[Paper Review] LatentPoison - Adversarial Attacks On The Latent Space

Antonia Creswell, Anil A. Bharath+1 more|arXiv (Cornell University)|Nov 8, 2017

Adversarial Robustness in Machine Learning11 references9 citations

TL;DR

This paper proposes LatentPoison, a novel adversarial attack that manipulates the latent space of a deep variational autoencoder (dVAE) to flip classification labels with minimal perturbations. By applying small, targeted additive or multiplicative perturbations to the latent codes—without requiring model parameters—it successfully flips predictions while preserving decoded image quality and maintaining high confidence scores, demonstrating stealthy, latent-space-based evasion of classification systems.

ABSTRACT

Robustness and security of machine learning (ML) systems are intertwined, wherein a non-robust ML system (classifiers, regressors, etc.) can be subject to attacks using a wide variety of exploits. With the advent of scalable deep learning methodologies, a lot of emphasis has been put on the robustness of supervised, unsupervised and reinforcement learning algorithms. Here, we study the robustness of the latent space of a deep variational autoencoder (dVAE), an unsupervised generative framework, to show that it is indeed possible to perturb the latent space, flip the class predictions and keep the classification probability approximately equal before and after an attack. This means that an agent that looks at the outputs of a decoder would remain oblivious to an attack.

Motivation & Objective

• To investigate whether the latent space of a deep variational autoencoder (dVAE) can be manipulated to alter classification outcomes without detection.
• To develop a practical adversarial attack that operates solely on latent encodings, requiring only access to the encoder output and classifier predictions, not model parameters.
• To evaluate the stealthiness and effectiveness of latent-space attacks under different regularization schemes (L1 and L2) and perturbation types (additive, multiplicative).
• To demonstrate that minimal perturbations in the latent space can cause significant semantic changes in decoded outputs while maintaining high classification confidence.

Proposed method

• The attack learns a transformation 𝒯∘z that maps a latent code z of a given class to a latent code that decodes to a different class, using only the encoder output and classifier predictions.
• The method employs additive perturbations Δz to the latent code, optimized via a loss function that maximizes the classifier’s confidence in the target class while minimizing the L1 or L2 norm of Δz.
• L1 regularization is used to promote sparsity in Δz, ensuring only a few latent units are modified, enhancing stealthiness.
• The attack is evaluated using a binary classification setup on a dataset of facial images (smile vs. no smile), where the decoder reconstructs images from perturbed latent codes.
• The attack is applied independently to each latent code, with the same transformation 𝒯 used across all samples, making it scalable and generalizable.
• The success of the attack is attributed to the near-linear structure of the dVAE latent space, enabling smooth interpolation between classes.

Experimental results

Research questions

• RQ1 Can adversarial perturbations in the latent space of a dVAE successfully flip the predicted class of a decoded image without altering perceptual quality?
• RQ2 How effective is the attack when only the encoder output and classifier predictions are accessible, without model parameters?
• RQ3 To what extent does L1 regularization reduce the number of modified latent units, and does this enhance the stealthiness of the attack?
• RQ4 How do different perturbation types (additive vs. multiplicative) and regularization schemes affect the attack’s success and detectability?
• RQ5 Can the attack maintain high classifier confidence in the flipped class while keeping the confidence of the original class unchanged?

Key findings

• The attack successfully flips the predicted class from 'no smile' to 'smile' and vice versa, with reconstructed images remaining visually indistinguishable from original reconstructions.
• Under L1 regularization, the attack achieves high sparsity in Δz, modifying only a small number of latent units while still flipping predictions.
• For the 'no smile → smile' attack, the classifier confidence increased to 0.98 in the Poisoning+Class attack type, indicating strong optimization of the perturbation.
• The 'smile → no smile' attack achieved a confidence of 0.96 under the same conditions, showing consistent performance across both directions.
• The attack remains stealthy because the confidence of the tampered output is higher than that of the original data and reconstructed samples, making detection difficult.
• The success of the attack is primarily due to the near-linear structure of the dVAE latent space, enabling smooth transitions between classes via additive perturbations.