Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: **Pros:**
+ The paper considers the construction of adversarial examples for a new learning paradigm which has practical relevance.
+ A number of possible threat models under the few-shot learning paradigm are considered.
+ The considered attack (a simple variation on PGD) is found to be effective against a variety of models and on a benchmark datasets.

**Cons:**
- The attack methodology is not particularly novel, as it is just a simple extension of standard PGD attacks. 
- The writing in the paper lacks clarity. The descriptions of meta-learning algorithms are not clear enough for a reader with knowledge of supervised learning but limited background on few-shot learning. In particular, there should be a dedicated section explaining the differences between attacks on traditional supervised learning and few-shot learning.
- The related work refers to a couple of previous papers that have explored defenses against the query-based threat model for misclassifying particular examples. Similarly, this paper should have explored techniques for defending against the proposed support-set attacks. For example, the defender may add steps of training on the poisoned task to 'undo' the effects of support set attacks
- The attack success metrics are not clearly defined. How are the 500 tasks mentioned in figure 3 chosen? Is the support set data at for the new tasks at test time modified at all? How does attack success vary with the similarity of tasks at training time vs those at test time?
review_title: Interesting domain for attacks, but lacks novelty and rigor

final_score: rating: 6: Marginally above acceptance threshold
review_content: The paper proposes a novel poisoning attack which is tailored for few shot learning classifiers. It performs an experimental evaluation of proposed attacks on various state of the art few shot learning / meta learning classifiers.

Overall it’s a good paper which adapts poisoning attack on a few shot learning task. Thus I recommend to accept it.

Strong points:
* proposed poisoning attack on few shot learning classifiers
* paper is well written and easy to understand
* good experimental evaluation of the method

Weak points:
* security aspects of poisoning are not discussed in the paper. In particular paper does not clearly describe goals of adversary (it’s implied that adversary wants to make model always misclassify entire test set), does not discuss capabilities of adversary (white-box vs black box).
* The main contribution of the paper is a poisoning attack, however authors talk quite a bit about adversarial examples (evasion attack) which could be distracting from the main point of the paper given that paper does not really add any new technique specifically related to evasion attack.
* proposed taxonomy of few shot learning attacks (fig 1) is not comprehensive.
* while the proposed attack is novel in a context of few shot learning, nevertheless it’s pretty straightforward generalization of poisoning attack for fully-supervised classifiers.


Recommendations on how to improve the paper:
* Add clear discussion of goals and capabilities of the adversary. If feasible, consider adaptation of the attack for different goals (i.e. change only a subset of predictions of the classifier on test set) and capabilities of the adversary (i.e. black box). Authors may refer to https://arxiv.org/pdf/1804.00308.pdf which discuss most of the necessary terminology and which is already cited by this paper.
* Make paper more focused on poisoning attack, and remove references to adversarial examples, whenever they are not needed. 
* As mentioned above, proposed taxonomy of attacks is not comprehensive. It looks more like a list of attacks authors have tried, rather than comprehensive classification of all possible attacks. Thus I would recommend to change wording and call it “considered attacks” or something similar instead of “taxonomy”.

review_title: Review for Attacking Few-Shot Classifiers with Adversarial Support Sets paper

final_score: rating: 4: Ok but not good enough - rejection
review_content: Summary:

This paper introduces Adversarial Support Set Attack, an attack that perturbs the support set samples under the few-shot paradigm. It makes use of a seed query set to find adversarial samples that maximize the loss on this set, with the hope that it will generalize to any query sample. Empirical results show that this attack is effective against a variety of few-shot algorithms and datasets. Additionally, adversarial samples constructed on traditional few-shot algorithms are empirically shown to transfer to the fine-tuning few-shot algorithm (when using similar feature extractors).

Pros:
1. This is the first paper that looks at support set poisoning as an adversarial attack in few-shot learning.

