This paper studies the adversarial robustness of deep autoencoders (AEs). We highlight the problem that existing adversarial attack algorithms remain suboptimal due to the irreversible nature of AEs. Specifically, we observe that the adversarial loss gradients propagated back into poorly conditioned layers vanish. This is due to the weakening of the gradient signal due to singular values in the Jacobian matrix of these layers that are approximately zero. Therefore, we propose the GRILL technique, which locally restores the gradient signal in poorly conditioned layers. Extensive experiments under various AE structures and attack settings (sample-specific and general-purpose attacks, standard and adaptive attacks) demonstrate that GRILL significantly enhances the effectiveness of adversarial attacks, enabling a more rigorous evaluation of AE robustness.
