{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T02:45:27Z","timestamp":1760150727899,"version":"build-2065373602"},"reference-count":34,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2022,1,19]],"date-time":"2022-01-19T00:00:00Z","timestamp":1642550400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100004543","name":"China Scholarship Council","doi-asserted-by":"publisher","award":["201606895018"],"award-info":[{"award-number":["201606895018"]}],"id":[{"id":"10.13039\/501100004543","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Algorithms"],"abstract":"<jats:p>Capsule networks are a type of neural network that use the spatial relationship between features to classify images. By capturing the poses and relative positions between features, this network is better able to recognize affine transformation and surpass traditional convolutional neural networks (CNNs) when handling translation, rotation, and scaling. The stacked capsule autoencoder (SCAE) is a state-of-the-art capsule network that encodes an image in capsules which each contain poses of features and their correlations. The encoded contents are then input into the downstream classifier to predict the image categories. Existing research has mainly focused on the security of capsule networks with dynamic routing or expectation maximization (EM) routing, while little attention has been given to the security and robustness of SCAEs. In this paper, we propose an evasion attack against SCAEs. After a perturbation is generated based on the output of the object capsules in the model, it is added to an image to reduce the contribution of the object capsules related to the original category of the image so that the perturbed image will be misclassified. We evaluate the attack using an image classification experiment on the Mixed National Institute of Standards and Technology Database (MNIST), Fashion-MNIST, and German Traffic Sign Recognition Benchmark (GTSRB) datasets, and the average attack success rate can reach 98.6%. The experimental results indicate that the attack can achieve high success rates and stealthiness. This finding confirms that the SCAE has a security vulnerability that allows for the generation of adversarial samples. Our work seeks to highlight the threat of this attack and focus attention on SCAE\u2019s security.<\/jats:p>","DOI":"10.3390\/a15020032","type":"journal-article","created":{"date-parts":[[2022,1,19]],"date-time":"2022-01-19T08:20:57Z","timestamp":1642580457000},"page":"32","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["An Evasion Attack against Stacked Capsule Autoencoder"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1883-0171","authenticated-orcid":false,"given":"Jiazhu","family":"Dai","sequence":"first","affiliation":[{"name":"School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Siwei","family":"Xiong","sequence":"additional","affiliation":[{"name":"School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,1,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1002\/nav.3800020109","article-title":"The hungarian method for the assignment problem","volume":"2","author":"Kuhn","year":"1955","journal-title":"Nav. Res. Logist. Q."},{"key":"ref_2","unstructured":"Yoon, J. (2021, March 11). Adversarial Attack to Capsule Networks. Available online: https:\/\/github.com\/jaesik817\/adv_attack_capsnet."},{"key":"ref_3","unstructured":"Michels, F., Uelwer, T., Upschulte, E., and Harmeling, S. (2019). On the vulnerability of capsule networks to adversarial attacks. arXiv."},{"key":"ref_4","unstructured":"Marchisio, A., Nanfa, G., Khalid, F., Hanif, M.A., Martina, M., and Shafique, M. (2019). CapsAttacks: Robust and imperceptible adversarial attacks on capsule networks. arXiv."},{"key":"ref_5","unstructured":"De Marco, A. (2020). Capsule Networks Robustness against Adversarial Attacks and Affine Transformations. [Ph.D. Thesis, Politecnico di Torino]."},{"key":"ref_6","unstructured":"Guyon, I., Luxburg, U., von Bengio, S., Wallach, H.M., Fergus, R., Vishwanathan, S.V.N., and Garnett, R. (2017, January 4\u20139). Dynamic routing between capsules. Proceedings of the Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA. Available online: https:\/\/arxiv.org\/abs\/1710.09829."},{"key":"ref_7","unstructured":"Hinton, G.E., Sabour, S., and Frosst, N. (May, January 30). Matrix capsules with EM routing. Proceedings of the 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada. Conference Track Proceedings."},{"key":"ref_8","unstructured":"Wallach, H.M., Larochelle, H., Beygelzimer, A., d\u2019Alch\u00e9-Buc, F., Fox, E.B., and Garnett, R. (2019, January 8\u201314). Stacked capsule autoencoders. Proceedings of the Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, Vancouver, BC, Canada. Available online: https:\/\/arxiv.org\/abs\/1906.06818."},{"key":"ref_9","first-page":"3744","article-title":"Set Transformer: A Framework for Attention-Based Permutation-Invariant Neural Networks","volume":"Volume 97","author":"Chaudhuri","year":"2019","journal-title":"Proceedings of the Proceedings of the 36th International Conference on Machine Learning, ICML 2019"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","article-title":"Threat of adversarial attacks on deep learning in computer vision: A survey","volume":"6","author":"Akhtar","year":"2018","journal-title":"IEEE Access"},{"key":"ref_11","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., and Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv."},{"key":"ref_12","unstructured":"Roussev, V., Thuraisingham, B.M., Carminati, B., and Kantarcioglu, M. (2020, January 16\u201318). Backdoor embedding in convolutional neural network models via invisible perturbation. Proceedings of the CODASPY \u201920: Tenth ACM Conference on Data and Application Security and Privacy, New Orleans, LA, USA."