# RobCaps: Evaluating the Robustness of Capsule Networks against Affine Transformations and Adversarial Attacks

arXiv: https://arxiv.org/abs/2304.03973 · HTML: https://mlsanity.com/paper/2304.03973/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 52 references that are in the map.
- First posted on arXiv 8 Apr 2023.

## Builds on (most cited first, 28 of 28)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Dynamic Routing Between Capsules](https://mlsanity.com/paper/1710.09829/) (2017)
- [TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems](https://mlsanity.com/paper/1603.04467/) (2016)
- [DeepCaps: Going Deeper with Capsule Networks](https://mlsanity.com/paper/1904.09546/) (2019)
- [Hardware and Software Optimizations for Accelerating Deep Neural Networks: Survey of Current Trends, Challenges, and the Road Ahead](https://mlsanity.com/paper/2012.11233/) (2020)
- [Investigating Capsule Networks with Dynamic Routing for Text Classification](https://mlsanity.com/paper/1804.00538/) (2018)
- [Improving the Robustness of Capsule Networks to Image Affine Transformations](https://mlsanity.com/paper/1911.07968/) (2019)
- [Attention routing between capsules](https://mlsanity.com/paper/1907.01750/) (2019)
- [Towards Energy-Efficient and Secure Edge AI: A Cross-Layer Framework](https://mlsanity.com/paper/2109.09829/) (2021)
- [NASCaps: A Framework for Neural Architecture Search to Optimize the Accuracy and Hardware Efficiency of Convolutional Capsule Networks](https://mlsanity.com/paper/2008.08476/) (2020)
- [On the Vulnerability of Capsule Networks to Adversarial Attacks](https://mlsanity.com/paper/1906.03612/) (2019)
- [Neural Network Encapsulation](https://mlsanity.com/paper/1808.03749/) (2018)
- [DARCCC: Detecting Adversaries by Reconstruction from Class Conditional Capsules](https://mlsanity.com/paper/1811.06969/) (2018)
- [CapsAttacks: Robust and Imperceptible Adversarial Attacks on Capsule Networks](https://mlsanity.com/paper/1901.09878/) (2019)
- [fakeWeather: Adversarial Attacks for Deep Neural Networks Emulating Weather Conditions on the Camera Lens of Autonomous Systems](https://mlsanity.com/paper/2205.13807/) (2022)
- [ReD-CaNe: A Systematic Methodology for Resilience Analysis and Design of Capsule Networks under Approximations](https://mlsanity.com/paper/1912.00700/) (2019)
- [Q-CapsNets: A Specialized Framework for Quantizing Capsule Networks](https://mlsanity.com/paper/2004.07116/) (2020)
- [Special Session: Towards an Agile Design Methodology for Efficient, Reliable, and Secure ML Systems](https://mlsanity.com/paper/2204.09514/) (2022)
- [Novel Deep Learning Model for Traffic Sign Detection Using Capsule Networks](https://mlsanity.com/paper/1805.04424/) (2018)
- [CapsAcc: An Efficient Hardware Accelerator for CapsuleNets with Data Reuse](https://mlsanity.com/paper/1811.08932/) (2018)
- [DESCNet: Developing Efficient Scratchpad Memories for Capsule Network Hardware](https://mlsanity.com/paper/2010.05754/) (2020)
- [RoHNAS: A Neural Architecture Search Framework with Conjoint Optimization for Adversarial Robustness and Hardware Efficiency of Convolutional and Capsule Networks](https://mlsanity.com/paper/2210.05276/) (2022)
- [Enabling Capsule Networks at the Edge through Approximate Softmax and Squash Operations](https://mlsanity.com/paper/2206.10200/) (2022)

## Built on by (most cited first, 1 of 1)

- [IGAff: Benchmarking Adversarial Iterative and Genetic Affine Algorithms on Deep Neural Networks](https://mlsanity.com/paper/2509.06459/) (2025)

## Abstract (arXiv)

Capsule Networks (CapsNets) are able to hierarchically preserve the pose relationships between multiple objects for image classification tasks. Other than achieving high accuracy, another relevant factor in deploying CapsNets in safety-critical applications is the robustness against input transformations and malicious adversarial attacks. In this paper, we systematically analyze and evaluate different factors affecting the robustness of CapsNets, compared to traditional Convolutional Neural Networks (CNNs). Towards a comprehensive comparison, we test two CapsNet models and two CNN models on the MNIST, GTSRB, and CIFAR10 datasets, as well as on the affine-transformed versions of such datasets. With a thorough analysis, we show which properties of these architectures better contribute to increasing the robustness and their limitations. Overall, CapsNets achieve better robustness against adversarial examples and affine transformations, compared to a traditional CNN with a similar number of parameters. Similar conclusions have been derived for deeper versions of CapsNets and CNNs. Moreover, our results unleash a key finding that the dynamic routing does not contribute much to improving the CapsNets' robustness. Indeed, the main generalization contribution is due to the hierarchical feature learning through capsules.