Adversarial Meta-Learning
Authors: Chengxiang Yin
Jian Tang
Zhiyuan Xu
Yanzhi Wang
Venue:  (2021)
Keywords: Meta-learning
Adversarial manner
Adversarial Meta-Learner
Adversarial samples

Abstract: Meta-learning enables a model to learn from very limited data to undertake a new task. In this paper, we study the general meta-learning with adversarial samples. We present a meta-learning algorithm, ADML (ADversarial Meta-Learner), which leverages clean and adversarial samples to optimize the initialization of a learning model in an adversarial manner. ADML leads to the following desirable properties: 1) it turns out to be very effective even in the cases with only clean samples; 2) it is robust to adversarial samples, i.e., unlike other meta-learning algorithms, it only leads to a minor performance degradation when there are adversarial samples; 3) it sheds light on tackling the cases with limited and even contaminated samples. It has been shown by extensive experimental results that ADML outperforms several representative meta-learning algorithms in the cases involving adversarial samples generated by different attack mechanisms, on two widely-used image datasets, MiniImageNet and CIFAR100, in terms of both accuracy and robustness.

Under review as a conference paper at ICLR 2021
ADVERSARIAL META-LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Meta-learning enables a model to learn from very limited data to undertake a new task. In this paper, we study the general meta-learning with adversarial sam- ples. We present a meta-learning algorithm, ADML (ADversarial Meta-Learner), which leverages clean and adversarial samples to optimize the initialization of a learning model in an adversarial manner. ADML leads to the following desirable properties: 1) it turns out to be very effective even in the cases with only clean samples; 2) it is robust to adversarial samples, i.e., unlike other meta-learning algorithms, only leads to a minor performance degradation when there are ad- versarial samples; 3) it sheds light tackling the cases with limited and even contaminated samples. It has been shown by extensive experimental results that ADML outperforms several representative meta-learning algorithms in the cases involving adversarial samples generated by different attack mechanisms, on two widely-used image datasets, MinilmageNet and CIFAR CIFAR100, in terms of both ac- curacy and robustness.
INTRODUCTION
Deep learning has made tremendous successes and emerged as a de facto approach in many appli- cation domains, such computer vision and natural language processing, which, however, depends heavily on huge amounts of labeled training data. The goal of meta-learning is to enable a model (especially Deep Neural Network (DNN) to learn from only small number of data samples to undertake a new task, which is critically important to machine intelligence but turns out to be very challenging. Currently, a common approach to learn is train model undertake task from scratch without making use of any previous experience. Specifically, a model is initialized randomly and then updated slowly using gradient descent with a large number of training samples. and data-hungry training process is quite different from the way how
This kind of human learns quickly from only a few samples and obviously cannot meet the requirement of meta-learning. Several methods (Finn et al. (2017); Vinyals et al. (2016); Snell et al. (011)); (ung et al. (2018)) have been proposed to address meta-learning by fixing the above issue. For exam- ple, well-known work (Finn et al. (2017)) ) presents novel meta- learning algorithm called MAML (Model-Agnostic Meta-Learniig) which trains and optimizes the initialization of model parameters carefully such that it achieves the maximal performance
a new task after its parameters are up- dated through one or just a few gradient steps with a small amount of data. This method is claimed be model-agnostic since it can be directly applied to any learning model that can be trained with gradient descent.
Robustness is another major concern for machine intelligence, especially for the safety-critical ap- plications, such as facial recognition, algorithmic trading and copyright control. It has been shown that such learning models can be easily fooled by adversarial manipulation to cause serious secu- rity threats (Zhao et al. (2018); Goldbbum et al. (0000):B Saadatpanah et al. (2019)) which, however, can be properly and effectively handled by conventional adversarial training and pre-processing defenses (Madry et al. (2077): Zhang et al. (2019): (Samangouei et al. (2018)). Nonetheless, if the data is limited (e.g., face recognition from few images), the aforementioned pipelines, which require large amount of training data, suffers from serious performance degradation. Although meta- leta-lea based approaches show great potential on dealing with few-shot tasks, we show via experiments that existing meta-leaning algorithms (such MAML (Finn et al. (2017)). Matching Networks (Vinyals et al. (2016)) and Relation Networks (Sung et al. (2018)) are also vulnerable to adversarial samples, i.e., adversarial samples can lead to significant performance degradation

