Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 6: Marginally above the acceptance threshold
review_content: summary: This paper focuses on solving few-shot domain adaptation problem without accessing to source data during the training time, i.e., hypothesis transfer. The proposed method "TOHAN" uses two DNNs: one learns intermediate domain while another minimize the target risk and intermediate-target discrepancy.
main_review: Hypothesis transfer that this paper focuses on is an interesting and important problem which can protect pravicy. Also, only get access to a few labeled target data makes this problem more challenging. By solving the few-shot problem, the proposed method generates intermediate data using a generator and fixed source model. Then the distribution discrepancy between intermediate data and the target data are minimized.
limitations_and_societal_impact: Generally, the problem setting is interesting and the solution is reasonable. My major concerns are:
1. How much time does it take running one epoch?
2. Since there are only a few target data, is there a balanced problem between target data and the intermediate data?
3. Since the distance between intermediate data and the target data is minimized in the following step, does it important to make the intermediate data look like target data in the generation step?
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: As the increasing need for privacy protection, previous few-shot DA (FDA) has limited applications in the real world. To overcome this drawback of the FDA, this paper considers a very challenging problem setting, few-shot hypothesis adaptation (FHA), which is the most difficult part of hypothesis transfer learning (HTL). Compared to previous solutions to HTL, the authors argue that generating target samples is a good solution. The proposed method is validated on common datasets.
main_review: Pros:

1.  The considered problem setting is practical and is not solved well in the literature. In the current era, how to protect privacy is quite important. If we can use well-trained classifiers (from other domains) to help obtain a good classifier for the target domain, many more available well-trained classifiers can be used, which can save a lot of energy to train a deep network for the target domain or to train a very big generalized deep network. 

2. Compared to existing fine-tuning methods, the proposed solution considers the domain gap between the backbone network and the target domain, which is a research gap in the current literature. Besides, generating unlabeled data for the target domain sounds interesting, especially in few-shot situations.

3. Experiments are conducted on five data sets. Baselines, including FDA methods and HTL methods, are used to validate if the proposed method can handle FHA well.

Cons:

1. In Problem 1, we have two domains: source and target. However, if the source domain is a random domain, can we still obtain a useful classifier for the target domain? The key assumption that makes FHA solvable is missing. What is the key to ensuring that FHA can be solved? This is the major concern about the considered setting.

2. The proposed solution, TOHAN, is a hybrid one that repeats generating and adapting. However, how could you know the initial steps being good? At the initial stage, we might not get good target samples, right? How could we ensure we can get good results from possible bad target samples in the loop mentioned above?

3. SHOT is actually not a classical HTL method. Network-based HTL methods should be also considered as a baseline. Besides, more HTL methods should be reviewed, such as multi-source HTL methods.

4. What is the performance of the method that does not use the group information to implement the domain alignment? I did not see the results of this kind of method.

5. In Problem 1, n_t is less than 7 seems too extreme?

6. Grammar issues should be addressed in the revised version.

limitations_and_societal_impact: Yes, the authors have adequately addressed the limitations and potential negative societal impact of their work.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper focuses on a problem setting where data are not available but classifiers are. The possible benefits of this setting lie in the privacy reservation, i.e., data used in previous few-shot learning may leak the private information. The proposed solution does not use a fine-tuning-based method but a sample-generation-based method, which is motivated by the learnability of semi-supervised learning. 
main_review: The proposed solution thought few-shot learning in a different way. The most of current methods address few-shot learning via finding/digging relation among available data and few-shot data. Data can be from different distributions (although they should be related) [r1]. In this paper, generating samples for the target domain is proposed and validated. If the samples are suitable for the target domain, a good classifier should be achievable (like SSL).

Major concerns/questions: 

   1. Although generating samples look novel and interesting, how to ensure a reliable generating process is unclear to me. There are many ways to influence the process and make the generated sample unreliable. Regarding this concern, I am not sure why the source domain can help as well. If the source cannot help, the generated samples must be unreliable, is that right? 

   2. I notice that HTL might be a very similar setting to the proposed setting. What are the major differences between both? Have you tried to compare TOHAN with HTL methods?

   3. A large pre-trained classifier also seems suitable for solving the proposed setting. Such a classifier contains enough knowledge that is useful for the target domain as well. If so, what is the meaning to consider the proposed setting and solution?

