ALMA: Aggregated Lipschitz Maximization Attack on Auto-encoders

2025-05-06

AI Summary

Existing adversarial robustness evaluation methods for autoencoders (AEs) suffer from insufficient gradient propagation through ill-conditioned intermediate layers under white-box attacks, resulting in weak perturbations and poor convergence. To address this, we propose a layer-conditioned adversarial attack framework: (i) we explicitly model the local Lipschitz constant as an optimizable objective—novel in AE robustness analysis—and enhance gradient flow via Lipschitz-guided gradient amplification and layer-weighted loss, significantly improving perturbation propagation efficiency in deep layers; (ii) we design a lightweight, inference-time adversarial training plug-in for defense. Extensive evaluation across multiple state-of-the-art AEs demonstrates that our attack substantially outperforms existing methods in both generic and sample-specific settings. Moreover, the defense plug-in reduces reconstruction error increase by 42%, markedly enhancing AE robustness against adversarial perturbations.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Despite the extensive use of deep autoencoders (AEs) in critical applications, their adversarial robustness remains relatively underexplored compared to classification models. AE robustness is characterized by the Lipschitz bounds of its components. Existing robustness evaluation frameworks based on white-box attacks do not fully exploit the vulnerabilities of intermediate ill-conditioned layers in AEs. In the context of optimizing imperceptible norm-bounded additive perturbations to maximize output damage, existing methods struggle to effectively propagate adversarial loss gradients throughout the network, often converging to less effective perturbations. To address this, we propose a novel layer-conditioning-based adversarial optimization objective that effectively guides the adversarial map toward regions of local Lipschitz bounds by enhancing loss gradient information propagation during attack optimization. We demonstrate through extensive experiments on state-of-the-art AEs that our adversarial objective results in stronger attacks, outperforming existing methods in both universal and sample-specific scenarios. As a defense method against this attack, we introduce an inference-time adversarially trained defense plugin that mitigates the effects of adversarial examples.

Problem

• Assessing adversarial robustness of deep autoencoders
• Exploiting vulnerabilities in intermediate ill-conditioned AE layers
• Improving adversarial loss gradient propagation in attacks

Innovation

• Layer-conditioning-based adversarial optimization objective
• Enhancing loss gradient information propagation
• Inference-time adversarially trained defense plugin