dstack-capsule: Capsules in Cloud, NLP, and Vision

• dstack-capsule is a unified term for three capsule-inspired systems: secure Kubernetes pod attestation, dual-state text classification (DS-Caps), and viewpoint-invariant image modeling (SCAE).
• Each system employs a layered architecture to bind fine-grained identities—using hardware-rooted proofs, dual-state LSTMs, or geometric transforms—ensuring robust, verifiable features.
• Rigorous evaluations show improvements in startup latency, long-text accuracy, and unsupervised image clustering, highlighting practical benefits and future scalability potential.

dstack-capsule refers to three distinct domains: (1) dstack-capsule in confidential Kubernetes workloads as a Pod-level attestation and isolation framework (Yang et al., 2 Jun 2026), (2) Dual-State Capsule Networks (DS-Caps) for text classification (Demotte et al., 2021), and (3) the Stacked Capsule Autoencoder (SCAE) for viewpoint-invariant unsupervised part–whole modeling in images (Kosiorek et al., 2019). Each instantiation embodies key capsule-like principles: compositional identity binding or feature routing across granular levels—Pods, words/sentences, or image parts/objects, respectively. These systems are unified by their layered architectures, fine-grained entity identity, and explicit handling of hierarchical or sequential structure.

1. Pod-Level Attestation with dstack-capsule (Yang et al., 2 Jun 2026)

dstack-capsule is a Kubernetes platform designed for cryptographic Pod-level remote attestation in confidential cloud workloads, leveraging Intel TDX. Unlike prior "one Pod per VM" models such as Confidential Containers (CoCo), dstack-capsule allows multiple Pods to share a single Confidential VM (CVM), while each Pod receives an independent, hardware-signed proof of identity. Its main contribution is a two-layer attestation architecture:

• Layer 1: Platform Trust—Static measurements (firmware, UKI, kernel, dstack-agent config including Ed25519 public key) are recorded in TDX's RTMR[0–3]. At cluster setup, a privilege fuse irreversibly freezes RTMR[3], ensuring a tamper-evident platform baseline.
• Layer 2: Pod Identity—Dynamic identifiers (pod_uid, pod_spec_hash, workload_id) are bound into the TDX Quote's report_data field on each request, cryptographically tying each Pod’s software stack to hardware-rooted evidence.

Attestation follows a precise protocol: the dstack-agent, running inside the CVM, collects Pod metadata, hashes it, and requests a TDX Quote encapsulating both platform and Pod measurements. Quotes are externally verifiable by checking Intel DCAP signatures, policy-compliant OS stack hashes, the frozen RTMR[3], and SHA-256 bindings of dynamic Pod identifiers. The privilege fuse mechanism ensures that after initial setup, no privileged workloads—even with a compromised host—can alter the measured configuration or regain host-level privileges.

A five-layer sandbox provides defense-in-depth: (1) per-Pod encrypted ZFS volumes with kernel-enforced separation, (2) Sysbox-powered user namespace separation, (3) admission controls enforced by dstack-agent to prohibit privileged contexts post-fuse, (4) denial of risky Kubelet APIs by default, and (5) per-Pod network isolation via eBPF-enforced WireGuard VPCs, with network policy digests included in the attestable Pod spec hash.

In rigorous evaluation, dstack-capsule achieves Pod-level attestation in ~24 ms, Pod startup latency of 6.25 s (vs. 8.85 s for CoCo), per-Pod memory overhead under 2 MB, and supports up to 86 idle Pods on a 64 GB TDX node—over 2× improvement in density compared to CoCo. The approach enables efficient, hardware-enforced, and cryptographically verifiable isolation and identity at the Kubernetes Pod level (Yang et al., 2 Jun 2026).

