An evaluation device receives input of latent variables of a variational autoencoder, clusters the input latent variables, and assigns, for each cluster, a label indicating the cluster to latent variables belonging to the cluster. After that, the evaluation device performs learning of a classifier so as to accurately classify the latent variables based on the assigned label, performs an adversarial attack resistance evaluation for the classifier after learning, and outputs a result of the resistance evaluation. Thus, the evaluation device can perform an adversarial attack resistance evaluation even for a variational autoencoder that uses unlabeled data as input data.