A Simple Approach to Adversarial Robustness in Few-shot Image Classification 

1 INTRODUCTION . Few-shot learning presents the challenge of generalizing to unseen tasks with limited data . The problem is aimed at learning quickly from few examples of data , which is generally considered the hallmark of human intelligence . This is an important practical problem due to the scarce availability of fully annotated data in the real world . Researchers have shown that such a setting can be considered for various real world computer vision tasks such as image classification ( Finn et al. , 2017 ; Chen et al. , 2019 ) , object detection ( Wang et al. , 2020 ) , image segmentation ( Rakelly et al. , 2018 ) , facerecognition ( Guo et al. , 2020 ) and medical analysis ( Maicas et al. , 2018 ) . As a result , it is of paramount importance that such safety-critical systems are reliable and robust to changes in input . Specifically in this work , we consider robustness to adversarial examples - carefully crafted perturbations using gradients that when added to inputs , fool the classifier . The most common method of improving robustness is by adversarial training ( Goodfellow et al. , 2015 ) which involves training on adversarial examples using adversary of choice . Traditional adversarially robust methods ( Madry et al. , 2018 ; Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) consider a data-rich setting where many examples are available per category . It has also been shown that adversarial generalization possibly requires significantly more data ( Schmidt et al. , 2018 ) . This becomes challenging in a scenario where the end-user has access to limited amount of annotated data but is interested in building a robust few-shot classifier . Such a setting is more practical and it is important to develop methods which can work with minimal effort in the pre-deployment stage . We show from our experiments that a simple approach of finetuning the network on clean data from an adversarially robust base model can lead to significant improvement in robustness with minimal resources . Previous works on improving robustness for few-shot classifiers focus mainly on meta-learning approaches . Here the base model is trained on adversarial examples of episodic data . We show that standard adversarial training on a large dataset is sufficient for learning a robust classifier . This makes our method simple and scalable , making the process of training robust classifiers straightforward and also creating directions to explore methods from robustness literature for few-shot setting . It is important to understand the problem of few-shot learning in order to develop their robust counterparts . The goal in few-shot learning is to learn transferable knowledge for generalization to tasks with limited data . These have generally been partitioned into metric learning ( Snell et al. , 2017 ; Vinyals et al. , 2016 ; Sung et al. , 2018 ) , optimization-based ( Finn et al. , 2017 ; Ravi & Larochelle , 2016 ) and hallucination based methods ( Hariharan & Girshick , 2017 ; Yang et al. , 2021 ; Antoniou et al. , 2017 ; Wang et al. , 2018 ) . The most common work among optimization based methods is MAML ( Finn et al. , 2017 ) which aims at learning a network initialization using a bi-level optimization procedure , that when finetuned on limited data is able to generalize to the new task . Recent works have shown that meta-learning methods can be extended to include adversarial robustness as well . ( Goldblum et al. , 2019 ; Wang et al. , 2021 ) perform adversarial training on top of meta-learners to improve robustness significantly . However , adversarial training on its own is expensive and combining with meta-learning makes the problem computationally intensive . ( Wang et al. , 2021 ) showed that there exists a compromise between training robust meta-learners and performance , both in terms of standard and robust accuracy , motivating the need for a simpler approach . Another interesting line of work , focused on improving few-shot learning , shows that a simple method which involves training on large scale data and finetuning the model on the few-shot dataset can match or even outperform meta-learning methods ( Chen et al. , 2019 ; Dhillon et al. , 2019 ) . The intuition is that the model sees examples from all categories and can get a general sense of semantics rather than seeing only episodic data . Such a setting also makes it easier to train on large scale data that can lead to further improvements as shown in ( Dhillon et al. , 2019 ) . Our results show considering a simple setting can be beneficial for adversarial robustness as well . We consider the few-shot setting and show that adversarial training along with simple nearest centroid based classifier can outperform previous methods in terms of robustness . Such a setting is practically relevant , since the adversarial training on large data needs to be done just once and robustness for few-shot classes can be achieved without creating adversarial examples for the specific task . We believe it also becomes easier to incorporate new approaches to robustness , such as verifiably robust classifiers ( Gowal et al. , 2018 ; Cohen et al. , 2019 ) and can bring together robust methods for both large and limited dataset settings . In the following sections , we describe our method and discuss relevant related work . We present experimental findings and implementation details in the subsequent sections followed by conclusion and directions for future work . 2 METHOD . Here we introduce notation and provide a description of our method . Our first objective is to learn a feature extractor fθb and linear classifier Cωb using the abundantly-labeled base dataset Xb . At the next stage , when a N -way K-shot few-shot task is sampled from the novel dataset Xn , we use only the feature extractor fθb and learn a new linear classifier Cωn such that it can generalize to unseen examples from the novel categories . We show that a simple approach of training a robust base model and then adapting it to novel categories can outperform previous approaches . We divide our approach into two stages : ( 1 ) Robust Base training and ( 2 ) Novel training . 2.1 ROBUST BASE TRAINING . Given a base datasetXb with large number of annotated examples per category , we perform adversarial training using an iterative adversary such as PGD ( Madry et al. , 2018 ) . Specifically , we solve the min-max objective θ∗ = min θ E ( x , y ) ∈Xb [ max ||δ||p < L ( θ , x+ δ , y ) ] ( 1 ) Here , L ( θ , x , y ) represents the training objective , which is commonly cross-entropy and θ = ( θb , ωb ) represents the combination of the feature extractor and base classifier parameters . There are different methods for optimizing the inner maximization in Equation 1 . For all our experiments we use the Projected Gradient Descent ( PGD ) algorithm , an iterative algorithm presented in ( Madry et al. , 2018 ) with p =∞ which corresponds to finding a perturbation δ around an -bounded hypercube around x that maximizes the objective . Once we find the perturbation , the perturbed input is added to the training set and parameters are tuned . This method is called adversarial training and is the most widely used method to improve robustness to adversarial examples . Note that adversarial training , which is a computationally expensive procedure , needs to be performed just once using base dataset . In the next stage , we use only clean examples which makes it practical and easy to train robust few-shot classifiers for novel tasks . Weight averaging : Weight averaging ( WA ) has been shown as a simple way to improve generalization ( Izmailov et al. , 2018 ; Garipov et al. , 2018 ) in deep networks as it approximates ensembling in temporal fashion and can find flatter optima in loss surface . This method has been used in adversarial training ( Gowal et al. , 2020 ; Chen et al . ) for improving robustness in standard classification task . Since we are interested in using base parameters at the next stage , we perform weight averaging for only the feature extractor parameters θb and show this can be used for few-shot setting . Similar to ( Gowal et al. , 2020 ) , we keep a separate copy of the weights and for every iteration perform exponential moving average method θb′ ← τθb′ + ( 1 − τ ) ∗ θb and use θb′ during the evaluation . We set τ = 0.999 in all our experiments . 2.2 NOVEL TRAINING . During this stage , we consider the N -way , K-shot method as the novel task and adapt our learnt feature extractor fθb using classifier Cωn . For all our experiments , we found best results when the weights of feature extractor fθb are frozen and not optimized during novel training . Intuitively , this can be understood not wanting the parameters of the feature extractor to be biased towards the fewshot examples . And since we are interested in learning only from clean data during the novel training , there can also be an effect of forgetting the robustness learnt at the base stage . This was observed in ( Goldblum et al. , 2019 ) where only the final layer was trained and rest of the parameters were frozen . During the novel training stage , we use only clean examples and not adversarial examples , making the process straightforward . Linear classifier : The simplest possible baseline is to learn a linear model on top of the frozen feature extractor using the few shot examples of novel categories . As shown in our experiments , this simple baseline on its own achieves reasonable performance compared to previous approaches . This baseline also suggests that a robust base classifier corresponds to a robust novel classifier and a simple approach such as ours is enough to achieve robustness for few-shot classifiers . However , as observed in previous works ( Wang et al. , 2021 ; Goldblum et al. , 2019 ) and in our experiments , this approach alone is not sufficient to achieve improved robustness . Interestingly , we achieve much closer results to state of the art compared to previous works using this simple baseline . One challenge associated with using few-shot data is that the model can become biased towards the specific