---

Under review as a conference paper at ICLR 2021
for meta-learning To the best of our knowledge, existing works on meta-learning have not yet addressed adversarial samples, which, however, is the main focus of this paper.
In this paper, extend meta-learning to whole new dimension by studying how to quickly train a model (especially a DNN) for a new task using a small dataset with both clean and adversarial samples. Since both meta-learning and adversarial learning have been studied recently, straightfor- ward solution is to simply combine MAML (Finn et al. (2017) algorithm with adversarial training (e.g.. Goodfellow al. (2015)). However, we show such an approach does not work well by our experimental results. We present novel ADversarial Meta-Learner (A (ADML), which utilizes antago- nistic correlations between clean and adversarial samples to let the inner gradient update arm wrestee with the meta- peette to obtain a good and robust initialization of model parameters. Hence, "ad- versarial" in ADMI, refers to not only adversarial samples but also the way of updating the learning model. The design of ADML leads to several desirable properties. First, it turns out to be very effective even in the cases with only clean samples. Second, unlike other meta-learning algorithms, ADML is robust to adversarial samples since it only suffers from a minor performance degradation when encountering adversarial samples, and it outperforms several representative meta-learning al- gorithms (Finn et al. p; /Vinyals et al. (2016); Sung et al. (2018); Bertinetto et al. (2019)) in such cases. In addition, ADML is agnostic to the attack mechanism, which is responsible for the adversarial samples generation. Most importantly, it opens up an interesting research direction and sheds light on dealing with the cases with limited and even contaminated samples, which are com- mon in real life. We conducted a comprehensive empirical study for performance evaluation using two widely-used image datasets, MinilmageNett (Vinyals et al. (2016)) and CIFAR 100 (Krizhevsky al. (2009)). Experimental results well justify the effectiveness and superiority of ADML in terms of both accuracy and robustness.
2 RELATED WORK
Research on meta-learning has a long history, which can be traced back to some early works (Naik & Mammone (1992): Thrun & Pratt Pratt((1988) (1998)) Meta-learning, standard methodol- ogy to tackle few-shot learning problems, has recently attracted extensive attention due to its impor- tant roles in achieving human-level intelligence. Several specialized models (Vinyals et al.] (2016); Koch et al. (2015): Snell et al. (2017); (Sug et al.] (2018)) have been proposed for meta-learning par- ticularly for few-shot classification, by comparing similarity among data samples. Specificallyy, KKoch (Koch
Meta-Learning:
et al. 2015) leveraged a Siamese Networks to rank similarity between input samples and predict if two samples belong to the same class. In addition, Relation Networks (Sung et al. (2018) was proposed to classify query images by computing relation scores, which can be extended to few-shot learning. VVnyyals et al. (2016) presented a neural network model, Matching Networks, which learn an embedding function and use the cosine distance in attention kernel to measure similarity.
Another popular approach to meta-learning is to develop meta-learner to optimize key hyper- parameters (c.g., initialization) of the learning model. Specifically, |Fin al. (017)) presented model-agnostic meta-lcarner, MAML, to optimize the initialization of a learning model with the objective of maximizing its performance on new task after updating its parameters with small number of samples. Several other methods (Andrychowicz et al. (2016); Ravi & Larochelle (2017); Santoro al. (2016): Mishra et al. (2018)) utilized an additional neural network, such as LSTM, to serve as the meta-learner. A seminal work (Andrychowicz et al. (2016)) developed meta-learner based on LSTMs and showed how the design of an optimization algorithm can be cast as learning problem. Ravi & Larochelle (2017) proposed another LSTM-based meta-learner to learn proper parameter update and a general initialization for the learning model. A recent work (Mishra et al.) (018)) presented a class of simple and generic meta-learners that use novel combination of tem- poral convolutions and soft attention.
Adversarial Learning: DNN models have been shown to be vulnerable to adversarial samples. Particularly, (Szegedy et al. (2014) showed that they can cause a DNN to misclassify an image by applying certain hardly perceptible perturbation, and moreover, the same perturbation can cause a different network (trained on a different subset of the dataset) to misclassify the same input. has also been shown by Goodfellow et al. 2015) that injecting adversarial samples during training can increase the robustness of DNN models. Papernot et al. (2017) introduced the first practical demonstration of black-box attack controlling remotely hosted DNN without either the model
2

