Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: I think the approach proposed by the authors to attack CapsNets and show how they are affected by adversarial examples is solid. It is backed by a comprehensive experimental design and empirical evidence, demonstrating that attacking the voting process of routing is better than attacking output capsules directly. 
Comments:
-- I am not sure that this statement is accurate "Since the routing process is the main difference between CapsNets and CNNs,...."....Capsules are built under different premises one of which is the routing process.
--   "In couter-part[sic] CapsNets, we apply ResNet18 backbone to extract primary capsules".......What's the point of using a ResNet-18 backbone with CapsNets when the whole point of CapsNets is to adhere to the premises they were built under. I understand that in this paper authors evaluate a certain property but how do you know that ResNet-18 does not have an effect on this? 
-- To understand table 1 better, is Resnet = Resnet-18 and CapsNets= ResNet-18 backbone + Capsules?

Improvements:
-- Generalise this approach to other proposed CapsNets architectures, beyond Dynamic Routing, such as VarCaps (De Sousa et al. AAAI 2020, StarCaps (Ahmed et al.) etc
-- Use the architecture without a ResNet backbone, but just a single CNN layer in the input
-- SmallNorb could be used to see whether the novel viewpoint generalisation is affected and to what extent.
--Along the same lines Affnist could also be used to see the effect on affine transformations (along with or instead of Cifar10 that was presented in the appendix)

Typos:
--Line 3 Section 4 "(see Equation (??))"
review_title: Good submission on attacking CapsNets in the voting process

final_score: rating: 8: Top 50% of accepted papers, clear accept
review_content: The paper investigates robustness of Capsule Networks (CapsNets) under adversarial attacks and makes several interesting observations around the behaviour of CapsNets under attack regime which have been used later to design a new attack against these types of networks (vote attack).  Through several experiments, they show the proposed vote-attack can reduce the robust accuracy of CapsNets significantly across different methods. Authors analyze the effectiveness of this attack from different perspectives (i.e.  transferability of adversarial examples, the adversarial robustness on affine-transformed inputs).


- Correctness and Clarity: The paper seems correct and concise and they experiment different aspects of the methods for effectiveness. The paper is also in general  well-written and easy to follow.
- Reproducibility: They have also provided several tables and figures on the main paper and appendix to help with understanding of the results and method. They also provided detailed description of the methods, training and experimental setup.  It would be great if authors could also release the code to reproduce the results.
Relation to prior works: I am curious to see if the proposed attack can still be effective for Self-Routing Capsule Networks (Hanh et al.)  and the other family of CapsNets in which the different routing mechanism has been used. 
Additional Feedback and Suggestions: There are some editorial issues, like missing ref to equations (e.g. Equation ??) , and missing name tags for numbered items (e.g. Table 4.)

review_title:    

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper presents a new adversarial attack targeting the votes derived from the primary capsules of a capsule network. It demonstrates that this is a stronger attack against capsules networks than an attack directly optimizing the output logits of a capsule model. This paper has some novel contributions to the literature but can be improved in a few areas.  

The paper spends a fair bit of time discussing the efficiency of their attack but does not meaningfully motivate this focus. They claim that the time it takes to compute adversarial attacks against capsule networks may have contributed to the claimed robustness, but all the papers they cite which discuss the adversarial robustness of capsule networks measures the success rate with respects to the number of attack optimization steps as opposed to optimization time. Furthermore as shown in table 3, their new attack does not significantly decrease the attack creation time for most optimization strategies. I believe the focus on attack optimization time should be removed from the paper entirely, and the space can be dedicated to some of the results relegated to the appendix such as black box attacks, or the class conditional reconstruction detection. 

By creating an attack that specifically targets the votes of the primary capsules this paper is able to increase the success rate of adversarial attacks against capsule networks. It does this however, by effectively not attacking the capsule part of a capsule network. Rather they have created an attack which optimizes the features extracted by the CNN feature extractor used to derive primary capsules. This is an interesting finding, and illustrates that capsules networks are more vulnerable to adversarial attack than perhaps previously believed due to their reliance on CNN feature extraction, but it is important to note that it does so by optimizing for activations of non-capsule components of a capsule network. This is not a major flaw of the paper, but i believe it warrants some discussion, space providing.

This paper also presents the success rate and undetected rate of their new attack against the class conditional reconstruction attack presented by Yao et al. This section improves the paper, but there are some omissions. Namely they do not in the main text nor in the appendix visualize the resultant attacks. This is an issue as both Yao et al (2020) (Detecting and diagnosing adversarial images with class-conditional capsule reconstructions) and  Yao et al (2020) (Deflecting Adversarial Attacks) show that the undetected attacks often resemble the target class, even under small epsilon bounds. This paper also does not address the additional defense mechanisms presented in Deflecting Adversarial Attacks, which were shown to drastically increase the attack detection rate, specifically in colour datasets such as cifar10.  

This paper would be improved by addressing those 3 main issues.  

------------------- 
smaller issues, 

the text describing figure 2 is confusing, and i am not entirely sure what the point of the figure it. perhaps more space could be dedicated the distinguishing the b and c plots and discussing why this motivates the work. 

there is a missing equation link in section 4 

there is a missing table link in appendix E  



----POST AUTHOR RESPONSE --------

1.) Efficiency of our Vote-Attack: 

It is clear that the vote attack is more time efficient than other attacks, but there is no clear motivation for this improvement. To my knowledge the attack creation time has never been a barrier to adversarial research, nor has it prevented real world adversarial attacks. As a result this focus of the paper simply confuses the reader, be spending time addressing an issue that is not important in research or practical settings.  

