VAE fails to encode typical samples, new method improves robustness.
problem VAE does not necessarily encode typical samples generated by its decoder.
method Alternative construction of variational approximation distribution, self-consistency approach.
result Encoders trained with self-consistency approach are robust to adversarial attacks.