A Proofs

In this section, we provide the proofs of the propositions stated in the main text. However, if an'inconsistent' decoder-encoder pair would be used, an encoder with a perturbed mean In the PCA case, the invariant subspace is explicitly known thanks to the linearity. "autoencoding" requires that realizations generated by the decoder are approximately invariant when The algorithm is shown in Algorithm 1. While SE introduced an'external selection mechanism' to generate adversarial examples, the analysis in this appendix shows that the approach could be viewed as a robust Bayesian We can employ a robust Bayesian approach to define a'pessimistic' bound in the sense of selecting With the given tighter bound the algorithm for SE is shown in Algorithm 2. From Equation 18 we This algorithm can be used for post training an already trained V AE. Figure 6 shows the graphical The algorithm is shown in Algorithm 4. We approximate the required expectations by their Monte C.5 SE-A V AE Figure 7 shows the graphical model describing A V AE-SS model. The algorithm is shown in Algorithm 3. We approximate the required expectations by their Monte In this example Section 3.1, we will assume that both the observations Convolutional architectures are stabilized using BatchNorm between each convolutional layer.