GRILL: Gradient Signal Restoration in Ill-Conditioned Layers to Enhance Adversarial Attacks on Autoencoders

2025/05/06 by Ramanaik, Chethan Krishnamurthy, Roy, Arjun, Callies, Tobias +1
#Artificial Intelligence (cs.AI) #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2505.03646

Abstract

Adversarial robustness of deep autoencoders (AEs) remains relatively unexplored, even though their non-invertible nature poses distinct challenges. Existing attack algorithms during the optimization of imperceptible, norm-bounded adversarial perturbations to maximize output damage in AEs, often stop at sub-optimal attacks. We observe that the adversarial loss gradient vanishes when backpropagated through ill-conditioned layers. This issue arises from near-zero singular values in the Jacobians of these layers, which weaken the gradient signal during optimization. We introduce GRILL, a technique that locally restores gradient signals in ill-conditioned layers, enabling more effective norm-bounded attacks. Through extensive experiments on different architectures of popular AEs, under both sample-specific and universal attack setups, and across standard and adaptive attack settings, we show that our method significantly increases the effectiveness of our adversarial attacks, enabling a more rigorous evaluation of AE robustness.

Citations

• Gemma 3 Technical Report
• AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion models
• Qwen2.5-Coder Technical Report
• Adversarial Robustness of VAEs across Intersectional Subgroups
• A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion
• Alleviating Adversarial Attacks on Variational Autoencoders with MCMC
• Advances in adversarial attacks and defenses in computer vision: A\n survey
• Diagnosing Vulnerability of Variational Auto-Encoders to Adversarial Attacks
• NVAE: A Deep Hierarchical Variational Autoencoder
• A Self-supervised Approach for Adversarial Robustness
• Improved Gradient based Adversarial Attacks for Quantized Networks
• On Adaptive Attacks to Adversarial Example Defenses
• The troublesome kernel -- On hallucinations, no free lunches and the accuracy-stability trade-off in inverse problems
• Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reduction
• FDA: Feature Disruptive Attack
• LXMERT: Learning Cross-Modality Encoder Representations from Transformers
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• BERTScore: Evaluating Text Generation with BERT
• A Style-Based Generator Architecture for Generative Adversarial Networks
• Implicit Self-Regularization in Deep Neural Networks: Evidence from Random Matrix Theory and Implications for Learning
• Adapting Auxiliary Losses Using Gradient Similarity
• Adversarial Attacks on Variational Autoencoders
• Lipschitz regularity of deep neural networks: analysis and efficient estimation
• The Singular Values of Convolutional Layers
• Spectral Normalization for Generative Adversarial Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Neural Networks in Adversarial Setting and Ill-Conditioned Weight Space
• Resurrecting the sigmoid in deep learning through dynamical isometry: theory and practice
• Neural Discrete Representation Learning
• Spectral Norm Regularization for Improving the Generalizability of Deep Learning
• Parseval Networks: Improving Robustness to Adversarial Examples
• Improved Training of Wasserstein GANs
• Adversarial Images for Variational Autoencoders
• Towards Evaluating the Robustness of Neural Networks
• Deep Learning Face Attributes in the Wild

Related

• Revisiting Role of Autoencoders in Adversarial Settings
• A Computationally Efficient Method for Defending Adversarial Deep Learning Attacks
• Double Backpropagation for Training Autoencoders against Adversarial Attack
• An Eye for an Eye: Defending against Gradient-based Attacks with Gradients
• Combatting Adversarial Attacks through Denoising and Dimensionality\n Reduction: A Cascaded Autoencoder Approach