Black or white box attacks? about adv_attack_capsnet

[jsikyoon]

Hi @shenkev ,

Everyattack is white-box.

[jsikyoon]

if you don't have any other issues, then I will close this issue :)

[shenkev]

Nope, please close the issue. But have you tried black-box attacks as well? They hinted in their EM routing paper that capsules are not more robust to black-box than CNN's. This suggests that it's simply hard to create adv. examples using capsule but ones created using other architectures work just as well on capsules. Therefore capsules aren't actually robust.

[jsikyoon]

I will do black-box attacks generated with naiive model.

[shenkev]

Quick question, for

Adversarial Training with adversarial examples from FGSM and Basic iter.

What was the training procedure? How many adversarial examples did the model get to train on? How many regular images did it train on?

[jsikyoon]

training procedure is same to naiive model, and the the number of adv. examples used on training is same to the number of training dataset.