---

Under review as a conference paper at ICLR 2021
internals or its training data. In addition, Kurakin al. (017)) studied adversarial learning at scale by proposing an algorithm to train a large scale model, Inception v3, on the ImageNet dataset, which has been shown to significantly increase the robustness against adversarial samples.
To the best of our knowledge, meta-learning has not been well studied in the setting with adversarial samples. We not only show straightforward solution does not work well but also present novel and effective method, ADML.
3 ADVERSARIAL
3.1 PROBLEM STATEMENT
The regular machine learning problem seeks model that maps observations x to output y; and a training algorithm optimizes the parameters of the model with a training dataset, whose generaliza- tion is then evaluated on test dataset. While in the setting of meta-learning, the learning model expected to be trained with limited data to be able to adapt to a new task quickly. Meta-learning includes meta-training and meta-testing. In the meta-training phase, we use set T of I tasks, each of which has a loss function L,, and a dataset D; (with limited data) that is further split into D; and D for training and testing respectively. For example, in experiments, each task is 5-way classification task. Note that the 5-way represents 5 different classes.
We aim to develop meta-learner (i.e., learning algorithm) that takes as input the datasets D (D,,... Dr} and returns a model with parameters O that maximizes the average classification accuracy the corresponding testing sets D' (Di:- D'r)- Note that here these testing data are also used for meta-training. In the meta-testing, we evaluate the generalization of the learned model with parameters 0 on new tasks, whose corresponding training and test datasets may include adversarial samples. The learned model is expected to learn quickly from just one (I-shot) or K (K-shot) training samples of new task and deliver highly-accurate results on its testing samples. An ideal meta-learner is supposed to return learning model that can deal with new tasks with only clean samples; and suffers from only a minor performance degradation for new tasks with adversarial samples. We believe the proposed ADML can be easily extended to other scenarios as long as adversarial samples can be properly generated.
3.2 ADVERSARIAL META-LEARNEH (ADML)
We formally present the proposed ADML as Algorithm D for meta-training. We consider a model fo parameterized by 9, which is updated iteratively. Here, updating episode includes inner gradient update process (Line 8-Line 12) and a meta-update process (Line 14). Unlike MAML, for each task, additional adversarial samples are generated and used enhance the robustness for meta- training. Note that our algorithm is not restricted to any particular attack mechanism. Here, we use the Fast Gradient Sign Method (FGSM) proposed by (Goodfellow al. (2015) for illustration. For task Tú given clean sample (Xe. from D4. its corresponding ad adversarial sample (Xados Vadv) is generated using the following equations:
Nadv Xx + esign( Vx. J( Xe.
(1)
y Vodv Ye-
where (féore: Y.) represents the cost used to train a classification model fe,.. parameterized by 0 ppre: and specifies the size of the adversarial perturbation (the larger the the higher the perturbation). Note that the classification model fo.... is pre-trained based on the corresponding dataset and its parameters Opre are fixed during the meta-training (Algorithm) and meta-testing.
The key idea behind ADML is to utilize antagonistic correlations between clean and adversarial samples to let the inner gradient update and the meta-update arm-wrestle with each other to obtain a good initialization of model parameters A which is robust to adversarial samples. Specifically, in the inner gradient update, we compute the new model parameters (updated in two directions) 0 0ndss and 0 based on generated adversarial samples Dadcy and clean samples D., in training set D, of task T, respectively using gradient descent (Line 10). In the meta-update process, we update the model parameters by optimizing the losses Le ( and Li of the model with updated
3

