(1− D(De(En(xi),V(xj))))].
The goal of this loss is to encourage the decoded examples, either benign or counterexamples, to be182 indistinguishable from the original input. It is worth mentioning that this GAN framework can be183 directly incorporated to all other encoder-decoder-like detectors [12, 13, 15–18], though they do not184 use a disentangled representation, to refine the manifold drawn by encoder-decoder networks.185
In summary, the loss function to train the encoder En, the decoder De, and the discriminator D is
Loss = 4∑
i=1
λiLi + λGANLGAN, (6)
where λi (i = 1, · · · , 4) and λGAN control the relative importance of each loss function. En, De, and186 D are obtained by solving the minmax problem argminEn,De maxD.187
The last observation we made is that even though the training of DRR mimics the behavior of188 adversarial examples, it does not really see any of them. And an empirical fact is that the victim model189 V is normally confident on benign examples. In contrast, it is not mandatory for V to be confident on190 adversarial examples (e.g., max(softmax(C(xadv))) = 0.2 << max(softmax(C(x))) = 0.9). This191 leads to trivial failure of DRR as DRR relies on class feature c = C(x) for reconstruction. As a192 remedy of this problem, we use the class feature sharpening trick here, i.e., c is updated as193
c = { α · c− (α− 1) ·mean(c), if std(c) < σ; c, others,
(7)
where std is the standard deviation function, σ is the standard deviation of the training benign194 examples, and α, an empirical sharpening constant, is set to 3.195
In this section, we assess the performance of DRR on three datasets, MNIST [30], Fashion-MNIST197 [31] and CIFAR-10 [32], by comparing it with other state-of-the-art detectors [12, 15, 16] against198 the adversarial attacks FGSM, BIM, PGD, DeepFool and CW (taken from Foolbox [33]) and the199 adaptive PGD under differnt norms (L1, L2 and Linf ). As a proof-of-concept, two representative200 networks, an 8-layer CNN and VGG-16 [34], are used as the victim models. These settings generate201 (24 + 6) attacks and (24× 5) + 6 defenses, so only the representative results are reported here due to202 space limit and the complete results (including the source code) are provided in the supplementary203 file. We use a GeForce RTX 2080 to conduct the experiments.204
4.1 Settings205
DRR: DRR has three modules: encoder En, decoder De and discriminator D. It is suffice to say that206 the encoder En and the discriminator D have the same architecture as the victim model except the last207 fully connected layer: for CIFAR-10, there are 128 neurons in the last layer of En; for MNIST and208 Fashion-MNIST, only 4 neurons are used. The architecture of the decoder De is simply a mirror of En.209 Following the literature [11, 23], the hyperparameters [λi]4i=1 and λGAN of the Loss are determined210 by a binary search in [10−3, 106], and d and δ are determined empirically. The full details are listed211 in Table 1.212
Methods for comparison: As mentioned above, three kinds of self-supervised detectors [12, 15, 16]213 are used for comparison. The structure of the encoder, the decoder for all these three methods are the214 same as of DRR. These methods can be classified as hidden vector based reconstruction (HVR) and215 high-level representation based reconstruction (HLR).216
Table 2: Test accuracy of the victim models.
Data Attack Accuracy
C IF
A R
10
benign 0.869 BIM Linf = 0.01 0.195
BIM L1 = 5 0.588 PGD Linf = 0.01 0.267 PGD L2 = 0.1 0.744 PGD L2 = 0.3 0.352
FGSM Linf = 0.05 0.092 DeepFool Linf 0.054
CW L2 0.001
M N
IS T
benign 0.993 BIM Linf = 0.3 0.001 BIM L1 = 50 0.012 PGD Linf = 0.3 0.000 PGD L2 = 1 0.724 PGD L2 = 2 0.086
FGSM Linf = 0.1 0.762 DeepFool Linf 0.078
CW L2 0.000
Fa sh
io n
benign 0.926 BIM Linf = 0.05 0.021
BIM L1 = 20 0.300 PGD Linf = 0.05 0.008
PGD L2 = 1 0.240 PGD L2 = 2 0.095 FGSM Linf = 0.05 0.327 DeepFool Linf 0.052
CW L2 0.003
For [12], it is based on optimizing the pixel-level reconstruction error from the hidden vector outputted217 by the encoder. We term it as HVR-P. For [15], it optimizes both pixel and logits reconstruction218 error and we term it as HVR-L. For [16], it takes the logits from the parameter-fixed victim model as219 a high-level representation of examples for decoding, and it has two variants, HLR-P and HLR-L,220 depending on whether the loss function includes the logits reconstruction error or not. We also221 incorporate and optimize the GAN loss when implementing all these detectors: HVR-P, HVR-L,222 HLR-P, and HLR-L. Note that our implementations perform slightly better than the original methods223 in [12, 15, 16], but this provides a fair environment for evaluating the effectiveness of disentangled224 representation.225
4.2 Results Analyses226
