Visible to the public Adversarial Examples for Generative Models

TitleAdversarial Examples for Generative Models
Publication TypeConference Paper
Year of Publication2018
AuthorsKos, J., Fischer, I., Song, D.
Conference Name2018 IEEE Security and Privacy Workshops (SPW)
Date PublishedMay 2018
ISBN Number978-1-5386-8276-0
Keywordsadversarial example, adversarial examples, Adversary Models, classification-based adversaries, classifier, Data models, Decoding, deep generative models, deep learning architectures, Generative Models, Human Behavior, image classification, Image coding, Image reconstruction, image representation, input data distribution model, learning (artificial intelligence), machine learning, Metrics, neural net architecture, neural net architectures, pubcrawl, Receivers, Resiliency, Scalability, target generative model, target generative network, Training, vae, vae gan, VAE-GAN architecture attacks, variational techniques

We explore methods of producing adversarial examples on deep generative models such as the variational autoencoder (VAE) and the VAE-GAN. Deep learning architectures are known to be vulnerable to adversarial examples, but previous work has focused on the application of adversarial examples to classification tasks. Deep generative models have recently become popular due to their ability to model input data distributions and generate realistic examples from those distributions. We present three classes of attacks on the VAE and VAE-GAN architectures and demonstrate them against networks trained on MNIST, SVHN and CelebA. Our first attack leverages classification-based adversaries by attaching a classifier to the trained encoder of the target generative model, which can then be used to indirectly manipulate the latent representation. Our second attack directly uses the VAE loss function to generate a target reconstruction image from the adversarial example. Our third attack moves beyond relying on classification or the standard loss for the gradient and directly optimizes against differences in source and target latent representations. We also motivate why an attacker might be interested in deploying such techniques against a target generative network.

Citation Keykos_adversarial_2018