# An Evasion Attack against Stacked Capsule Autoencoder
## 4 Proposed Evasion Attack
### Computing the Perturbation
#### 4.2.3 Computing the Perturbation with Optimizer  
In this algorithm, an optimizer is used to minimize the value of Formula (2). To misclassify a perturbed image \(x+p\), that is, \(C(E(x+p))\
eq C(E(x))\), we can lower the output of the object capsule subset \(S\) by decreasing the value of \(f(x+p)\) to reduce their contribution to the original classification. Therefore, the optimization problem in Formula (1) can be transformed into the one in Formula (6):  
\[\begin{array}{rl}\text{Minimize}&\left\|p\right\|_{2}+\alpha\cdot f(x+p)\\ \text{\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \  
variable \(p^{\prime}\) according to the \"change of variables\" method given by [PERSON] et al. [25] and optimize over it instead. The relationship between the two variables is as follows:  
\[ \begin{array}{l}w=\operatorname{arctanh}(2x-1)\\ p=\frac{1}{2}(\tanh(w+p^{\prime})+1)-x\end{array}  \tag{7}\]  
As \(x\in[0,1]^{n}\), \(w\in(-\infty,+\infty)^{n}\). During the experiments, we use \(\operatorname{arctanh}((2x-1)*\epsilon)\) to avoid dividing by zero. For \(p^{\prime}\in(-\infty,+\infty)^{n}\), \(\tanh(w+p^{\prime})\in(-1,1)^{n}\), which leads to \(x+p\in(0,1)^{n}\). The core idea of this method is that the original image \(x\) is first transformed into the \(\operatorname{arctanh}\) space and then mapped back into \([0,1]^{n}\). Therefore, the calculated image \(x+p\) is always valid. The full algorithm for computing perturbation consists of the inner iteration and the outer iteration. In the inner iteration, we use an optimizer to iteratively conduct the process of Formula (6). The hyperparameter \(\alpha\) is fixed from beginning to end during the computation. When an inner iteration is finished, we select the perturbation \(p\) with the smallest \(\left\lVert p\right\rVert_{2}\) from those satisfying \(C(E(x+p))\
eq C(E(x))\) as the best inner result. In the outer iteration, we initialize the optimizer, execute a complete inner iteration, and finally update the hyperparameter \(\alpha\) to find the most suitable value of \(\alpha\) so that the optimizer can obtain perturbation \(p\) with a smaller \(L_{2}\) norm. We perform multiple rounds of outer iterations, and finally select the perturbation \(p\) with the smallest \(\left\lVert p\right\rVert_{2}\) among all best inner results as the global optimal result. The whole procedure is shown in Algorithm 3:  
```
1:Input: Image \(x\), SCAE model \(E\), classifier \(C\), optimizer \(opt\), hyperparameter \(\alpha\), the number of outer iterations \(n_{\alpha,iter}\), the number of inner iterations \(n_{i,iter}\). 2:Output: Perturbation \(p\). 3:
4: Initialize \(p\gets 0\), \(\mathcal{L}_{p}\leftarrow+\infty\), \(\alpha\). 5:\(S\leftarrow\left\{i\middle|E(x)_{j}>\frac{1}{k}\sum_{i=1}^{k}E(x)_{j}\right\}\)
6:\(w\leftarrow\operatorname{arctanh}(2x-1)\)
7:for\(i\) in \(n_{\alpha,iter}\)do
8:Init \(opt\). 9:\(p^{\prime}_{i}\leftarrow\operatorname{rand}(0,1)\)
10:for\(j\) in \(n_{i,iter}\)do
11:\(x^{adv}_{j}\leftarrow\frac{1}{2}\left(\tanh\left(w+p^{\prime}_{j}\right)+1\right)\)
12:\(\mathcal{L}\leftarrow\left\lVert x^{adv}_{j}-x\right\rVert_{2}+\alpha\cdot \sum_{i\in S}E\left(x^{adv}_{j}\right)_{i}\)
13:\(\prime\) The optimizer computes next \(p^{\prime}_{j}\)\(\prime\)
14:\(p^{\prime}_{i+1}\gets opt\left(p^{\prime}_{j}\middle|\mathcal{L}\right)\)
15:\(x^{adv}_{j}\leftarrow\frac{1}{2}\left(\tanh\left(w+p^{\prime}_{j+1}\right)+1\right)\)
16:\(\prime\)/* Judge if the current result is the best one \(\gamma\)
17:if\(C\left(E\left(x^{adv}_{j+1}\right)\right)\
eq C(E(x))\)and\(\left\lVert x^{adv}_{j+1}-x\right\rVert_{2}<\mathcal{L}_{p}\)do
18:\(\mathcal{L}_{p}\leftarrow\left\lVert x^{adv}_{j+1}-x\right\rVert_{2}\)
19:\(p\leftarrow\lambda^{adv}_{j+1}-x\)
20:endif
21:endfor
22: Update \(\alpha\). 23:endfor
24:return\(p\)
```  
**Algorithm 3**Generating the perturbation with optimizer. The update algorithm of the hyperparameter \(\alpha\) is as follows: we use a binary search to find the optimal value for \(\alpha\).