2.) Optimizing for activations of non-capsule components of a capsule network: 

In the authors response they discuss the semantic meaning of the votes of capsules. This too is a bit of a red herring. Although when discussing the motivation behind capsules, the potential for semantically meaningful capsule votes is invoked, there is nothing in the training procedure that ensures that the activations of the capsules correspond directly to features that humans would find semantically meaningful. In my original review i mentioned that by not attacking the output of the capsules after the routing procedure, this attack was simply optimizing for representations extracted from a standard neural network. In this way this work is similar to the representation attacks first presented by [1] which showed the success of representation attacks on standard neural networks.  

3.) The undetected attacks often resemble the target class, under the class-conditional capsule reconstructions detection:

Th addition of the attack visualizations is an improvement but the authors do not specify which attacks are successful and undetected and a few of the visualized attacks do indeed resemble the target class.   

4.) The additional defense mechanisms presented in Deflecting Adversarial Attacks:

The authors are right to point out the scope of the paper, and it is perhaps unreasonable to expect this paper to address these defence mechanisms, but their inclusion would greatly strengthen the paper. 

[1] Sara Sabour, Yanshuai Cao, Fartash Faghri, and David J Fleet. Adversarial manipulation of deep
representations. In ICLR, 2016.
review_title: A good paper with some areas of improvement.

final_score: rating: 6: Marginally above acceptance threshold
review_content: Authors argue that in order to attack Capsule network more effectively one should consider their inner workings, i.e. iterative routing. They propose two reasons behind the relative robustness of capsnets vs cnns: 1) gradient obfuscating 2) being more computationally intensive. Therefore, they propose a new attack which attacks a CapsNet running only 1 routing iteration. 
The attacks are shown to be more effective than targeting the 3-iteration capsnets directly. Which suggests the gradients for 1-iteration CapsNets are close enough to a 3-iteration version that the adversarial images fool a 3-iteration capsnet too. 

They also show that their attacks stay undetected by Qin et al method (class conditional reconstruction). However, the point of Qin et al was to some degree that although adversaries exist that Qin et al method will not detect, such adversaries have semantical resemblance to the target class and they are not undetected to human eye. i.e. the change is not scattered noise and is not imperceptible anymore. Therefore, to fully claim that their method fools Qin et al, a set of advarsarial images should be visualized to showcase they being imperceptible changes while going undetected.

Authors also provide a study on how attacking a capsule network changes the voting/routing mechanism. They find that attackers make the votes orthogonal to the target class parameters and therefore, remove votes from contributing. 
I was not able to see the connection of why this finding leads to their advarsarial attack. So maybe more clarification is required. 

But given gradient obfuscating as a reason for capsnet robustness their attack is intuitive (rather than attacking the 3 iterations attack a 1 iteration version). 

The study by itself is interesting and can lead to further robustness of CapsuleNetworks.

One caveat of the vote attack is that it seems it is most effective where there is only one Capsule layer. It seems that adding more and more capsule layers would make the model further robust to adversarial attacks. Hinton et al 2018 specifically had 3 capsule layers. An study with several capsule layers would enhance this papers argument and showcase its effectiveness better.

Pros: The paper is relatively well written. Authors explain their attack and motivate their research well. Also the experimental setup covers several attacks. There is novelty both in the idea and in the voting study.

Cons: Not covering multi capsule layer architectures, weak argument against Qin et al (not visualizing their detection aware advarsaries). Also, given that Michels et al 2019 has shown CapsNets are not robust to all attacks and already other attacks exist that CapsNets fail on, the relative interest domain of this paper is limited to researchers working on Capsule Networks.

--------------------------------------------------POST AUTHOR RESPONSE
1) Thank you for adding Fig. 3. My concern about the attacks being noticeable is resolved. 
3 & 4) The scope of this work is still limited to Specifically dynamic routing, which we already know are susceptible to black box attack (the community that already exists on architecture un-aware attacks) and some other attacks. As author's mention it is not trivial to apply their attack to other capsule architectures either. 
However, I find their various analysis informative. 
Therefore, I am increasing my score to 6.
review_title: An adversarial attack designed for Capsule Network

Meta-review: This paper studies the robustness of CapsNets under adversarial attacks. It is found that the votes from primary capsules in CapsNets are manipulated by adversarial examples and that the computationally expensive routing mechanism in CapsNets incurs high computational cost. As such, a new adversarial attack is specially designed by attacking the votes of CapsNets without having to involve the routing mechanism, making the method both effective and efficient.

**Strengths:**
  * This is the first work which proposes an attack specifically designed for CapsNets by exploiting their special properties.
  * The proposed vote attack is more effective and efficient than the other attacks originally proposed for CNNs rather than CapsNets.
  * The paper is generally well written.
  * The experimental study is quite comprehensive.
  * The code will be made available to facilitate reproducibility.

**Weaknesses:**
  * The study is mostly for only one type of CapsNets. It is not clear whether the observations in this paper still hold generally for other types of CapsNets even after some additional experiments have been added.
  * The presentation of the paper has room for improvement.

The authors are recommended to proofread the references thoroughly to ensure style consistency such as the consistent use of capitalization, e.g.
  * “Star-caps” -> “STAR-Caps”
  * “ieee symposium on security and privacy (sp)” -> “IEEE Symposium on Security and Privacy (SP)”

Despite its weaknesses especially those pointed out by Reviewer 2, this paper would be of interest to other researchers as it is the first paper that studies adversarial attacks on CapsNets.

Decision: Accept (Poster)