Detecting and Diagnosing Adversarial Images with Class-Conditional Capsule Reconstructions

Abstract

Adversarial examples raise questions about whether neural network models are sensitive to the same visual features as humans. In this paper, we first detect adversarial examples or otherwise corrupted images based on a class-conditional reconstruction of the input. To specifically attack our detection mechanism, we propose the Reconstructive Attack which seeks both to cause a misclassification and a low reconstruction error. This reconstructive attack produces undetected adversarial examples but with much smaller success rate. Among all these attacks, we find that CapsNets always perform better than convolutional networks. Then, we diagnose the adversarial examples for CapsNets and find that the success of the reconstructive attack is highly related to the visual similarity between the source and target class. Additionally, the resulting perturbations can cause the input image to appear visually more like the target class and hence become non-adversarial. This suggests that CapsNets use features that are more aligned with human perception and have the potential to address the central issue raised by adversarial examples.

References in corpus (13)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Detecting Adversarial Samples from Artifacts
• On the (Statistical) Detection of Adversarial Examples
• Towards the first adversarially robust neural network model on MNIST
• On Detecting Adversarial Perturbations
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Motivating the Rules of the Game for Adversarial Example Research
• Early Methods for Detecting Adversarial Images
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Adversarial Spheres
• With Friends Like These, Who Needs Adversaries?
• On the Vulnerability of Capsule Networks to Adversarial Attacks
• Are Odds Really Odd? Bypassing Statistical Detection of Adversarial Examples

Cited by in corpus (6)

• Controversial stimuli: pitting neural networks against each other as models of human recognition
• DESCNet: Developing Efficient Scratchpad Memories for Capsule Network Hardware
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses