Capsule Networks (CapsNets) are able to hierarchically preserve the pose relationships between multiple objects for image classification tasks. Other than achieving high accuracy, another relevant factor in deploying CapsNets in safety-critical applications is the robustness against input transformations and malicious adversarial attacks. In this paper, we systematically analyze and evaluate different factors affecting the robustness of CapsNets, compared to traditional Convolutional Neural Networks (CNNs). Towards a comprehensive comparison, we test two CapsNet models and two CNN models on the MNIST, GTSRB, and CIFAR10 datasets, as well as on the affine-transformed versions of such datasets. With a thorough analysis, we show which properties of these architectures better contribute to increasing the robustness and their limitations. Overall, CapsNets achieve better robustness against adversarial examples and affine transformations, compared to a traditional CNN with a similar number of parameters. Similar conclusions have been derived for deeper versions of CapsNets and CNNs. Moreover, our results unleash a key finding that the dynamic routing does not contribute much to improving the CapsNets' robustness. Indeed, the main generalization contribution is due to the hierarchical feature learning through capsules.

翻译：胶囊网络（CapsNets）能够层次化地保持图像分类任务中多个对象间的姿态关系。除高准确率外，在安全关键应用中部署CapsNets的另一重要因素是其对输入变换和恶意对抗攻击的鲁棒性。本文系统分析并评估了影响CapsNets鲁棒性的不同因素，并与传统卷积神经网络（CNNs）进行对比。为进行全面比较，我们在MNIST、GTSRB和CIFAR10数据集及其仿射变换版本上测试了两种CapsNet模型和两种CNN模型。通过深入分析，我们揭示了这些架构中哪些特性更有助于提升鲁棒性及其局限性。总体而言，与参数数量相近的传统CNN相比，CapsNets在对抗样本和仿射变换方面展现出更优的鲁棒性。对于更深层的CapsNets和CNNs也得出了相似结论。此外，我们的结果揭示了一个关键发现：动态路由对提升CapsNets鲁棒性的贡献不大。事实上，主要的泛化提升源于通过胶囊进行的层次化特征学习。