With the settings above, we first train victim models on the 3 datasets, and then generate adversarial227 examples with the 5 attacks (FGSM, BIM, PGD, DeepFool, and CW) under different norm compliance228 ( in Eq. (1)). All these test examples, either benign or adversarial, are passed to the detector for229 inspection.230
Preparing test examples: The two victim models, VGG-16 and 8-layer CNN, are trained on CIFAR-231 10 and MNIST/Fashion MNIST, respectively. For each test example, we generate the corresponding232 adversarial versions with 5 attacks under different norm compliance, and the test accuracy is listed in233 Table 2. From this table, it is clear that the victim models achieve 0.869, 0.926, 0.993 classification234 accuracy over benign test examples. Also from this table, the attacks DeepFool and CW, which235 directly optimize , are generally stronger than the other three. By increasing , other attacks also236 obtains better attack result (i.e., worse accuracy), e.g., PGD with different L2 constraints in Table 2.237 However, a larger adversarial perturbation will make the attack get detected easier.238
Visual inspection: We visually compare the reconstructed results of the benign and adversarial239 examples for all the detectors, some examples are shown in Fig. 3. Inspecting columns 3 and 4240 of Fig. 3(a) and (b), it is clear that DRR, HLR-P and HLR-L generally have bigger reconstruction241 errors over adversarial examples, which validates that logits (of the victim model) do help to reduce242 undesirable generalization capability of the detectors.243
We further box-plot the reconstruction errors of all benign and adversarial examples from CIFAR-244 10, the result is shown in Fig. 4. It is clear from this figure, under all attacks of CIFAR-10, the245 reconstruction errors of DRR are clearly separable. The reconstruction errors of HLR-P and HLR-L246 are also generally separable, but it has a higher FNR or FPR than that of DRR (depending on the247 concrete threshold of RE). This validates that the disentangled semantic and class features can better248 refine the volume of the embedded manifold and prevent undesirable generalization. Moreoever, as249 shown in this figure, it is easy to determine a universal threshold for DRR to detect all considered250
attacks over CIFAR-10 (and it is similar for the other two datasets), but it is hard to do so for HVR-P,251 HVR-L, HLR-P, and HLR-L.252
ROC curve and AUC: With benign samples and adversarial examples of CIFAR-10, the ROC curves253 of all the detectors are depicted in Fig. 5 for qualitative analysis. From Fig. 5, it is very clear that254 DRR can retain a high true positive detection rate (TPR) while keeping the FPR rate low. If the size255 of the AUC of ROC curve is larger, the detector is better and the ideal size can reach up to 1.256
We use AUC of ROC to quantitatively study the effectiveness of all detectors over CIFAR-10, as well257 as extending this metric to MNIST and Fashion-MNIST. The results are tabulated in Table 3. It is258 clear that, for CIFAR-10, the AUC of DRR is the largest over all different attacks, and the value is259 very close to the ideal case 1. For MNIST and Fashion-MNIST, DRR outperforms other detectors in260 most cases. For the cases that DRR is inferior to HLR-P/HLR-L, the gap is tiny and we regard their261 performances are comparable to each other.262
4.3 Defensing Against Adaptive Adversarial Attack263
To further evaluate the performance of DRR, we assume that the attacker can not only access the victim model but also knows all the details of the detector. Under this adaptive assumption, the attacker’s goal is to fool both the victim model and the detector. Following the most-widely used adaptive attack strategy [8, 11, 20, 23, 24], the attack now aims to solve
min xadv
αLRE(xadv)− LCE(xadv, y)
s.t. ‖xadv − x‖p < , p ∈ {1, 2, inf} (8)
where LRE and LCE are respectively the attack’s loss function for the detector (i.e., reconstruction264 error) and for the victim model (i.e., cross entropy), and y = F(x) is the true label of x and α is the265
parameter to control the relative importance of the two loss functions. It is worth mentioning that the266 detectors [12,15,16] in comparison fail to resist the adaptive attack defined above2. The reason is, for267 other AE-based detectors, no matter high-level representation (i.e., logits) is used or not, they fail268 to capture true features of adversarial examples by certain. In contrast, the AE in DRR mimics the269 behavior of adversarial examples via disentangled representation.270
We evaluate this adaptive attack strategy under the same setting of Table 1, and the results for271 CIFAR-10 and MNIST are depicted in Fig. 6. Observing the first row of Fig. 6, it is clear the accuracy272 of victim model under adaptive attacks is higher than that without our defense, a.k.a., it is harder273 for the attacker to succeed when the detector DRR is deployed. Moreover, if the attacker focuses274 more on circumventing the detector by increasing α of Eq. (8) (from 102 to 105), it will be harder for275 him to succeed in constructing real adversarial examples. However, if the attacker puts less focus on276 bypassing the detector, further experimental results verify that it makes him easier to get detected.277
