Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

GRILL: Restoring Gradient Signal in Ill-Conditioned Layers for More Effective Adversarial Attacks on Autoencoders

Chethan Krishnamurthy Ramanaik, Arjun Roy, Tobias Callies, Eirini Ntoutsi

TL;DR

This paper tackles the vulnerability of autoencoders to adversarial perturbations by identifying gradient vanishing caused by ill-conditioned layer Jacobians, driven by near-zero singular values. It introduces GRILL, a gradient signal restoration framework that extends latent gradient restoration across all layers by aggregating layer-wise encoder–decoder distortions into a unified objective, ensuring non-vanishing attack directions. Through extensive experiments on multiple autoencoder architectures and, notably, on multimodal encoder–decoder models, GRILL consistently outperforms classical OA/LA attacks in both universal and sample-specific settings and under adaptive defenses. The results highlight a fundamental vulnerability in modern encoding–decoding systems and suggest GRILL as a general tool for rigorous robustness evaluation beyond AEs, with implications for vision–language models and similar architectures.

Abstract

Adversarial robustness of deep autoencoders (AEs) has received less attention than that of discriminative models, although their compressed latent representations induce ill-conditioned mappings that can amplify small input perturbations and destabilize reconstructions. Existing white-box attacks for AEs, which optimize norm-bounded adversarial perturbations to maximize output damage, often stop at suboptimal attacks. We observe that this limitation stems from vanishing adversarial loss gradients during backpropagation through ill-conditioned layers, caused by near-zero singular values in their Jacobians. To address this issue, we introduce GRILL, a technique that locally restores gradient signals in ill-conditioned layers, enabling more effective norm-bounded attacks. Through extensive experiments across multiple AE architectures, considering both sample-specific and universal attacks under both standard and adaptive attack settings, we show that GRILL significantly increases attack effectiveness, leading to a more rigorous evaluation of AE robustness. Beyond AEs, we provide empirical evidence that modern multimodal architectures with encoder-decoder structures exhibit similar vulnerabilities under GRILL.

GRILL: Restoring Gradient Signal in Ill-Conditioned Layers for More Effective Adversarial Attacks on Autoencoders

TL;DR

This paper tackles the vulnerability of autoencoders to adversarial perturbations by identifying gradient vanishing caused by ill-conditioned layer Jacobians, driven by near-zero singular values. It introduces GRILL, a gradient signal restoration framework that extends latent gradient restoration across all layers by aggregating layer-wise encoder–decoder distortions into a unified objective, ensuring non-vanishing attack directions. Through extensive experiments on multiple autoencoder architectures and, notably, on multimodal encoder–decoder models, GRILL consistently outperforms classical OA/LA attacks in both universal and sample-specific settings and under adaptive defenses. The results highlight a fundamental vulnerability in modern encoding–decoding systems and suggest GRILL as a general tool for rigorous robustness evaluation beyond AEs, with implications for vision–language models and similar architectures.

Abstract

Adversarial robustness of deep autoencoders (AEs) has received less attention than that of discriminative models, although their compressed latent representations induce ill-conditioned mappings that can amplify small input perturbations and destabilize reconstructions. Existing white-box attacks for AEs, which optimize norm-bounded adversarial perturbations to maximize output damage, often stop at suboptimal attacks. We observe that this limitation stems from vanishing adversarial loss gradients during backpropagation through ill-conditioned layers, caused by near-zero singular values in their Jacobians. To address this issue, we introduce GRILL, a technique that locally restores gradient signals in ill-conditioned layers, enabling more effective norm-bounded attacks. Through extensive experiments across multiple AE architectures, considering both sample-specific and universal attacks under both standard and adaptive attack settings, we show that GRILL significantly increases attack effectiveness, leading to a more rigorous evaluation of AE robustness. Beyond AEs, we provide empirical evidence that modern multimodal architectures with encoder-decoder structures exhibit similar vulnerabilities under GRILL.
Paper Structure (35 sections, 10 equations, 53 figures, 3 tables, 1 algorithm)

This paper contains 35 sections, 10 equations, 53 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Our Contribution.
  3. Related Work
  4. Preliminaries
  5. Notation.
  6. Multidimensional Chain Rule.
  7. Multidimensional Taylor Approximation.
  8. Output–space Maximization(OA).
  9. Latent–space Maximization (LA).
  10. Condition number.
  11. Ill-conditioning in AEs
  12. Latent Gradient Restoration in Encoder due to Ill-Conditioned Decoder
  13. Gradient Signal Restoration in Ill-Conditioned Layers
  14. Aggregated adversarial objective.
  15. Experiments
  16. ...and 20 more sections

Figures (53)

  • Figure 1: Universal attacks on highly ill-conditioned models. OD is output distortion.
  • Figure 2: Universal attacks on moderately ill-conditioned models. OD is output distortion.
  • Figure 3: Universal adaptive attacks: Output distortion under varying perturbation radii $c$ for NVAE (a), DiffAE (b), TC-VAE (c), $\beta$-VAE (d), and MAE (e).
  • Figure 8: (a) Output distortion distributions for GRILL layer-fraction ablations on NVAE; (b) distributions of partial derivatives of the adversarial loss gradient during optimization.
  • Figure 9: Adversarial loss partial derivatives histograms (universal attacks at $c = 0.3$ on DiffAE). Note: range chosen for visualization; no gradient clipping.
  • ...and 48 more figures