Using Capsule Networks with Thermometer Encoding to Defend Against Adversarial Attacks

Adversarial attacks have been shown to construct examples that drastically reduce the performance of classification models. One recently proposed defense against adversarial attacks is to discretize the input in a method called thermometer encoding. We apply thermometer encoding to capsule networks, a recently proposed computer vision architecture that has also demonstrated state-ofthe-art resistance to adversarial attacks. The capsule network with thermometer encoding outperforms our baseline CNN and vanilla capsule network when trained adversarially, and performs comparably to a CNN with thermometer encoding. The gains by applying thermometer encoding to capsule networks may improve adversarial resistance on more complex tasks where capsule networks have already demonstrated state-of-theart resistance.