[Paper Review] Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions

Yao Qin, Nicholas Frosst+4 more|arXiv (Cornell University)|Jul 5, 2019

Adversarial Robustness in Machine Learning41 references37 citations

TL;DR

The paper introduces a class-conditional reconstruction mechanism with Capsule Networks (CapsNets) to detect adversarial images, extending the approach to CNNs, and studies a reconstructive attack designed to bypass detection. CapsNets outperform CNNs in detection across MNIST, Fashion-MNIST, SVHN, and CIFAR-10.

ABSTRACT

Adversarial examples raise questions about whether neural network models are sensitive to the same visual features as humans. In this paper, we first detect adversarial examples or otherwise corrupted images based on a class-conditional reconstruction of the input. To specifically attack our detection mechanism, we propose the Reconstructive Attack which seeks both to cause a misclassification and a low reconstruction error. This reconstructive attack produces undetected adversarial examples but with much smaller success rate. Among all these attacks, we find that CapsNets always perform better than convolutional networks. Then, we diagnose the adversarial examples for CapsNets and find that the success of the reconstructive attack is highly related to the visual similarity between the source and target class. Additionally, the resulting perturbations can cause the input image to appear visually more like the target class and hence become non-adversarial. This suggests that CapsNets use features that are more aligned with human perception and have the potential to address the central issue raised by adversarial examples.

Motivation & Objective

• Motivate robust detection of adversarial examples rather than purely improving classification accuracy.
• Leverage class-conditional reconstructions from CapsNets to distinguish natural from adversarial inputs.
• Extend the detection approach to CNN architectures to compare effectiveness.
• Investigate the impact of an attacker specifically targeting the detection mechanism (Reconstructive Attack).
• Qualitatively analyze why CapsNets’ features align better with human perception and resist manipulation.

Proposed method

• Use a class-conditional reconstruction network that reconstructs inputs from the pose parameters of the winning Capsule.
• Mask and feed only the predicted class’s pose parameters to generate a class-specific reconstruction.
• Compute the reconstruction distance between the input and its class-conditional reconstruction and flag adversaries by thresholding this distance.
• Extend the approach to CNNs by introducing a CNN+CR (class-conditional reconstruction) model and a CNN+R baseline.
• Design a Reconstructive Attack that optimizes both classification loss and reconstruction distance to bypass detection.

Experimental results

Research questions

• RQ1 Can class-conditional capsule reconstructions detect standard white-box and black-box adversarial attacks across multiple datasets?
• RQ2 Does the reconstruction-based detector transfer to CNN architectures, and how do CapsNets compare to CNNs in detection performance?
• RQ3 How does a defense-aware reconstructive attack perform against CapsNets versus CNN-based models?
• RQ4 What insights can be drawn about the perceptual alignment of CapsNet features versus CNN features from adversarial failures and recoveries?
• RQ5 How well does the approach scale to more complex datasets like CIFAR-10?

Key findings

• CapsNets achieve the strongest attack detection rates and accuracy across MNIST, Fashion-MNIST, and SVHN, outperforming CNN-based models.
• A defense-aware Reconstructive Attack can produce undetected adversarial examples but with a lower success rate than non-reconstructive attacks, and CapsNets still show better robustness.
• CNN+CR improves detection over CNN+R, indicating class-conditional reconstruction aids robustness similarly to CapsNets.
• On Corrupted MNIST, all three models detect distributional shifts effectively, with CapsNet showing particularly strong performance.
• On CIFAR-10, CapsNets with class-conditional reconstruction maintain detection advantages and exhibit reduced transferability of attacks.