Standard Convolutional Neural Networks (CNNs) can be easily fooled by images with small quasi-imperceptible artificial perturbations. As alternatives to CNNs, the recently proposed Capsule Networks (CapsNets) are shown to be more robust to white-box attacks than CNNs under popular attack protocols. Besides, the class-conditional reconstruction part of CapsNets is also used to detect adversarial examples. In this work, we investigate the adversarial robustness of CapsNets, especially how the inner workings of CapsNets change when the output capsules are attacked. The first observation is that adversarial examples misled CapsNets by manipulating the votes from primary capsules. Another observation is the high computational cost, when we directly apply multi-step attack methods designed for CNNs to attack CapsNets, due to the computationally expensive routing mechanism. Motivated by these two observations, we propose a novel vote attack where we attack votes of CapsNets directly. Our vote attack is not only effective but also efficient by circumventing the routing process. Furthermore, we integrate our vote attack into the detection-aware attack paradigm, which can successfully bypass the class-conditional reconstruction based detection method. Extensive experiments demonstrate the superior attack performance of our vote attack on CapsNets.
An Efficient Approach for Using Expectation Maximization Algorithm in Capsule Networks
Bu Ali Sina University（布阿里西那大学）
胶囊网络（CapsNets）是一种全新的架构，在计算机视觉（CV）的某些领域取得了突破性的成果。2017年，Hinton和他的团队在Sabour et al中引入了具有协议路由的CapsNets，并在最近的一篇论文“Matrix Capsules with EM Routing”中提出了一种更完整的具有期望最大化（EM）算法的架构。与传统的卷积神经网络（CNN）不同，这种架构能够保持图片中对象的姿态。由于这一特性，它已经能够击败smallNORB数据集上的先前最先进的结果，其中包括具有各种观点的样本。此外，该架构对于白盒对抗攻击更鲁棒。然而，CapsNets有两个主要缺点。它们在复杂数据集上的表现不如CNN，并且需要大量的时间进行训练。我们试图通过找到用于训练CapsNet的EM路由迭代的最佳设置来减轻这些缺点。与过去的研究不同，我们使用不等数量的EM路由迭代的CapsNet的不同阶段。在我们的研究中，我们使用了三个数据集：耶鲁人脸数据集，比利时交通标志数据集和Fashion-MNIST数据集。
Use of a Capsule Network to Detect Fake Images and Videos
SOKENDAI (The Graduate University for Advanced Studies)（総合研究大学院大学（高等研究科大学院））；National Institute of Informatics（情报学研究所）；The University of Tokyo（东京大学）；The University of Edinburgh（爱丁堡大学）
Quaternion Equivariant Capsule Networks for 3D Point Clouds
University of Padova（帕多瓦大学）；Stanford University（斯坦福大学）；TU Munich（慕尼黑工业大学）；TU Dortmund（多特蒙德工业大学）；Google（谷歌）
我们提出了一个3D胶囊模块处理点云，是等变的3D旋转和平移，以及不变的输入点的排列。该操作员接收一组稀疏的本地参考系，从输入点云计算，并建立端到端的变换等方差通过一种新的动态路由程序的四元数。此外，我们从理论上连接胶囊之间的动态路由到著名的Weiszfeld算法，一个解决\emph{iterative re-weighted least squares}（IRLS）问题的可证明收敛性的计划。结果表明，这样的组动态路由可以被解释为强大的IRLS旋转平均胶囊投票，信息路由的基础上，最终的内点得分。基于我们的算子，我们构建了一个胶囊网络，将几何形状从姿势中分离出来，为更多信息的描述符和结构化的潜在空间铺平了道路。我们的架构允许联合对象分类和方向估计，而无需明确的监督旋转。我们验证我们的算法经验上常见的基准数据集。
Enhancing Transformation-based Defenses using a Distribution Classifier
National University of Singapore（新加坡国立大学）；Bioinformatics Institute, A*STAR（新加坡科技研究局生物信息学研究所）；CNRS UMI 2955（法国国家科学研究中心联合实验室2955）；Singapore Eye Research Institute（新加坡眼科研究所）
CapST: Leveraging Capsule Networks and Temporal Attention for Accurate Model Attribution in Deep-fake Videos
Institute of Information Science, Academia Sinica（资讯研究所）；Social Networks and Human-Centred Computing, Taiwan International Graduate Program（人本计算与社交网络，台湾国际研究生计划）；Department of Computer Science, National Chengchi University（计算机科学系，国立成功大学）；Member IEEE, National Chengchi University（IEEE会员，国立成功大学）；Fellow IEEE, Institute of Information Science, Academia Sinica（IEEE会士，资讯研究所）；Dire Dawa University（迪雷达瓦大学）；Research Center for Information Technology Innovation, Academia Sinica（资讯科技创新研究中心，学术院）
Busting the Paper Ballot: Voting Meets Adversarial Machine Learning
University of Rhode Island（罗德岛大学）；University of Connecticut（康涅狄格大学）；Northeastern University（东北大学）；Stony Brook University（石溪大学）；University of Connecticut Voting Technology Center（康涅狄格大学选举技术中心）；Synchrony Chair in Cybersecurity University of Connecticut（康涅狄格大学网络安全荣誉教授职位）