samples and may not capture the true class distribution . Hence there is a need for more calibrated classifiers . Background on Distribution Calibation ( DC ) ( Yang et al. , 2021 ) : Recent work ( Yang et al. , 2021 ) has shown that standard accuracy of few-shot classifiers can be improved by using Distribution Calibration . They present a free-lunch hallucination-based method where the feature distributions of the novel categories are calibrated using the base dataset , due to the similarity between the base and novel datasets . The mean and covariance of each novel category is calibrated using the statistic of base data . They use these statistics to hallucinate or sample many points from a Gaussian distribution , and learn a logistic regression classifier . This simple method was shown to improve standard accuracy significantly under various settings . Mean Calibration and Nearest Centroid ( NC ) : DC method can be computationally expensive due to the calculation of covariance matrix which can be of O ( N ∗D2 ) complexity where D is the dimensionality of the feature space and N is the number of data points in the base dataset . The covariance matrix is also expensive to store in memory . Moreover , sampling from a multivariate Gaussian with non-diagonal covariance is also expensive and can be of the order of at least O ( D2.3 ) ( Bishop , 2006 ) . These can reduce the applicability of the approach for certain architectures . Another aspect of using the hallucinated features is that the model can become biased to the clean features and learn a non-robust final classifier . Note that since these additional data points are generated in the feature space and not the image space , it is not possible to create adversarial versions of these features and perform adversarial training using the large set of features . This poses a problem of improving the performance during novel training without sacrificing robustness . To overcome these problems , we present a simple method where we rely only on the calibrated mean and classify query sample using a non-parametric Nearest Centroid based algorithm . We find the nearest base-category centers to each novel training sample and then average them along with the novel training sample to obtain the new mean or centroid for the novel category , similar to ( Yang et al. , 2021 ) . We do not consider the covariance matrix in our method and we find this approximation works equally well in our experiments . More formally : µj = 1 m+ 1 ( zj + ∑ i∈Sj µbi ) ( 2 ) where µj is the center for the novel category j and Sj is the set of m base category centers that are closest to zj , µbi is the mean of base category i in the feature space . In the case of k-shot setting , we calculate a centroid for each sample and average them to get one centroid for each category . At inference time , we simply find the nearest center to the query point and assign its label : ŷ = { yj | argmax j µ̃Tj z̃ } ( 3 ) where ã = a||a||2 is the ` 2 normalized version of the vector a and ŷ is the predicted category . Note that ` 2 normalization is performed for both query point and centroids . Since we consider the normalized version of the vectors , euclidean distance reduces to the form in Equation 3 , similar to recent works ( Grill et al. , 2020 ) . Our inference can be considered similar to the Linear Classifier method exceptthat our centres ( µj ) are estimated with simple averaging rather than learnt using SGD . Note that similar to ( Yang et al. , 2021 ) , as a preprocessing step , we transform the embeddings by taking the square root of each dimension so that their distribution gets closer to Gaussian form . It can be seen as “ Tukey ’ s Ladders of Power Transformation ” ( Tukey et al. , 1977 ) with λ = 0.5 . At the inference time , the Nearest Centroid ( NC ) method requires less memory and computation compared to a Nearest Neighbor classifier since we only have to store and compare with one prototype per class rather than the entire training set .

Summary: This paper aims to address the problem of adversarial attack for low shot image classification. This work is motivated by the challenging scenario where there is a need of significant amount of data to train an adversarial robust classifier and there is not much data under few-shot setting. This work proposed and demonstrated a simple approach for robust few shot classifier. A model is first adversarially trained on the base classes and produce a robust base model. The feature extractor of the robust base model is then frozen. With the frozen feature extractor, 2  different manners are used for training a novel / few shot classifier, including (1) training a linear classifier and (2) computing category centroid for each novel class and perform nearest neighbor classification using the centroid. The experiment demonstrates that this simple baseline can outperform prior baselines on 3 datasets. The ablation study includes 1 vs 5 shot and different adversarial training methods. However, the core contribution of this paper is weakened due to the lack of theoretical analysis.