Venue: ICLR 2020 Conference

Reviews:

final_score: rating: 6: Weak Accept
review_content: This paper studies the problem of detecting and generating adversarial images using class-conditional capsule networks. Specifically, this paper first introduced a novel method that detects adversarial examples by class-conditional image reconstruction. Motivated by this defense method, this paper further proposed a novel reconstructive attack that minimizes both classification and reconstruction loss. Experimental evaluations are conducted on MNIST, FashionMNIST, SVHN, and CIFAR-10 dataset. Results demonstrate the effectiveness of the proposed defense and the novel reconstructive attack method.

Overall, this paper is well-motivated and presentation is clear. It proposed a smart way of using the class-conditional generative model to improve the adversarial robustness. Please address the following questions.

(1) Reviewer’s major concern is that this method is not very scalable to large-scale real-world datasets such as ImageNet and SUN database. First, training a class-conditional generative model on MNIST is relatively easy compared to ImageNet. The generative model could potentially create image artifacts on higher resolution images. 

-- SUN Database: Large-scale Scene Recognition from Abbey to Zoo. Xiao et al. In CVPR 2010.

Second, the proposed proxy based on l_2 image distance might not be effective at all for higher-resolution images.

-- A note on the evaluation of generative models, Theis et al. In ICLR 2016.
-- The Unreasonable Effectiveness of Deep Features as a Perceptual Metric, Zhang et al. In CVPR 2018.

(2) Reviewer is not fully convinced by the argument that features learned by CapsNets are superior to features learned by CNN baselines. To draw such conclusion, it is necessary to conduct systematic experiments with different CapsNets and CNNs architectures (e.g., number of layers) and other hyper-parameters related to the adversarial optimization.

(3) It looks like the proposed method is not specific to generative models use class labels as condition. reviewer is curious whether the method generalizes to other conditions (e.g., image-to-image translation) as well.

-- Learning Structured Output Representation using Deep Conditional Generative Models, Sohn et al. In NIPS 2015.
-- Image-to-Image Translation with Conditional Adversarial Nets, Isola et al. In CVPR 2017.
-- Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks, Zhu et al. In ICCV 2017.
-- Semantic Image Synthesis with Spatially-Adaptive Normalization, Park et al. In CVPR 2019.

(4) Can you possibly comment on the attack transferability compared to other existing attacks evaluated in this paper?

(5) Detection threshold: Can you possibly draw the AOC curve or report the Area Under Curve (AOC) score?

review_title: Official Blind Review #1

final_score: rating: 8: Accept
review_content: This work proposes to detect adversarial examples or otherwise corrupted images with the reconstruction network, which is used to regularise CapsNets. To further confirm the effectiveness of their detection method, they propose the Reconstructive Attack, which seeks both to cause a misclassification and a low reconstruction error. The comprehensive experiments are conducted.

Although the idea is not very novel, the paper makes enough contributions to get accepted. Especially, Section 6 diagnoses the adversarial examples for CapsNets and shows the relationship between the success of the attack and the visual similarity between the source and target class.

We have the following question for authors about this work:

1. Baseline models: This work creates the baseline model CNN+CR, by dividing the penultimate hidden layer of a CNN into groups corresponding to each class. The sum of each neuron group serves as the logit for that particular class. Why is the sum operation used to create the logit? The sum operation is pretty rare the existing CNN architectures. A linear combination may be a better choice?

2. Detection Threshold: this paper empirically chooses the 95th percentile of validation distances as the threshold to detect adversary samples. Why not report the Area Under Curve (AOC) score? It is a more comprehensive evaluation metric for such a problem.

3. Class-conditional information: This paper follows the architecture in Sabour et al. (2017) where the reconstruction is class-conditional. The work DeepCaps [1] shows that the reconstruction without class-conditional information leads to the better disentanglement of instantiation parameters. Is the class-conditional information necessary to achieve the robustness to adversary attacks?
[1] Rajasegaran, Jathushan, et al. "DeepCaps: Going Deeper with Capsule Networks." Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2019.
review_title: Official Blind Review #2

final_score: rating: 6: Weak Accept
review_content: This paper proposed a new defense method for capsule networks. For both white-box and black-box settings, the proposed CapNets has shown superior performance than two variants of CNNs. The visualizations of adversarial examples generated by the CapNets are more aligned with the human perception which is very insightful. On the corrupted MNIST dataset, the results show the proposed defense method can also be used well as an out-of-distribution detector. Overall the paper is clearly written and easy to follow.



Here I have some concerns:

The major one is the limited comparisons. For the defense of CNNs, the author only implemented two types of the strategy, which is derived from the characteristics of the capsule network. However, there are also other a lot of defense methods for CNNs which are designed according to the characteristics of themselves. I think the author should also compare the defense performance with those methods to hold the strong claims that CpasNets always perform better than convolutional networks. Also, the experiments performed on Cifar-10 is very limited.



The adversarial examples generated by the CapsNets shown in Figure 3 and Figure 11 are indeed changing the number shape which is aligned with human perception. However, some studies for CNNs has also found similar results on MNIST(Towards Deep Learning Models Resistant to Adversarial Attacks) and CIFAR-10(RANDOM MASK: Towards Robust Convolutional Neural Networks). The author should provide more visualizations on other datasets such as CIFAR-10 to support the contribution that the features captured by CapsNets are more aligned with human perception than CNNs.

=========================================================
After Rebuttal:

I thank the author for the response. 

I still think the argument that CpasNets always perform better than convolutional networks is an overstatement since you only performed a few defense methods. A milder one is more suitable.

Also, the high variance of the Capsule Network in Figure 10 can tell something but it is not enough. Could you find similar visible semantic changes in CIFAR-10 dataset as Figure 5?  If yes, you should also list some results. The mentioned CNN works could find similar phenomena on both MNIST and CIFAR-10 dataset. I do not see the strong evidence for the argument that features captured by CapsNets are more aligned with human perception than CNNs.

To sum up, I think some arguments are overstatements. But this is a good work to analyze the robustness of Capsule Net, I would like to rate 6.
review_title: Official Blind Review #3

Meta-review: This paper presents a mechanism for capsule networks to defend against adversarial examples, and a new attack, the reconstruction attack. The differing success of this attacks on capsnets and convnets is used to argue that capsnets find features that are more similar to what humans use.

Reviewers generally like the paper, but took instance with the strength of the claim (about the usefulness of the examples) and argued that the paper might not be as novel as it claims.

Still, this seems like a valuable contribution that should be published.
Decision: Accept (Poster)