Experiments

Using this setup, we visualize the generated images from StyleGAN.

Observing the outputs, this is an expected results. Since MSE is a paired loss function, any photorealistic face which doesn't look like the input face can maximize the loss function during the adversarial attack. Moreover, since the attack is strictly constrained, this setup is unable to explore the entire latent space to arrive at adversarial holes. Therefore, we need to remove the constraints for PGD. Moreover, we also need to impose a stricter loss function since, in some sense, there are multiple solutions to maximization of MSE loss and an adversarial holes is not the only solution.

In order to generate an image from StyleGAN, a latent vector is first sampled from a standard normal distribution (called the z-space). From this latent vector, a (non-linear) latent mapper is employed to transform this distribution into a learned latent distribution (called the w-space). In this experiment, we first adversarially perturb the initial sampled vector from the z-space. Next, we perturb the resultant mapped latent vector from the W-space. The results are visualized below.

The outputs start to look like random noise. This means that the adversarial attack indeed leads us to latent codes which, when sampled, lead to very poor reconstructions. While these results look promising, we need to verify whether the adversarially perturbed latent code in the z-space still belongs to a standard normal distribution. In order to verify this, we perform PCA and project the latent vectors into 2 dimensions and plot them.

In the z-space, we observe that the sampled latent vectors are tightly packed around the origin. This is expected, since they are sampled from a standard normal distribution. The adversarial latent codes (in green) are much larger in magnitude and probably out of distribution. This is even more evident for the case of w-space, where all the sampled points collapse into a single dot since the magnitude of the adversarial latent vectors is significantly larger.

Therefore, this experiment remains inconclusive. For points outside the distribution, random generations are expected. For our next experiment, we look to enforce distribution similarity.

In order to verify our intuition, we plot the trajectory of the projected latent vector across the iterations of the adversarial attack.

Evident from the scale of the plots, the magnitude of the latent vector projections has been reduced. At the very least, this ensures that the adversarial vector does not lie well outside the latent distribution. In order to verify this claim, we visualize the generated faces corresponding to these adversarial vectors.

The faces generated from the adversarial latent vectors contain some artefacts. At this stage, we raise the question: "What does it really mean to have an adversarially latent vector?" Since these faces do not look particularly realistic, these could be considered as adversarial. However, we wish to take this one step further. In our formulation, we consider adversarial latent vectors as those which result in noisy and random generations.

Using this network, we visualize the generated faces after the adversarial attack below. We also plot the PCA projections corresponding to the adversarially attacked latent vectors.

The faces generated by the generator corresponding to latent vectors from the adversarial holes do not look realistic at all. Moreover, most of these projections lie close to the original distribution. By large, it seems as though they lie in the original latent distribution. Therefore, we have successfully arrived at adversarial holes i.e., latent vectors (obtained adversarially) within the latent distribution corresponding to which generated images are very noisy and not realistic.

Unfortunately, this setup proves extremely hard to train. We observe exploding loss values and gradients, and despite our best efforts, could not seem to get this training to converge.

In the Z-Space, the lowest FID is observed using MSE loss and constrained PGD, since the strong clamping on the gradient step prevents the latent codes to drift away from the original latent distribution. This is also proven by the fact that the FID is similar to the FID computed for the sampled images. In an unconstrained PGD setting, the FID is the highest without enforcing KL divergence between z and adv_z. Moreover, it is also significantly greater than the FID for the sampled images, which suggests that the adversarial latent codes may have strayed out of distribution. On enforcing KL Divergence, we observe a slight fall in the FID. Finally, on replacing the StyleGAN discriminator with a noise discriminator, we obtain similar results, which proves that adding KL Divergence is indeed necessary.

In the W-Space, we observe surprising results. In experiment 1 and 2, we observe lower FID than the sampled images, which may be due to some sampling artefacts. We use a small sample size (15) due to compute constraints which significantly impacts the FID metric. For the experiments that follow, since the exact distribution of W Space is unknown in it's closed form, we cannot enforce KL divergence.