---

Under review as a conference paper at ICLR 2021
Algorithm 1 Adversarial Meta-Learner (ADML)
Require: 01/022 and /1/ The step sizes for inner gradient update and meta-update respec-
tively
2: Require: D: The datasets for meta-training
3: Require: < (.) >: The loss function for task Tú Vi {1....,7)
4: Randomly initialize 0:
5: while not done do
6: Sample batch of tasks < Ti > from task set T;
7: for all T. do
8: Sample K clean samples
". ...., (Xo" (ee }) from D;;
9:
Generate K adversarial samples { (Xaan" F Fedy "),... (Xado K Vade }}} based on another K clean samples from D; to form dataset (Dade, , De, for the inner gradient update, containing K adversarial samples and K clean samples; Compute updated model parameters with gradient descent respectively:
10:
0 0adv. = 0 a VoLi D Dado;): O², == 02 Vo Dr:); Sample & clean samples {xxx", 1, .ye" ",.,, (xo",ye"") }) from D';
Generate l adversarial samples { {Xado' .Yavv ").m ... (Xado k -adv *)} based on another
clean samples from D to form a dataset D adv, D for the meta-update, containing
adversarial samples and & clean samples;
13:
end for
Update 0 = 31 ΣTNT Lilfo'
0= - ETOT Lilfo, Dadr;):
15: end while
parameters 6 Oadv, and 6², with respect to 0 based on the clean samples D in testing set D' of task T and the corresponding adversarial samples D adv; respectively:
min Σ Cilfor... .Da)) min Σ
Volfo-;Vooi(fo.Dae Dey):
TOT
TiNT
min
Σ
LilSo'
D' Dodv,)) min Σ
Ci CC Dade.).
TNT
ToT
Note that in the meta-update, is optimized an adversarial manner: the gradient of the loss of the model with 0 6adv; (updated using adversarial samples Dadv.) is calculated based on clean samples D while the gradient of the loss of the model with 0", (updated using Dz.)) is calculated based on adversarial samples D Dudv.- The arm- wrm-wrestling between the inner gradient update and the meta-update brings an obvious benefit: the model adapted adversarial samples (through the inner gradient update using adversarial samples) is made suitable also for clean samples through the optimization of the meta-update based on the clean samples, and vice versa. So "adversarial" in ADML refers to not only adversarial samples but also the way of meta-training. Please note that in Line 9, the set of adversarial samples Dadv; can be generated exactly from the set of clean samples De., and it also holds for Dade, and D',, in Line 12.
The meta-update of the model parameters O performed the last step of each episode (Line 14). Through the arm- wre-wreslling between the inner gradient update and the meta- meta-update in the meta- training phase, 0 will be updated a certain point, such that the average loss given by both adver- sarial samples and clean samples of all the tasks is minimized. In addition, we set the step sizes 0n = 02 0.01, 31 = 32 0.001, and set (.(-) of each classification task Te to be the cross- entropy loss. K and As are task tssc-spe, whose settings are discussed in the next section. Note that ADML preserves the model-agnostic property of MAML because both the inner gradient update and the meta-update processes are fully compatible with any learning model that can be trained by gradient descent.
We further illustrate the design philosophy of algorithm in Figure I For each task T. in the inner gradient update, ADML first drags via gradient descent to the direction of the subspace that favorable for adversarial samples (marked with the purple color) well another subspace that
4

