Adversarial Robustness of Flow-Based Generative Models - AISTATS 2020 Proceedings

Sep 18, 2026

Uploaded by Graffin

Flow-based generative models use invertible generator functions and maximum-likelihood training to fit data distributions, yet adversarial robustness remains insufficiently studied. This paper analyzes robustness theoretically for linear flow models and empirically for nonlinear models including GLOW and RealNVP, designing in-distribution and out-of-distribution attacks. Results show extreme sensitivity, while hybrid adversarial training substantially improves robustness by boosting defense effectiveness.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages10

Reading Time25 min

AccessFree to download

Abstract

1 Introduction

Generative modeling and likelihood-based approaches

Adversarial robustness motivation

Main theoretical and empirical contributions

Adversarial Robustness of Flow-Based Generative Models Phillip Pope􀀃 Yogesh Balaji􀀃 Soheil Feizi University of Maryland, College Park Abstract Flow-based generative models leverage invertible generator functions to 􀀌t a distribution to the training data using maximum likelihood. Despite their use in several application domains, robustness of these models to adversarial attacks has hardly been explored. In this paper, we study adversarial robustness of 􀀍ow-based generative models both theoretically (for some simple models) and empirically (for more complex ones) . First, we consider a linear 􀀍ow-based generative model and compute optimal samplespeci􀀌c and universal adversarial perturbations that maximally decrease the likelihood scores. Using this result, we study the robustness of the well-known adversarial training procedure, where we characterize the fundamental trade-o􀀋 between model robustness and accuracy. Next, we empirically study the robustness of two prominent deep, nonlinear, 􀀍ow-based generative models, namely GLOW and RealNVP. We design two types of adversarial attacks; one that minimizes the likelihood scores of in-distribution samples, while the other that maximizes the likelihood scores of out-of-distribution ones. We 􀀌nd that GLOW and RealNVP are extremely sensitive to both types of attacks. Finally, using a hybrid adversarial training procedure, we signi􀀌cantly boost the robustness of these generative models. 1 Introduction The promise of modern deep generative models is to learn data distributions with su􀀎ciently high 􀀌delity, Proceedings of the 23rd International Conference on Arti􀀌 -cial Intelligence and Statistics (AISTATS) 2020, Palermo, Italy. PMLR: Volume 108 . Copyright 2020 by the author(s) . allowing simulation of realistic samples. Some applications include photo-realistic image generation, audio synthesis, and image to text generation (Reed et al. , 2016; Ledig et al., 2017; van den Oord et al., 2016a) . Generative Adversarial Networks (GANs)(Goodfellow et al., 2014) have become a popular choice in modern generative modeling, often obtaining the state-of-theart results in image and video synthesis (Karras et al. , 2018) . While GANs can synthesize samples from a data distribution, their inability to compute sample likelihoods limits their usage in statistical inference tasks (Balaji et al., 2019) . Likelihood-based models, on the other hand, explicitly 􀀌t a generative model to the data using a maximum likelihood optimization, enabling exact or approximate evaluations of sample likelihoods at the test time. Some popular choices include auto-regressive models (van den Oord et al., 2016b), (Oord et al., 2016), Variational Auto-encoders (Kingma & Welling, 2019), and methods based on normalizing 􀀍ow (Rezende & Mohamed, 2015) . Notably, 􀀍ow-based models (Kingma & Dhariwal, 2018; Dinh et al., 2017) leverage invertible generator functions to learn a bijective mapping between latent space and the data distribution, enabling an exact sample likelihood computation. The focus of this paper is to perform a comprehensive study of robustness of likelihood-based generative models to adversarial perturbations of their inputs. While there has been progress on adversarial robustness of classi􀀌cation problems (Madry et al. , 2018), robustness of likelihood models has not been explored in the literature. Performing such a sensitivity analysis is crucial for reliable deployment, especially in safetycritical applications. For instance, one application where likelihood estimation is crucial is unsupervised anomaly detection in medical imaging, where out-ofdistribution samples can be detected using likelihood scores. Adversarial attacks on such systems can lead to false diagnosis, potentially bearing life-threatening consequences. First, we present a theoretical analysis of the sensitivity of linear generative models that 􀀌t a Gaussian 􀀃 First two authors contributed equally Clean image In-dis

FAQs

What problem does the paper study about flow-based generative models?

It studies how flow-based generative models respond to adversarial perturbations, focusing on whether attackers can reduce likelihood scores for in-distribution and out-of-distribution inputs.

How do the authors analyze robustness in the paper?

They provide a theoretical analysis for a linear flow-based generative model and then run empirical experiments on nonlinear flow models such as GLOW and RealNVP using designed adversarial attacks.

What defense approach improves robustness according to the paper?

A hybrid adversarial training procedure significantly boosts robustness, reducing the impact of adversarial attacks on likelihood scores.

Sep 18, 2026

Uploaded by Graffin