[论文解读] Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions

Yao Qin, Nicholas Frosst+4 more|arXiv (Cornell University)|Jul 5, 2019

Adversarial Robustness in Machine Learning参考文献 41被引用 37

一句话总结

本文提出一种基于类别条件的重建机制，结合 Capsule Networks (CapsNets) 来检测对抗图像，将该方法扩展到 CNN，并研究了旨在规避检测的重建性攻击。CapsNets 在对 MNIST、Fashion-MNIST、SVHN 和 CIFAR-10 的检测中优于 CNN。

ABSTRACT

Adversarial examples raise questions about whether neural network models are sensitive to the same visual features as humans. In this paper, we first detect adversarial examples or otherwise corrupted images based on a class-conditional reconstruction of the input. To specifically attack our detection mechanism, we propose the Reconstructive Attack which seeks both to cause a misclassification and a low reconstruction error. This reconstructive attack produces undetected adversarial examples but with much smaller success rate. Among all these attacks, we find that CapsNets always perform better than convolutional networks. Then, we diagnose the adversarial examples for CapsNets and find that the success of the reconstructive attack is highly related to the visual similarity between the source and target class. Additionally, the resulting perturbations can cause the input image to appear visually more like the target class and hence become non-adversarial. This suggests that CapsNets use features that are more aligned with human perception and have the potential to address the central issue raised by adversarial examples.

研究动机与目标

• Motivate robust detection of adversarial examples rather than purely improving classification accuracy.
• Leverage class-conditional reconstructions from CapsNets to distinguish natural from adversarial inputs.
• Extend the detection approach to CNN architectures to compare effectiveness.
• Investigate the impact of an attacker specifically targeting the detection mechanism (Reconstructive Attack).
• Qualitatively analyze why CapsNets’ features align better with human perception and resist manipulation.

提出的方法

• Use a class-conditional reconstruction network that reconstructs inputs from the pose parameters of the winning Capsule.
• Mask and feed only the predicted class’s pose parameters to generate a class-specific reconstruction.
• Compute the reconstruction distance between the input and its class-conditional reconstruction and flag adversaries by thresholding this distance.
• Extend the approach to CNNs by introducing a CNN+CR (class-conditional reconstruction) model and a CNN+R baseline.
• Design a Reconstructive Attack that optimizes both classification loss and reconstruction distance to bypass detection.

实验结果

研究问题

• RQ1 Can class-conditional capsule reconstructions detect standard white-box and black-box adversarial attacks across multiple datasets?
• RQ2 Does the reconstruction-based detector transfer to CNN architectures, and how do CapsNets compare to CNNs in detection performance?
• RQ3 How does a defense-aware reconstructive attack perform against CapsNets versus CNN-based models?
• RQ4 What insights can be drawn about the perceptual alignment of CapsNet features versus CNN features from adversarial failures and recoveries?
• RQ5 How well does the approach scale to more complex datasets like CIFAR-10?

主要发现

• CapsNets achieve the strongest attack detection rates and accuracy across MNIST, Fashion-MNIST, and SVHN, outperforming CNN-based models.
• A defense-aware Reconstructive Attack can produce undetected adversarial examples but with a lower success rate than non-reconstructive attacks, and CapsNets still show better robustness.
• CNN+CR improves detection over CNN+R, indicating class-conditional reconstruction aids robustness similarly to CapsNets.
• On Corrupted MNIST, all three models detect distributional shifts effectively, with CapsNet showing particularly strong performance.
• On CIFAR-10, CapsNets with class-conditional reconstruction maintain detection advantages and exhibit reduced transferability of attacks.