# An Evasion Attack against Stacked Capsule Autoencoder
## 4 Proposed Evasion Attack
### Computing the Perturbation
#### 4.2.2. Computing the Perturbation with Pixel Saliency to Capsules  
In this algorithm, we iteratively choose a pair of pixels that contributes most to the value of Formula (2). The amount of contribution of a pixel pair \((u,v)\) is named pixel saliency, which is defined as follows:  
\[\begin{split}\delta_{1}&=\sum\limits_{i=u,v}\left( \
abla_{x_{i}}\sum\limits_{j\in S}E(x)_{j}\right)\\ \delta_{2}&=\sum\limits_{i=u,v}\left(\
abla_{x_{i}} \sum\limits_{j\in S}E(x)_{j}\right)\end{split} \tag{4}\]  
where \(\delta_{1}\) represents the influence on the sum of the output of the object capsule subset \(S\) when the pixel pair \((u,v)\) changes, and \(\delta_{2}\) represents the influence on the sum of the output of the object capsules not belonging to \(S\). The pixels for modification are picked according to the following rule:  
\[(u^{*},v^{*})=\underset{(u,v)}{\text{argmax}}(-\delta_{1}\times\delta_{2} \times(\delta_{1}>0)\times(\delta_{2}<0)) \tag{5}\]  
where \(\delta_{1}>0\) means the sum of the output of the capsules in subset \(S\) increases with the values of the pixels, and \(\delta_{2}<0\) means the sum of the output of the other capsules decreases when the values of the pixels increase. Therefore, by reducing the value of the pixels, we can decrease the sum of the output of the capsules in subset \(S\).  
Before the iteration, a pixel search domain \(\Gamma\) is initialized including all pixels whose values are above 0, which are available for modification. We use an iterative algorithm to compute the adversarial sample. In each iteration, we obtain the pair of pixels with the largest pixel saliency from \(\Gamma\), and reduce the values of the two pixels by \(\alpha\), which isa positive hyperparameter that represents the step of change. During the iteration, the modification of \(\Gamma\) follows this principle: if the value of a pixel reaches 0 after being chosen and decreased, then this pixel will be removed from \(\Gamma\) since 0 is the minimum value of a pixel and further subtraction is meaningless. All pixels not in \(\Gamma\) are excluded from the algorithm.  
The algorithm halts as soon as the current perturbation causes misclassification to avoid affecting more pixels. On the other hand, the algorithm will also stop when \(\Gamma\) is empty, which means that the attack fails. The whole procedure is shown in Algorithm 2:  
```
1:Input: Image \(x\), SCAE model \(E\), classifier C, hyperparameter \(\alpha\), the number of iterations \(n_{iter}\).
2:Output: Perturbation \(p\).
3:
4:/* Initial future search domain */
5: Initialize \(x^{\alpha\mu}\leftarrow\)\(x\), \(\Gamma\leftarrow\{i|x_{i}>0\}\).
6:\(S\leftarrow\left\{i\big{|}E(x_{i})>\frac{1}{k}\sum_{j=1}^{k}E(x)_{j}\right\}\)
7:for\(i\) in \(n_{iter}\)do
8:if\(C\big{(}E(x^{\alpha\mu})\big{)}\
eq C(E(x))\) or \(\Gamma\) is empty do
9: break
10:endif
11:/* Choose the two pixels for modification */
12:\(m\gets 0\)
13:for each pair \((u,v)\) in \(\Gamma\)do
14:\(\delta_{1}=\sum_{i=u,v}\left(\
abla_{x^{\alpha\mu}}\sum_{j\in S}E(x^{\alpha \mu})_{j}\right)\)
15:\(\delta_{2}=\sum_{i=u,v}\left(\
abla_{x^{\alpha\mu}}\sum_{j\in S}E(x^{\alpha \mu})_{j}\right)\)
16:if\(-\delta_{1}\times\delta_{2}\times(\delta_{1}>0)\times(\delta_{2}<0)>m\)do
17:\(u^{*},v^{*}\gets u,v\)
18:\(m\leftarrow-\delta_{1}\times\delta_{2}\)
19:endif
20:endfor
21:/* Decreine the values of the two pixels */
22:\(x^{\alpha\mu}_{u^{*}}\leftarrow\max\{x^{\alpha\mu}_{u^{*}}-\alpha,0\}\)
23:\(x^{\alpha\mu}_{u^{*}}\leftarrow\max\{x^{\alpha\mu}_{u^{*}}-\alpha,0\}\)
24:if\(x^{\alpha\mu}_{u^{*}}=0\)do
25: Remove \(u^{*}\) from \(\Gamma\).
26:endif
27:if\(x^{\alpha\mu}_{u^{*}}=0\)do
28: Remove \(v^{*}\) from \(\Gamma\).
29:endif
30:endfor
31:\(p\gets x^{\alpha\mu}-x\)
32:return\(p\)
```  
**Algorithm 2**Generating the perturbation with pixel saliency to capsules.