DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules

Abstract

We present a simple technique that allows capsule models to detect adversarial images. In addition to being trained to classify images, the capsule model is trained to reconstruct the images from the pose parameters and identity of the correct top-level capsule. Adversarial images do not look like a typical member of the predicted class and they have much larger reconstruction errors when the reconstruction is produced from the top-level capsule for that class. We show that setting a threshold on the $l2$ distance between the input image and its reconstruction from the winning capsule is very effective at detecting adversarial images for three different datasets. The same technique works quite well for CNNs that have been trained to reconstruct the image from all or part of the last hidden layer before the softmax. We then explore a stronger, white-box attack that takes the reconstruction error into account. This attack is able to fool our detection technique but in order to make the model change its prediction to another class, the attack must typically make the "adversarial" image resemble images of the other class.

arXiv commentTo be presented at NIPS 2018 Workshop on Security in Machine Learning

References in corpus (3)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Towards the first adversarially robust neural network model on MNIST
• The Robust Manifold Defense: Adversarial Training using Generative Models

Cited by in corpus (13)

• Controversial stimuli: pitting neural networks against each other as models of human recognition
• Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamics
• PaXNet: Dental Caries Detection in Panoramic X-ray using Ensemble Transfer Learning and Capsule Classifier
• CapsAttacks: Robust and Imperceptible Adversarial Attacks on Capsule Networks
• On the Vulnerability of Capsule Networks to Adversarial Attacks
• On Learning and Learned Data Representation by Capsule Networks
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Understanding the Limitations of Conditional Generative Models
• ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Kernelized Capsule Networks
• An Information-Theoretic Explanation for the Adversarial Fragility of AI Classifiers
• Back to Square One: Superhuman Performance in Chutes and Ladders Through Deep Neural Networks and Tree Search