A similar trend can be also observed when implementing the adaptive attack on MNIST (the second278 row of Fig. 6). But from this figure, it is clear that now it is harder for the attacker to succeed in279 attacking, for example, the attacker only has about 10% attack success rate (under L1 and L2 norm)280 even with small α = 102 (less attention on circumventing the detector). We regard this is because the281 semantic feature of MNIST is simple, and the network architecture used by DRR (Table 1) captures282 this feature very well and the defense is stronger (than that of CIFAR-10 which has more complex283 semantic features). In this concern, it is reasonable to speculate that DRR can be extended to other284 complex datasets with an appropriate choice of model architecture to capture the complex semantic285 features within the dataset, which we leave as future work.286
5 Conclusion287
In this study, we propose to make use of disentangled representation for self-supervised adversarial288 examples detection. The proposed method DRR is based on the very nature of adversarial examples:289 misleading classification results without changing images’ semantics (a lot). With disentangled290 class and semantic features, this nature inspires us to construct counterexamples to better guide291 the training of DRR. Compared with previous self-supervised detectors, DRR generally performs292 better under various measurements over different datasets and different adversarial attack methods.293 Not surprisingly, compared with other AE-based adversarial detectors, DRR is also more robust to294 adaptive adversaries. This makes DRR a promising candidate, when combined with other proactive295 strategies, for the defense of adversarial attacks. Moreover, disentangled representation is a ubiquitous296 property for many other data formats, including natural language, voice, and video signals, so DRR297 may be extended easily to provide adversarial defense to other domains.298
2We note that [15] considered a weaker adaptive attack strategy (maximize the cross entropy after AE reconstruction but not directly optimize reconstruction error) and HVR-L is robust to the weaker adaptive notion.
References299 [1] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing300 properties of neural networks,” ICLR, 2013.301
[2] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” ICLR,302 2015.303
[3] S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “DeepFool: A simple and accurate method to fool304 deep neural networks,” in CVPR, pp. 2574–2582, 2016.305
[4] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in Oakland, pp. 39–57,306 2017.307
[5] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to308 adversarial attacks,” in ICLR, 2018.309
[6] K. Roth, Y. Kilcher, and T. Hofmann, “The odds are odd: A statistical test for detecting adversarial310 examples,” in ICML, pp. 5498–5507, 2019.311
[7] K. Grosse, P. Manoharan, N. Papernot, M. Backes, and P. McDaniel, “On the (statistical) detection of312 adversarial examples,” arXiv preprint arXiv:1702.06280, 2017.313
[8] K. Lee, K. Lee, H. Lee, and J. Shin, “A simple unified framework for detecting out-of-distribution samples314 and adversarial attacks,” in NeurIPS, pp. 7167–7177, 2018.315
[9] D. Hendrycks and K. Gimpel, “Early methods for detecting adversarial images,” ICLR, 2016.316
[10] N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,”317 in CCS, pp. 3–14, 2017.318
[11] J. Tian, J. Zhou, Y. Li, and J. Duan, “Detecting adversarial examples from sensitivity inconsistency of319 spatial-transform domain,” in AAAI, 2021.320
[12] D. Meng and H. Chen, “Magnet: A two-pronged defense against adversarial examples,” in CCS, pp. 135–321 147, 2017.322
[13] C. Chen, J. Liu, Y. Xie, Y. X. Ban, C. Wu, Y. Tao, and H. Song, “Latent Regularized Generative Dual323 Adversarial Network For Abnormal Detection,” in IJCAI, (California), pp. 760–766, 2020.324
[14] D. Gong, L. Liu, V. Le, B. Saha, M. R. Mansour, S. Venkatesh, and A. v. d. Hengel, “Memorizing normality325 to detect anomaly: Memory-augmented deep autoencoder for unsupervised anomaly detection,” in CVPR,326 pp. 1705–1714, 2019.327
[15] G. Vacanti and A. Van Looveren, “Adversarial detection and correction by matching prediction distributions,”328 arXiv preprint arXiv:2002.09364, 2020.329
[16] B. Wójcik, P. Morawiecki, M. Śmieja, T. Krzyżek, P. Spurek, and J. Tabor, “Adversarial examples detection330 and analysis with layer-wise autoencoders,” arXiv preprint arXiv:2006.10013, 2020.331
