A Simple Approach to Adversarial Robustness in Few-shot Image Classification 

1 INTRODUCTION . Few-shot learning presents the challenge of generalizing to unseen tasks with limited data . The problem is aimed at learning quickly from few examples of data , which is generally considered the hallmark of human intelligence . This is an important practical problem due to the scarce availability of fully annotated data in the real world . Researchers have shown that such a setting can be considered for various real world computer vision tasks such as image classification ( Finn et al. , 2017 ; Chen et al. , 2019 ) , object detection ( Wang et al. , 2020 ) , image segmentation ( Rakelly et al. , 2018 ) , facerecognition ( Guo et al. , 2020 ) and medical analysis ( Maicas et al. , 2018 ) . As a result , it is of paramount importance that such safety-critical systems are reliable and robust to changes in input . Specifically in this work , we consider robustness to adversarial examples - carefully crafted perturbations using gradients that when added to inputs , fool the classifier . The most common method of improving robustness is by adversarial training ( Goodfellow et al. , 2015 ) which involves training on adversarial examples using adversary of choice . Traditional adversarially robust methods ( Madry et al. , 2018 ; Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) consider a data-rich setting where many examples are available per category . It has also been shown that adversarial generalization possibly requires significantly more data ( Schmidt et al. , 2018 ) . This becomes challenging in a scenario where the end-user has access to limited amount of annotated data but is interested in building a robust few-shot classifier . Such a setting is more practical and it is important to develop methods which can work with minimal effort in the pre-deployment stage . We show from our experiments that a simple approach of finetuning the network on clean data from an adversarially robust base model can lead to significant improvement in robustness with minimal resources . Previous works on improving robustness for few-shot classifiers focus mainly on meta-learning approaches . Here the base model is trained on adversarial examples of episodic data . We show that standard adversarial training on a large dataset is sufficient for learning a robust classifier . This makes our method simple and scalable , making the process of training robust classifiers straightforward and also creating directions to explore methods from robustness literature for few-shot setting . It is important to understand the problem of few-shot learning in order to develop their robust counterparts . The goal in few-shot learning is to learn transferable knowledge for generalization to tasks with limited data . These have generally been partitioned into metric learning ( Snell et al. , 2017 ; Vinyals et al. , 2016 ; Sung et al. , 2018 ) , optimization-based ( Finn et al. , 2017 ; Ravi & Larochelle , 2016 ) and hallucination based methods ( Hariharan & Girshick , 2017 ; Yang et al. , 2021 ; Antoniou et al. , 2017 ; Wang et al. , 2018 ) . The most common work among optimization based methods is MAML ( Finn et al. , 2017 ) which aims at learning a network initialization using a bi-level optimization procedure , that when finetuned on limited data is able to generalize to the new task . Recent works have shown that meta-learning methods can be extended to include adversarial robustness as well . ( Goldblum et al. , 2019 ; Wang et al. , 2021 ) perform adversarial training on top of meta-learners to improve robustness significantly . However , adversarial training on its own is expensive and combining with meta-learning makes the problem computationally intensive . ( Wang et al. , 2021 ) showed that there exists a compromise between training robust meta-learners and performance , both in terms of standard and robust accuracy , motivating the need for a simpler approach . Another interesting line of work , focused on improving few-shot learning , shows that a simple method which involves training on large scale data and finetuning the model on the few-shot dataset can match or even outperform meta-learning methods ( Chen et al. , 2019 ; Dhillon et al. , 2019 ) . The intuition is that the model sees examples from all categories and can get a general sense of semantics rather than seeing only episodic data . Such a setting also makes it easier to train on large scale data that can lead to further improvements as shown in ( Dhillon et al. , 2019 ) . Our results show considering a simple setting can be beneficial for adversarial robustness as well . We consider the few-shot setting and show that adversarial training along with simple nearest centroid based classifier can outperform previous methods in terms of robustness . Such a setting is practically relevant , since the adversarial training on large data needs to be done just once and robustness for few-shot classes can be achieved without creating adversarial examples for the specific task . We believe it also becomes easier to incorporate new approaches to robustness , such as verifiably robust classifiers ( Gowal et al. , 2018 ; Cohen et al. , 2019 ) and can bring together robust methods for both large and limited dataset settings . In the following sections , we describe our method and discuss relevant related work . We present experimental findings and implementation details in the subsequent sections followed by conclusion and directions for future work . 