},{"key":"ref_13","unstructured":"Bengio, S., Wallach, H.M., Larochelle, H., Grauman, K., Cesa-Bianchi, N., and Garnett, R. (2018, January 3\u20138). Poison frogs! targeted clean-label poisoning attacks on neural networks. Proceedings of the Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, Montr\u00e9al, QC, Canada. Available online: https:\/\/arxiv.org\/abs\/1804.00792."},{"key":"ref_14","unstructured":"Saha, A., Subramanya, A., and Pirsiavash, H. (2020, January 7\u201312). Hidden trigger backdoor attacks. Proceedings of the Thirty-Fourth AAAI Conference on Artificial Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium on Educational Advances in Artificial Intelligence, EAAI 2020, New York, NY, USA."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"138872","DOI":"10.1109\/ACCESS.2019.2941376","article-title":"A backdoor attack against LSTM-based text classification systems","volume":"7","author":"Dai","year":"2019","journal-title":"IEEE Access"},{"key":"ref_16","unstructured":"Cavallaro, L., Kinder, J., Wang, X., and Katz, J. (2019, January 11\u201315). Latent backdoor attacks on deep neural networks. Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS 2019, London, UK. Available online: https:\/\/dl.acm.org\/doi\/abs\/10.1145\/3319535.3354209."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"41498","DOI":"10.1109\/ACCESS.2019.2905915","article-title":"TensorClog: An imperceptible poisoning attack on deep neural network applications","volume":"7","author":"Shen","year":"2019","journal-title":"IEEE Access"},{"key":"ref_18","first-page":"7614","article-title":"Transferable clean-label poisoning attacks on deep neural nets","volume":"Volume 97","author":"Chaudhuri","year":"2019","journal-title":"Proceedings of the 36th International Conference on Machine Learning, ICML 2019"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., and Zhang, X. (2018, January 18\u201321). Trojaning attack on neural networks. Proceedings of the 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, CA, USA.","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Kwon, H., Yoon, H., and Park, K.-W. (2019). Selective poisoning attack on deep neural networks. Symmetry, 11.","DOI":"10.3390\/sym11070892"},{"key":"ref_21","unstructured":"Bengio, Y., and LeCun, Y. (2014, January 14\u201316). Intriguing properties of neural networks. Proceedings of the 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada. Available online: https:\/\/arxiv.org\/abs\/1312.6199."},{"key":"ref_22","unstructured":"Bengio, Y., and LeCun, Y. (2015, January 7\u20139). Explaining and harnessing adversarial examples. Proceedings of the 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA. Available online: https:\/\/arxiv.org\/abs\/1412.6572."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P. (2016, January 27\u201330). DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks. Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.-M., Fawzi, A., Fawzi, O., and Frossard, P. (2017, January 21\u201326). Universal adversarial perturbations. Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA.","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D.A. (2017, January 22\u201326). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_26","unstructured":"Kurakin, A., Goodfellow, I.J., and Bengio, S. (2017, January 24\u201326). Adversarial Examples in the Physical World. Proceedings of the 5th International Conference on Learning Representations, ICLR 2017, Toulon, France. Workshop Track Proceedings."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","article-title":"One pixel attack for fooling deep neural networks","volume":"23","author":"Su","year":"2019","journal-title":"IEEE Trans. Evol. Comput."},{"key":"ref_28","unstructured":"Sarkar, S., Bansal, A., Mahbub, U., and Chellappa, R. (2017). UPSET and ANGRI: Breaking high performance image classifiers. arXiv."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Baluja, S., and Fischer, I. (2017). Adversarial transformation networks: Learning to generate adversarial examples. arXiv.","DOI":"10.1609\/aaai.v32i1.11672"},{"key":"ref_30","unstructured":"Ciss\u00e9, M., Adi, Y., Neverova, N., and Keshet, J. (2017). Houdini: Fooling deep structured prediction models. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"146","DOI":"10.1016\/j.patrec.2020.04.025","article-title":"Steganographic universal adversarial perturbations","volume":"135","author":"Din","year":"2020","journal-title":"Pattern Recognit. Lett."},{"key":"ref_32","unstructured":"Brendel, W., Rauber, J., and Bethge, M. (May, January 30). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. Proceedings of the 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada. Conference Track Proceedings."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P.D., Jha, S., Fredrikson, M., Celik, Z.B., and Swami, A. (2016, January 21\u201324). The limitations of deep learning in adversarial settings. Proceedings of the IEEE European Symposium on Security and Privacy, EuroS&P 2016, Saarbr\u00fccken, Germany.","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref_34","unstructured":"Kosiorek, A. (2020, September 24). Stacked Capsule Autoencoders. Available online: https:\/\/github.com\/akosiorek\/stacked_capsule_autoencoders."}],"container-title":["Algorithms"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-4893\/15\/2\/32\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:04:06Z","timestamp":1760133846000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-4893\/15\/2\/32"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,19]]},"references-count":34,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,2]]}},"alternative-id":["a15020032"],"URL":"https:\/\/doi.org\/10.3390\/a15020032","relation":{},"ISSN":["1999-4893"],"issn-type":[{"type":"electronic","value":"1999-4893"}],"subject":[],"published":{"date-parts":[[2022,1,19]]}}}