2. Dual-State Capsule Networks for Text Classification (DS-Caps) (Demotte et al., 2021)

The DS-Caps architecture introduces dual-state capsules to text classification, resolving limitations of conventional capsule networks (which target only spatial correlations and struggle with sequential and global context in long text). DS-Caps fuses two core state representations—word-level and sentence-level—into a capsule routing-backed model:

• Word-level states ($h_t$) are extracted via a Sentence-State LSTM (S-LSTM), encoding local (n-gram) and sequential dependencies at each token position.
• Sentence-level (global) states ($v^1, v^2$) aggregate context over the entire sentence, evolving at each time step and providing a form of long-range, holistically aggregated feature.

In the DS-Caps pipeline, word-level states replace raw embeddings as input for n-gram convolutions; the resulting activations form primary capsules. The global states $v^1$, $v^2$ are injected into the dynamic routing process by initializing coupling logits $b_{ij}^{(0)} = \mathrm{reshape}(v)$, biasing routing coefficients toward global sentence context. This allows DS-Caps to capture both localized composition (phrase/word) and overall text semantics, improving discriminability especially for longer sequences and low-resource languages.

Mathematically, the S-LSTM cell updates combine standard gates with message-passing of both local and global states. Downstream, capsules are transformed and routed using context-aware coupling, and each class-specific output capsule $v_j$ is supervised using the margin loss

$$L_j = T_j \max(0, m^+ - \|v_j\|)^2 + (1-T_j)\max(0, \|v_j\| - m^- )^2$$

with $m^+=0.9$, $m^-=0.1$, and target indicator $T_j$.

Empirical evaluation across six standard datasets (sentiment, news, question classification, and low-resource Sinhala text) shows that DS-Caps achieves or surpasses capsule-network state-of-the-art on four benchmarks and provides substantial improvements on long-sequence and low-resource tasks. For example, on IMDB (long text), DS-Caps attains 90.6% accuracy vs. 89.3%–89.7% for capsule baselines; on Sinhala, it achieves the highest accuracy (64.03%) and F1 (61.33%) among tested deep-learning methods. Ablations demonstrate the relevance of dual global states and the benefits of the margin loss (Demotte et al., 2021).

3. Stacked Capsule Autoencoder (SCAE): Hierarchical and Viewpoint-Invariant Representation (Kosiorek et al., 2019)

The Stacked Capsule Autoencoder (SCAE) models part–whole compositionality in images through a two-stage, unsupervised capsule autoencoder:

1. Part-Capsule Autoencoder (PCAE): Given an image $v^1, v^2$0, the PCAE encoder predicts $v^1, v^2$1 part capsules—each with a 6D spatial pose $v^1, v^2$2, presence probability $v^1, v^2$3, and features $v^1, v^2$4. These capsules index learned part templates $v^1, v^2$5 with distinct color and alpha channels. Applying inferred affine transforms yields spatial part placements, with the final image modeled by a spatial Gaussian mixture over part reconstructions, where each pixel is a weighted sum (by $v^1, v^2$6, $v^1, v^2$7) of per-part color reconstructions.
2. Object-Capsule Autoencoder (OCAE): The OCAE receives the set of part-capsule predictions and, via a set-transformer encoder, infers $v^1, v^2$8 object capsules, each endowed with a presence $v^1, v^2$9, latent $v^1$0, and an affine "object-to-viewer" map $v^1$1. An MLP over $v^1$2 predicts per-object part associations ($v^1$3), an isometric uncertainty, and another affine transform $v^1$4. By composing the affine maps, SCAE explicitly models geometric part–object structure; the likelihood of part poses is a K-component mixture of object-predicted part placements.

The design induces viewpoint-invariant part–whole relationships, as the composition of object-to-view and object-to-part transforms correctly adapts under changes in global pose. Amortized inference is performed by CNNs and attention mechanisms in both stages. Sparsity regularization (on capsule presences), posterior structure, and deformation penalties are used to encourage tight clustering of object capsules by semantics.

