This paper studies the adversarial robustness of deep autoencoders (AEs). We observe that the irreversible nature of AEs leads existing adversarial attack algorithms to remain in suboptimal attacks. This is due to the weakening of gradient signals caused by near-zero singular values in the ill-conditioned layer. To address this, we propose the GRILL technique, which locally restores gradient signals in the ill-conditioned layer. Experiments under various AE architectures, sample-specific and general-purpose attack settings, and standard and adaptive attack settings demonstrate that GRILL significantly enhances the effectiveness of adversarial attacks, thereby enhancing the rigor of AE robustness evaluations.
