  The origin of adversarial examples is still inexplicable in research fields,
and it arouses arguments from various viewpoints, albeit comprehensive
investigations. In this paper, we propose a way of delving into the unexpected
vulnerability in adversarially trained networks from a causal perspective,
namely adversarial instrumental variable (IV) regression. By deploying it, we
estimate the causal relation of adversarial prediction under an unbiased
environment dissociated from unknown confounders. Our approach aims to
demystify inherent causal features on adversarial examples by leveraging a
zero-sum optimization game between a casual feature estimator (i.e., hypothesis
model) and worst-case counterfactuals (i.e., test function) disturbing to find
causal features. Through extensive analyses, we demonstrate that the estimated
causal features are highly related to the correct prediction for adversarial
robustness, and the counterfactuals exhibit extreme features significantly
deviating from the correct prediction. In addition, we present how to
effectively inoculate CAusal FEatures (CAFE) into defense networks for
improving adversarial robustness.
