The generative autoencoders, such as the variational autoencoders or the
adversarial autoencoders, have achieved great success in lots of real-world
applications, including image generation, and signal communication.
However, little concern has been devoted to their robustness during practical
deployment.
Due to the probabilistic latent structure, variational autoencoders (VAEs)
may confront problems such as a mismatch between the posterior distribution of
the latent and real data manifold, or discontinuity in the posterior
distribution of the latent.
This leaves a back door for malicious attackers to collapse VAEs from the
latent space, especially in scenarios where the encoder and decoder are used
separately, such as communication and compressed sensing.
In this work, we provide the first study on the adversarial robustness of
generative autoencoders in the latent space.
Specifically, we empirically demonstrate the latent vulnerability of popular
generative autoencoders through attacks in the latent space.
We also evaluate the difference between variational autoencoders and their
deterministic variants and observe that the latter performs better in latent
robustness.
Meanwhile, we identify a potential trade-off between the adversarial
robustness and the degree of the disentanglement of the latent codes.
Additionally, we also verify the feasibility of improvement for the latent
robustness of VAEs through adversarial training.
In summary, we suggest concerning the adversarial latent robustness of the
generative autoencoders, analyze several robustness-relative issues, and give
some insights into a series of key challenges.

本文第一次对生成自编码器的最坏情况容忍性进行研究，发现在某些情况下，恶意攻击者可以利用潜在空间攻击常见的生成自编码器，同时我们通过实验还发现了生成自编码器与其确定性变体之间的差异，并考虑了在最坏情况容忍性和潜在代码解缠之间的潜在权衡。

关于生成型自编码器在潜空间的对抗性鲁棒性

On the Adversarial Robustness of Generative Autoencoders in the Latent  Space

Invisible watermarks safeguard images' copyrights by embedding hidden
messages detectable by owners. It also prevents people from misusing images,
especially those generated by AI models. Malicious adversaries can violate
these rights by removing the watermarks. In order to remove watermarks without
damaging the visual quality, the adversary needs to erase them while retaining
the essential information in the image. This is analogous to the encoding and
decoding process of generative autoencoders, especially variational
autoencoders (VAEs) and diffusion models. We propose a framework using
generative autoencoders to remove invisible watermarks and test it using VAEs
and diffusions. Our results reveal that, even without specific training,
off-the-shelf Stable Diffusion effectively removes most watermarks, surpassing
all current attackers. The result underscores the vulnerabilities in existing
watermarking schemes and calls for more robust methods for copyright
protection.

使用生成自编码器的框架，特别是变分自编码器（VAEs）和扩散模型，成功地移除了水印，且比目前所有其他攻击者都表现更好。

生成型自动编码器用作水印攻击者：漏洞和威胁的分析

Generative Autoencoders as Watermark Attackers: Analyses of  Vulnerabilities and Threats

Generative autoencoders offer a promising approach for controllable text
generation by leveraging their latent sentence representations. However,
current models struggle to maintain coherent latent spaces required to perform
meaningful text manipulations via latent vector operations. Specifically, we
demonstrate by example that neural encoders do not necessarily map similar
sentences to nearby latent vectors. A theoretical explanation for this
phenomenon establishes that high capacity autoencoders can learn an arbitrary
mapping between sequences and associated latent representations. To remedy this
issue, we augment adversarial autoencoders with a denoising objective where
original sentences are reconstructed from perturbed versions (referred to as
DAAE). We prove that this simple modification guides the latent space geometry
of the resulting model by encouraging the encoder to map similar texts to
similar latent representations. In empirical comparisons with various types of
autoencoders, our model provides the best trade-off between generation quality
and reconstruction capacity. Moreover, the improved geometry of the DAAE latent
space enables zero-shot text style transfer via simple latent vector
arithmetic.

本文介绍了一种通过利用生成自编码器的潜在句子表示来实现可控制文本生成的方法。作者提出了一种改进自动编码器的方法，被称为 DAAE，该方法可以在维持生成质量的同时，提高模型中的潜在空间几何性，从而实现了通过简单潜在向量算术进行全零文本风格转换。