[17] Y. Qin, N. Frosst, S. Sabour, C. Raffel, G. Cottrell, and G. Hinton, “Detecting and diagnosing adversarial332 images with class-conditional capsule reconstructions,” in ICLR, 2019.333
[18] L. Schott, J. Rauber, M. Bethge, and W. Brendel, “Towards the first adversarially robust neural network334 model on MNIST,” in ICLR, 2018.335
[19] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” ICLR, 2017.336
[20] N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,”337 in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3–14, 2017.338
[21] J. Lu, T. Issaranon, and D. Forsyth, “Safetynet: Detecting and rejecting adversarial examples robustly,” in339 ICCV, pp. 446–454, 2017.340
[22] R. Feinman, R. R. Curtin, S. Shintre, and A. B. Gardner, “Detecting adversarial samples from artifacts,”341 arXiv preprint arXiv:1703.00410, 2017.342
[23] X. Ma, B. Li, Y. Wang, S. Erfani, S. Wijewickrema, M. Houle, G. Schoenebeck, D. Song, and J. Bailey,343 “Characterizing adversarial subspaces using local intrinsic dimensionality,” ICLR, 2018.344
[24] N. Carlini and D. Wagner, “Magnet and "efficient defenses against adversarial attacks" are not robust to345 adversarial examples,” arXiv preprint arXiv:1711.08478, 2017.346
[25] X. Chen, Y. Duan, R. Houthooft, J. Schulman, I. Sutskever, and P. Abbeel, “Infogan: Interpretable347 representation learning by information maximizing generative adversarial nets,” in NeurIPS, pp. 2172–348 2180, 2016.349
[26] M. Sang, W. Xia, and J. H. Hansen, “Deaan: Disentangled embedding and adversarial adaptation network350 for robust speaker representation learning,” arXiv preprint arXiv:2012.06896, 2020.351
[27] L. Tran, X. Yin, and X. Liu, “Disentangled representation learning gan for pose-invariant face recognition,”352 in CVPR, pp. 1415–1424, 2017.353
[28] A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, “Adversarial examples are not354 bugs, they are features,” in NeurIPS, pp. 125–136, 2019.355
[29] C. Xiao, B. Li, J.-Y. Zhu, W. He, M. Liu, and D. Song, “Generating adversarial examples with adversarial356 networks,” in IJCAI, pp. 119–128, 2018.357
[30] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”358 Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998.359
[31] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-MNIST: A novel image dataset for benchmarking machine360 learning algorithms,” arXiv preprint arXiv:1708.07747, 2017.361
[32] A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009.362
[33] J. Rauber, W. Brendel, and M. Bethge, “Foolbox: A python toolbox to benchmark the robustness of363 machine learning models,” in ICML, 2017.364
[34] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,”365 ICLR, 2015.366
Checklist367 1. For all authors...368
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contribu-369 tions and scope? [Yes]370
(b) Did you describe the limitations of your work? [Yes]371 (c) Did you discuss any potential negative societal impacts of your work? [Yes]372 (d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]373
2. If you are including theoretical results...374
(a) Did you state the full set of assumptions of all theoretical results? [N/A]375 (b) Did you include complete proofs of all theoretical results? [N/A]376
3. If you ran experiments...377
(a) Did you include the code, data, and instructions needed to reproduce the main experimental378 results (either in the supplemental material or as a URL)? [Yes]379
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?380 [Yes] Please refer to Sec. 4 for the details.381
(c) Did you report error bars (e.g., with respect to the random seed after running experiments382 multiple times)? [Yes]383
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs,384 internal cluster, or cloud provider)? [Yes] Please refer to Sec. 4 for the details.385
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...386
(a) If your work uses existing assets, did you cite the creators? [Yes]387 (b) Did you mention the license of the assets? [Yes]388 (c) Did you include any new assets either in the supplemental material or as a URL? [Yes] Code is389 available in the supplemental material.390 (d) Did you discuss whether and how consent was obtained from people whose data you’re us-391 ing/curating? [N/A]392 (e) Did you discuss whether the data you are using/curating contains personally identifiable informa-393 tion or offensive content? [N/A]394
5. If you used crowdsourcing or conducted research with human subjects...395
(a) Did you include the full text of instructions given to participants and screenshots, if applicable?396 [N/A]397
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB)398 approvals, if applicable? [N/A]399
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on400 participant compensation? [N/A]401

title: Self-Supervised Adversarial Example Detection by Disentangled Representation