>Finally, not all SOTA methods are susceptible to adversarial attacks, eg capsule networks.

They appear to be susceptible: https://arxiv.org/pdf/1906.03612.pdf

That’s neat; hadn’t seen that paper. Thanks for sharing.