  4. Since you use a generator (DC-GAN) for each class, I was worried about the computational cost when scaling the method to larger datasets. 10 generators might be acceptable, but when the number becomes 200 or even 1000, is there any way to alleviate the computational cost? 

  5. I do not understand $\mathcal{H}_{P,X}$ in Eq. (2). How is it calculated? Also, what is the meaning of the $t$ in the definition of Theorem 1? I guess it is some kind of form/assumption but I think the authors should elaborate on it here.  The subscript of $M$ in line 71 appears abruptly without any description. 

  6. Why do you introduce M in Eq. (6)? Does this M influence the final results?

[r1] Model-agnostic meta-learning for fast adaptation of deep networks. ICML 2017.

----
## Post-Rebuttal Update
----

After viewing the rebuttal and other reviewers' comments, I feel more confident in the authors' methods. I think the authors did a great job in addressing my questions, so I have decided to raise my score to 7. There is something the authors need to address more but I do think it does not diminish the contribution of this work. 
limitations_and_societal_impact: The limitations and potential negative societal impact of their work have been discussed well.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a novel problem in domain adaptation - Few-shot Hypothesis Adaptation (FHA) - that combines Hypothesis Transfer Learning and the Few-Shot Domain Adaptation problem. Specifically, it assumes a lack of source domain data but the presence of a classifier (hypothesis) pretrained on the source domain and a few labelled data points (<=10 per class) from the target domain (with no additional data). The paper also adapts the FADA method and proposes a novel method, called TOHAN, which uses the source-domain hypothesis and the few target-domain data points to generate the intermediate-domain data compatible with the two domains.
main_review: \+ means strength, \- means weakness

**Originality**

\+ *Novel setting*. As far as I am aware, the paper proposes a novel setting - Few-shot Hypothesis Adaptation (FHA) - a combination of existing problems - Hypothesis Transfer Learning and the Few-Shot Domain Adaptation.

\+/\- *Somewhat novel method*. As far as I am aware, the paper also proposes a novel method - TOHAN - which is a minor adaptation of FADA [23] into the setting. The method architecture seems to be heavily inspired by FADA [23]. Unlike FADA, TOHAN generates and uses the generated intermediate domain instead of the original source domain. However, apart from that, it is not entirely clear what the technical differences are between these methods. Which line in Algorithm 1 would be different for FADA / S-FADA / T-FADA / ST-FADA?

\- *The relation between FHA and FSL is poorly explained, and FSL is poorly cited.* I found the sentence in lines 88-89 particularly vague and poorly written. In addition, line 90 that compares TSN [37] and ProtoNets [29] ("which is relatively weaker than the former") brings little value to the paper. In my humble opinion, these methods were designed for two different problems (i.e. video action classification [37] and single image classification [29]), and it is inappropriate to compare them in this way. The authors might find the following works from FSL literature more related to their work: (Antreas et al., 2018), (Hariharan & Girshick., 2017), (Wang et al., 2018). Generally, these methods also generate/hallucinate samples from limited target-domain data and should be cited. 

**Quality**

\+ *Some good experiments.* The paper performs a solid number of comparisons with representative baselines from HTL and FDA literature ([19] and [23], respectively) and basic fine-tuning baseline proposed by the authors. 

\+/\- *Work seems grounded in some theoretical work*. However, I did not attempt to verify the proof, so I cannot comment on its correctness.

\- *Only marginal improvements over baselines, mostly within the error bar range.* Although the authors claim the method performs better than the baselines, the error range is rather high, suggesting that the performance differences between some methods are not very significant. 

\- *There might be a possible fundamental flaw to the claim of full data privacy.* The authors claim that the TOHAN method (and therefore also the FHA problem) "strictly" protects the privacy of the source domain by using the source hypothesis rather than the source data itself (lines 245-247). However, the claim that knowledge is "completely" inaccessible may be false. For instance, Ateniese et al. (2015) have shown that it is possible to extract certain types of information from pretrained classifiers and models. In a more recent privacy analysis of deep learning, Nasr et al. (2019) suggest that even well-trained models might leak a significant amount of information about the data they were trained on. Moreover, the proposed TOHAN relies on the leaked source-domain knowledge to generator appropriate source-domain data. Therefore, it seems to me that claim that TOHAN is privacy secure is completely false.

