Causal Neural Network models have shown high levels of robustness to adversarial attacks as well as an increased capacity for generalisation tasks such as few-shot learning and rare-context classification compared to traditional Neural Networks. This robustness is argued to stem from the disentanglement of causal and confounder input signals. However, no quantitative study has yet measured the level of disentanglement achieved by these types of causal models or assessed how this relates to their adversarial robustness. Existing causal disentanglement metrics are not applicable to deterministic models trained on real-world datasets. We, therefore, utilise metrics of content/style disentanglement from the field of Computer Vision to measure different aspects of the causal disentanglement for four state-of-the-art causal Neural Network models. By re-implementing these models with a common ResNet18 architecture we are able to fairly measure their adversarial robustness on three standard image classification benchmarking datasets under seven common white-box attacks. We find a strong association (r=0.820, p=0.001) between the degree to which models decorrelate causal and confounder signals and their adversarial robustness. Additionally, we find a moderate negative association between the pixel-level information content of the confounder signal and adversarial robustness (r=-0.597, p=0.040).

翻译：因果神经网络模型相比传统神经网络，在对对抗攻击的鲁棒性以及泛化任务（如小样本学习和稀有上下文分类）的能力上均表现出更高水平。这种鲁棒性被认为源于因果信号与混杂输入信号的解缠。然而，目前尚无量化研究测量这类因果模型所达到的解缠程度，亦未评估其与对抗鲁棒性之间的关联。现有的因果解缠指标不适用于在真实数据集上训练的确定性模型。因此，我们借鉴计算机视觉领域的内容/风格解缠度量标准，针对四种前沿因果神经网络模型，测量其因果解缠的不同维度。通过使用统一的ResNet18架构重新实现这些模型，我们能够在三个标准图像分类基准数据集上，在七种常见白盒攻击下公平地评估其对抗鲁棒性。研究发现，模型解缠因果信号与混杂信号的程度与其对抗鲁棒性之间存在强关联（r=0.820, p=0.001）。此外，混杂信号的像素级信息含量与对抗鲁棒性之间存在中等程度的负关联（r=-0.597, p=0.040）。