Cons:
1. Swap attack is not explained comprehensively. Is the support set used as the seed query set in this case? Since it is one of the baselines, a better explanation for the method should be included.
2. Figure 3 suggests that the seed query set is 20 times larger than the support set. This is unrealistic. Few-shot learning deals with scarce amounts of data. Under this paradigm, there are only a handful of samples per class. Assuming that an attacker has an order of magnitude more data is unrealistic.
3. The paper mentions that the UAP perturbations were calculated on a 712-way classification problem, where smaller perturbations would be more effective than on a 5-way classification problem. If UAP is a baseline, the comparison should be made fair.
4. As pointed out by the author's the transfer of adversarial samples in supervised learning is not new. It is not surprising that it happens in the case of few-shot learning as well, so that should not be counted as a major contribution.

Clarifications:
1. Does the seed query set have an overlap with the query sets sampled for the Support General evaluation? If they are randomly sampled, there is a chance that they have some samples in common, especially when the size of the seed query set is large. If there is an overlap in samples, experiments should be run when the two sets are disjoint.
review_title: Simple method but missing many key-points

final_score: rating: 6: Marginally above acceptance threshold
review_content: This work proposes adversarial attacks on few-shot learning systems. Evasion attacks are developed which can be viewed a simple applications of PGD/FGSM. The authors then apply evasion attacks to a support dataset, such that the n-shot classifier's loss is maximised on a query set. Additionally, poisoning attacks that cause the classifier to learn a shifted label set are introduced. Experiments on miniImageNet are performed with two meta-learning algorithms (MAML and ProtoNets) showing that these attacks lead to a large decrease in accuracy in comparison to baselines such as random noise attacks or universal adversarial perturbations (UAP) [1]. The authors then perform additional experiments such as measuring drops in accuracy for different numbers of n in n-shot learning and different query set sizes. 


I am not meta-learning expert, so I have assumed the authors choice of meta-learning algorithms and datasets is fair. Overall, I thought the paper was well-written, and the experiments were sound and relatively convincing. The downside is that this work introduces attacks, which as far as I can tell, are quite simple extensions or applications of gradient based evasion attacks such as PGD. I'm not sure if this represents a large enough contribution to warrant acceptance. The main contribution seems to lie in experiments showing how little data is required to make these kinds of attacks work, but what should we infer from e.g. figure 4a beyond "if an adversary controls more data the attack is stronger"? Is this a fair characterisation of the paper's contributions? I also have a few areas of confusion I hope the authors can clarify:


1.  I found it curious that the UAP performed so poorly in comparison to the support attack, since the formulations are quite similar. I didn't understand how the UAP was constructed, it seems from Section 4.1 the perturbation was constructed from a separate classification task on 712 training labels from the full ImageNet dataset. Why was the UAP not constructed on the miniImageNet dataset? Or at least on a smaller task on the full ImageNet dataset? It is hard to reason about the veracity of comparison between the two attacks currently.

2. Why was there no comparison with related work? For example, to (Goldblum et al., 2019; Yin et al., 2018) on the evasion attack side?

3. Why is ProtoNets more robust than MAML?


[1] Moosavi-Dezfooli, Seyed-Mohsen, et al. "Universal adversarial perturbations." Proceedings of the IEEE conference on computer vision and pattern recognition. 2017.

review_title: Interesting ideas, questionable contributions

Meta-review: This paper presents a method for attacking few-shot learners with poisoning a subset of support set. I believe this might be the first work to address adversarial examples for meta-learners (or few-shot learners), which is a timely issue. A common concern raised by most of reviewers is in the novelty of this work, in the sense that the method builds on a basic attack strategy (such as PGD) in the standard adversarial example setting. Authors responded to this, summarizing what's new in this paper. Episodic training for few-shot learners requires consuming support set (instead of single training data point). It is a nature of most meta-learning methods. Thus, it is easily expected that the adversarial attack for few-shot learners is naturally extended to poisoning a support set (or its subset) instead of a single data point. Certainly such extension may entail a new strategy. However, during the discussion period with reviewers, concerns on the novelty of such extension still remains. In particular, the few-shot learning algorithms do not allow big changes in the original model. The algorithms analyzed are prototypical networks that do not utilize fine-tuning, and MAML that fine-tunes for a small number of pre-fixed steps. So the transfer of adversarial samples may not be counted as a major contribution.


Decision: Reject