\- *Lack of sufficient evidence for no source domain features in intermediate data.* The authors claim that "high-level, visual and useful features of source domain are rare in the generated intermediate data (Figure 6)" (lines 243-244); however, no empirical value is provided to support this claim (i.e. what do authors mean by "rare" in this context? how rare is "rare"?). Figure 6a/b does support this claim as it shows only 4 intermediate-domain images and no examples of the original source-domain data. This is insufficient evidence to draw the conclusion in lines 243-244, and in fact, it points to the contrary. 

**Clarity**

\- *The paper is poorly written.* The paper is not particularly easy to read. It contains many spelling and grammatical errors (see below for proposed corrections). There is a large number of acronyms (e.g. FHA, SHOT, HTL, ST+F etc..) and some confusing mathematical notation (e.g. $D$, $\mathcal{D}$, $X$ and $\mathcal{X}$ refer to different entities) which make this work more confusing to read. The notation in the figure is inconsistent with the main text (uses $\mathcal{X}$ instead of $\mathcal{D}$). 

**Significance**

\- *The paper presents a novel and interesting problem but could be flawed.* This novel problem and method could have important consequences in the context of data privacy - however, to me, the idea seems fundamentally flawed (see my comments in the "Quality" subsection, or  "Limitations And Societal Impact"). 

\- *The TOHAN improvements over baselines are mostly marginal.* Although the authors claim the method performs better than the baselines, the error range is rather high, suggesting that the performance differences between some methods are not very significant and the improvements are marginal. 


**Spelling, Grammer, and Other Possible Mistakes.**

\- Line 32, grammar: "face of generation" --> "face generation"

\- Figure 2 caption, grammar: "which two data come from ... " --> "where the two data points come from ... "

\- Line 128, wrong word: "dependents" --> "depends"

\- Line 167, redundant word: "regarding to the ..." --> "regarding the ... "

\- Line 210, redundant words: "which confuses D unable to distinguish between ..." --> "which confuses D between ... "

\- Line 213, wrong word: "initial" --> "initialize"

**References**

Ateniese et al., 2015, "Hacking smart machines with smarter ones: How to extract meaningful data from machine learning classifiers", International Journal of Security and Networks, Volume 10, Issue 3

Nasr et al., 2019, "Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning," 2019 IEEE Symposium on Security and Privacy

Antoniou et al., 2018, "Data Augmentation Generative Adversarial Networks", (ICLR 2018 Workshop)

Hariharan & Girshick., 2017, "Low-shot Visual Recognition by Shrinking and Hallucinating Features", (ICCV 2017)

Wang et al., 2018, "Low-shot learning from imaginary data" (CVPR 2018)



_____
### POST-REBUTTAL
_____

After a detailed discussion with the authors, I decided to increase my original rating from 3 to 7. The initial low rating was due to initially hidden assumptions and a poorly defined scope of data privacy which are central in the paper. These have been discussed and clarified by the authors during the rebuttal. The authors also addressed my concerns regarding the novelty and source-domain leakage into the intermediate domain. The authors have agreed to improve the clarity, literature review, dampen down on the privacy claims, and include additional experiments, and I am happy to increase the rating. Although the privacy claims are now not as strong as originally claimed (e.g. the method does not guard against source-information leakage, but rather shelters individual source data points from a possible data leakage), the paper still opens up an interesting area of research and presents a novel method that will likely attract attention in the community. 


limitations_and_societal_impact: The authors claim that their method allows for full privacy of the source domain by relying on a well-trained source domain classifier. However, this seems to be based on the false assumption that the source domain classifier does not leak any private information. Recent studies (for example, Nasr et al. (2019) and Ateniese et al. (2015)) suggest that there might be a significant amount of source-domain information that pre-trained models leak. Moreover, TOHAN relies on leaking information from the source domain to generate realistic/compatible intermediate-domain data. This completely invalidates one of the main claims of the paper that private information is protected.
review_title: null

Meta-review: The paper provides a few-shot learning technique that avoids looking at the data obtained to train previous tasks. As such it has promise for privacy preserving settings. The techniques seem solid, as well as the experimental setting. There where a few concerns related to over-promising in the area of differential privacy, however the reviewers agree that this can be fixed by the authors towards a camera-ready version. I recommend accepting the paper - it should be a good addition to Neurips
Decision: Accept (Spotlight)