# DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules

arXiv: https://arxiv.org/abs/1811.06969 · HTML: https://mlsanity.com/paper/1811.06969/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Nov 2018.

## Built on by (most cited first, 9 of 9)

- [Predify: Augmenting deep neural networks with brain-inspired predictive coding dynamics](https://mlsanity.com/paper/2106.02749/) (2021)
- [Persistent Classification: A New Approach to Stability of Data and Adversarial Examples](https://mlsanity.com/paper/2404.08069/) (2024)
- [Scanflow: A multi-graph framework for Machine Learning workflow management, supervision, and debugging](https://mlsanity.com/paper/2111.03003/) (2021)
- [Security Analysis of Capsule Network Inference using Horizontal Collaboration](https://mlsanity.com/paper/2109.11041/) (2021)
- [RobCaps: Evaluating the Robustness of Capsule Networks against Affine Transformations and Adversarial Attacks](https://mlsanity.com/paper/2304.03973/) (2023)
- [Back to Square One: Superhuman Performance in Chutes and Ladders Through Deep Neural Networks and Tree Search](https://mlsanity.com/paper/2104.00698/) (2021)
- [Towards Robust Stacked Capsule Autoencoder with Hybrid Adversarial Training](https://mlsanity.com/paper/2202.13755/) (2022)
- [Human-in-the-loop online multi-agent approach to increase trustworthiness in ML models through trust scores and data augmentation](https://mlsanity.com/paper/2204.14255/) (2022)
- [On Neural Network approximation of ideal adversarial attack and convergence of adversarial training](https://mlsanity.com/paper/2307.16099/) (2023)

## Abstract (arXiv)

We present a simple technique that allows capsule models to detect adversarial images. In addition to being trained to classify images, the capsule model is trained to reconstruct the images from the pose parameters and identity of the correct top-level capsule. Adversarial images do not look like a typical member of the predicted class and they have much larger reconstruction errors when the reconstruction is produced from the top-level capsule for that class. We show that setting a threshold on the l2 distance between the input image and its reconstruction from the winning capsule is very effective at detecting adversarial images for three different datasets. The same technique works quite well for CNNs that have been trained to reconstruct the image from all or part of the last hidden layer before the softmax. We then explore a stronger, white-box attack that takes the reconstruction error into account. This attack is able to fool our detection technique but in order to make the model change its prediction to another class, the attack must typically make the "adversarial" image resemble images of the other class.