1/7 Our new paper on adversarial attack detection and capsule networks with @sabour_sara and Geoff Hinton is out on arxiv today! arxiv.org/abs/1811.06969 it will be presented at the #NeurIPS Workshop on Security. Don't have time to read the paper? Read this thread instead! :)
2/7 The problem with adversarial examples is that they dont look like what they are classified as. Capsule networks output both a classification and a reconstruction of the input conditioned on the classification. A reconstruction of an adversarial looks different from the input 
3/7 We can create a detection algorithm by defining a threshold for reconstruction error from a validation set, and flag inputs as adversarial if the reconstruction error exceeds this threshold.
4/7 This is an attack agnostic detection algorithm that works quite well for the three datasets we tested - MNIST, fashionMNIST and SVHN and the attacks we tested - black box and white box FGSM and BIM attacks
5/7 The reconstruction error is itself differentiable; we can make a stronger attack by minimize reconstruction error and maximize classification error. This attack can trick our detection, but the results aren't really ‘adversarial’ - they resemble members of the target class
6/7 This is true for MNIT and fashionMNIST