2 METHOD . Here we introduce notation and provide a description of our method . Our first objective is to learn a feature extractor fθb and linear classifier Cωb using the abundantly-labeled base dataset Xb . At the next stage , when a N -way K-shot few-shot task is sampled from the novel dataset Xn , we use only the feature extractor fθb and learn a new linear classifier Cωn such that it can generalize to unseen examples from the novel categories . We show that a simple approach of training a robust base model and then adapting it to novel categories can outperform previous approaches . We divide our approach into two stages : ( 1 ) Robust Base training and ( 2 ) Novel training . 2.1 ROBUST BASE TRAINING . Given a base datasetXb with large number of annotated examples per category , we perform adversarial training using an iterative adversary such as PGD ( Madry et al. , 2018 ) . Specifically , we solve the min-max objective θ∗ = min θ E ( x , y ) ∈Xb [ max ||δ||p < L ( θ , x+ δ , y ) ] ( 1 ) Here , L ( θ , x , y ) represents the training objective , which is commonly cross-entropy and θ = ( θb , ωb ) represents the combination of the feature extractor and base classifier parameters . There are different methods for optimizing the inner maximization in Equation 1 . For all our experiments we use the Projected Gradient Descent ( PGD ) algorithm , an iterative algorithm presented in ( Madry et al. , 2018 ) with p =∞ which corresponds to finding a perturbation δ around an -bounded hypercube around x that maximizes the objective . Once we find the perturbation , the perturbed input is added to the training set and parameters are tuned . This method is called adversarial training and is the most widely used method to improve robustness to adversarial examples . Note that adversarial training , which is a computationally expensive procedure , needs to be performed just once using base dataset . In the next stage , we use only clean examples which makes it practical and easy to train robust few-shot classifiers for novel tasks . Weight averaging : Weight averaging ( WA ) has been shown as a simple way to improve generalization ( Izmailov et al. , 2018 ; Garipov et al. , 2018 ) in deep networks as it approximates ensembling in temporal fashion and can find flatter optima in loss surface . This method has been used in adversarial training ( Gowal et al. , 2020 ; Chen et al . ) for improving robustness in standard classification task . Since we are interested in using base parameters at the next stage , we perform weight averaging for only the feature extractor parameters θb and show this can be used for few-shot setting . Similar to ( Gowal et al. , 2020 ) , we keep a separate copy of the weights and for every iteration perform exponential moving average method θb′ ← τθb′ + ( 1 − τ ) ∗ θb and use θb′ during the evaluation . We set τ = 0.999 in all our experiments . 2.2 NOVEL TRAINING . During this stage , we consider the N -way , K-shot method as the novel task and adapt our learnt feature extractor fθb using classifier Cωn . For all our experiments , we found best results when the weights of feature extractor fθb are frozen and not optimized during novel training . Intuitively , this can be understood not wanting the parameters of the feature extractor to be biased towards the fewshot examples . And since we are interested in learning only from clean data during the novel training , there can also be an effect of forgetting the robustness learnt at the base stage . This was observed in ( Goldblum et al. , 2019 ) where only the final layer was trained and rest of the parameters were frozen . During the novel training stage , we use only clean examples and not adversarial examples , making the process straightforward . Linear classifier : The simplest possible baseline is to learn a linear model on top of the frozen feature extractor using the few shot examples of novel categories . As shown in our experiments , this simple baseline on its own achieves reasonable performance compared to previous approaches . This baseline also suggests that a robust base classifier corresponds to a robust novel classifier and a simple approach such as ours is enough to achieve robustness for few-shot classifiers . However , as observed in previous works ( Wang et al. , 2021 ; Goldblum et al. , 2019 ) and in our experiments , this approach alone is not sufficient to achieve improved robustness . Interestingly , we achieve much closer results to state of the art compared to previous works using this simple baseline . One challenge associated with using few-shot data is that the model can become biased towards the specific samples and may not capture the true class distribution . Hence there is a need for more calibrated classifiers . Background on Distribution Calibation ( DC ) ( Yang et al. , 2021 ) : Recent work ( Yang et al. , 2021 ) has shown that standard accuracy of few-shot classifiers can be improved by using Distribution Calibration . They present a free-lunch hallucination-based method where the feature distributions of the novel categories are calibrated using the base dataset , due to the similarity between the base and novel datasets . The mean and covariance of each novel category is calibrated using the statistic of base data . They use these statistics to hallucinate or sample many points from a Gaussian distribution , and learn a logistic regression classifier . This simple method was shown to improve standard accuracy significantly under various settings . Mean Calibration and Nearest Centroid ( NC ) : DC method can be computationally expensive due to the calculation of covariance matrix which can be of O ( N ∗D2 ) complexity where D is the dimensionality of the feature space and N is the number of data points in the base dataset . The covariance matrix is also expensive to store in memory . Moreover , sampling from a multivariate Gaussian with non-diagonal covariance is also expensive and can be of the order of at least O ( D2.3 ) ( Bishop , 2006 ) . These can reduce the applicability of the approach for certain architectures . Another aspect of using the hallucinated features is that the model can become biased to the clean features and learn a non-robust final classifier . Note that since these additional data points are generated in the feature space and not the image space , it is not possible to create adversarial versions of these features and perform adversarial training using the large set of features . This poses a problem of improving the performance during novel training without sacrificing robustness . To overcome these problems , we present a simple method where we rely only on the calibrated mean and classify query sample using a non-parametric Nearest Centroid based algorithm . We find the nearest base-category centers to each novel training sample and then average them along with the novel training sample to obtain the new mean or centroid for the novel category , similar to ( Yang et al. , 2021 ) . We do not consider the covariance matrix in our method and we find this approximation works equally well in our experiments . More formally : µj = 1 m+ 1 ( zj + ∑ i∈Sj µbi ) ( 2 ) where µj is the center for the novel category j and Sj is the set of m base category centers that are closest to zj , µbi is the mean of base category i in the feature space . In the case of k-shot setting , we calculate a centroid for each sample and average them to get one centroid for each category . At inference time , we simply find the nearest center to the query point and assign its label : ŷ = { yj | argmax j µ̃Tj z̃ } ( 3 ) where ã = a||a||2 is the ` 2 normalized version of the vector a and ŷ is the predicted category . Note that ` 2 normalization is performed for both query point and centroids . Since we consider the normalized version of the vectors , euclidean distance reduces to the form in Equation 3 , similar to recent works ( Grill et al. , 2020 ) . Our inference can be considered similar to the Linear Classifier method exceptthat our centres ( µj ) are estimated with simple averaging rather than learnt using SGD . Note that similar to ( Yang et al. , 2021 ) , as a preprocessing step , we transform the embeddings by taking the square root of each dimension so that their distribution gets closer to Gaussian form . It can be seen as “ Tukey ’ s Ladders of Power Transformation ” ( Tukey et al. , 1977 ) with λ = 0.5 . At the inference time , the Nearest Centroid ( NC ) method requires less memory and computation compared to a Nearest Neighbor classifier since we only have to store and compare with one prototype per class rather than the entire training set .

Summary: This paper 1) proposes a simple transfer learning approach to enable train adversarially robust few-shot classifiers for few-shot image classification, and 2) present a method for novel classification task based on calibrating the centroid of the few-shot category towards the base classes. Results show good performance has been achieved on three benchmarks i.e., Mini-ImageNet, CIFAR-FS, and CUB datasets.  My main concern of this work is that the improved performance can be mainly resulted from the pretrained stage (base training) using the base dataset $X_b$. Normally, pretraining can improve the performance on small tasks.