After unsupervised training, object-capsule presence activations $v^1$5 cluster tightly by semantic class. On MNIST, unsupervised classification via cluster assignments achieves 98.7% accuracy; on SVHN, it achieves 55.3%, both state-of-the-art for mutual–information–free unsupervised learning (Kosiorek et al., 2019).

4. Comparative Analysis of Capsule Approaches

All three frameworks instantiate capsule principles at different abstraction levels:

System	Domain	Granularity	Main Technical Innovation
dstack-capsule (Yang et al., 2 Jun 2026)	Kubernetes	Pod	Hardware-rooted, per-Pod attestation, privilege fuse, multi-layer sandboxes
DS-Caps (Demotte et al., 2021)	NLP	Word/Sentence	Dual-state S-LSTM + dynamic routing context bias
SCAE (Kosiorek et al., 2019)	Vision	Part/Object	Geometric, viewpoint-invariant, multi-stage capsule autoencoder

Each system employs a layered design: dstack-capsule with platform and Pod attestation, DS-Caps with local and global context states, and SCAE with part–object disentanglement. The underlying motif is the explicit modeling (and, in some cases, cryptographic or geometric binding) of fine-grained, independently verifiable structure within a shared context—whether that is a confidential VM, sentence, or image.

5. Implementation Details and Evaluation

dstack-capsule: The codebase is implemented in Rust (dstack-agent, dstack-kms, CSI driver, pod-digest) and Go (modified Kubelet). The system leverages Rocky Linux UKI with dm-verity for immutable disk state, auto-discovers TDX hardware, and uses Sysbox for container isolation. Each privileged component update triggers a reboot and new measurements/fuse event. Security tests include end-to-end Quote verification, forgery resistance (SO_PEERCRED/cgroup checks), and RTMR[3] immutability validation (Yang et al., 2 Jun 2026).

DS-Caps: Word states have dimension 300, sentence states 600; primary capsules have dimension 8, higher capsules 16; routing iterations are set to 3. The system is evaluated on standard benchmarks with batch sizes 8–32, epochs 20, and learning rates decaying from $v^1$6. Results confirm consistency and outperformance on long and low-resource corpora (Demotte et al., 2021).

SCAE: Uses 11×11 (MNIST) or 14×14 (SVHN/CIFAR10) templates, RMSProp optimization, batch size 128, and carefully tuned loss regularization. Training is performed for $v^1$7 steps on a single V100 GPU, requiring uniform noise injection in sigmoid logits for robust part/object presence estimation. Final class clusters are determined by K-means or a single linear layer over object-capsule presence vectors (Kosiorek et al., 2019).

6. Limitations and Future Directions

dstack-capsule: The threat model excludes side channels, DoS, and microcode vulnerabilities. The privilege fuse is irreversible post-setup, so updates that require privileged pod access necessitate full reboot/re-fusing. A plausible implication is that operational agility around privileged daemon updates may be constrained (Yang et al., 2 Jun 2026).

DS-Caps: The use of static global states per routing layer is a limitation; dynamic attention or Transformer/capsule hybrids represent natural future directions. Integration of pretrained embeddings could further enhance performance, especially on high-resource languages (Demotte et al., 2021).

SCAE: While excelling on relatively simple datasets (MNIST/SVHN), scaling to complex, high-resolution, real-world data remains a challenge, likely requiring further advances in part discovery, robust geometric modeling, and efficient amortized inference (Kosiorek et al., 2019).

7. Significance and Context

dstack-capsule represents a milestone in cloud-native confidential computing, establishing hardware-verifiable, multitenant, Pod-level trust boundaries on TDX. DS-Caps and SCAE, by contrast, advance core machine learning methods—respectively for low-resource NLP and viewpoint-invariant visual understanding—by structuring representations via layered, routeable capsules.

The conceptual synergy lies in fine-grained, explicit identity composition: dstack-capsule in the cloud security stack, DS-Caps in textual structure, and SCAE in visual compositionality. These advances collectively demonstrate the power and adaptability of capsule-inspired architectures and protocols in modern computer systems and machine learning.