---

Under review as a conference paper at ICLR 2021
Subapace favorable for clean sumples
Subspace favorable for adversarial samples Meta-update
0,"
Inner gradient update
VoL.V, Dady) On
VoLiVas., D2)
aa
VeLi(foDDe)
Vo VoL, JoLi Dadri)
Figure 1: Illustration of design philosophy of ADML
favorable for clean samples (marked with the red color) to reach two points 6 6adv, and 6', respec- tively (i.e., Line 10). Then in the meta-update, based on O adv; and 0', ADML further optimizes O to antithetic subspaces respectively (i.e., Line 14), and hopefully 0 can reach the optimal point 07 which is supposed to fall into the intersection of the subspace pair and is able to achieve good trade-off between clean and adversarial samples to boost the overall performance on both samples. Note that here only show the updates via single task. Using all the tasks in TT, O can be opti- mized to a point with the smallest average distance to the intersections of all the subspace pairs, and thus can be quickly adapted new tasks even with adversarial samples.
As mentioned before, a rather straightforward solution to the above adversarial meta-learning prob- lem is simply combine a meta-learner (e.g., MAML Finn et al. (2017) with adversarial training (e.g., Goodfellow et al. (2015).. Specifically, we mix adversarial and clean samples to form both D. (used the inner gradient update) and D (used in the meta-update), which are then used to calculate 02 and update using the following equations (just like MAML) respectively:
0 aVo. D.):
0 0 - v Σ c. D.). T:-T
We call this method MAML-AD, which is used as a baseline for performance evaluation. However, it has been shown by experimental results that although MAML-AD can slightly mitigate the problem. it still suffers from a significant performance degradation for new tasks with adversarial samples. This clearly shows that simply involving adversarial samples during the meta-training does not necessarily enhance the model's 's robustness; and well justifies that our idea of doing the inner gradient update and the meta-update in an adversarial way is necessary.
PERFORMANCE EVALUATION
The goal of our evaluation is to test and verify three properties of ADML: 1) ADML can learn quickly from limited data via few gradient updates for new task, and it is effective even in the cases with only clean samples; 2) ADML suffers from a minor performance degradation and yields much better performance than other meta-learning algorithms when encountering adversarial sam- ples; 3) ADML works with adversarial samples generated by different attack mechanisms; and 4) ADML maintains stable performance when the perturbation of adversarial samples (i.e., c) escalates. In this section, we first introduce the experimental setup, and then present and analyze the results.
4.1 EXPERIMENTAL SETUP
In our experiments, employed two commonly-used image benchmarks, MinilmageNet (Vinyals) et al. (016)), and 100 (Krizhevsky et al. (2009)). MinilmageNet is a benchmark for few- shot learning, which includes 100 classes and each of them has 600 samples. CIFAR100 was cre- ated originally for object recognition tasks, whose data are suitable for meta-learning, and same as MinilmageNet, it has 100 classes, each of which contains 600 images. Both MinilmageNet and
5

---

Under review as a conference paper at ICLR 2021
CIFAR 100 were divided into 64, 16 and 20 classes for training, validation and testing respectively. Here we consider 5-way 1-shot and 5-way 5-shot classification tasks. 5 samples per class were used for the inner gradient update during meta- meta-training of 5-shot learning model (1 sample for 1-shot learning model). Thus, K in ADMI. was set to 25 for 5-shot learning and for 1-shot learning. 15 samples per class were used for the meta-update, thus we set k 75. During the meta-testing, the learning model was trained on samples of unseen classes, then tested by classifying new instances into these classes.
Attack mechanisms including FGSM (Goodfellow et al. (013 ). FFGSM (Wong et al. (0200)
RFGSM (Tramer et al. (2017) and RPGD (Madry et al. (2017)) )) were leveraged to generate ad- versarial samples in the experiments. A well-trained VGGI6 network (pre-trained on ImageNet and CIFAR 100 respectively) for image classification served as the fixed classification model. To validate the performance of ADMI with both dtrongly-attacke and slightly-attacked samples, the parameter c was set to a large value (i.e., 2) and a small value (i.e., 0.2) for FGSM for both meta-training and meta-testing. See values of set for the other three attack mechanisms in supplementary material.
ADML was compared with four representative meta-learning algorithms, including MAML (Finn) et al. (2017), Matching Networks (Vinyals et al. (2016)), Relation Networks (Sung et al. (2018) and R2D2 (Bertinetto et al. (2019).. Moreover, for fair comparisons, we compared ADML with another adversarial meta-learne MAML-AD (introduced in Section 3), which can be considered as a rather straightforward extension of MAMI.
4.2 EXPERIMENTAL RESULTS
To fully test the effectiveness of ADML, we conducted a comprehensive empirical study, which cov- various possible cases. The experimental results on MinilmageNet and CIFARI00 with FGSM attack mechanism are presented in Tables 2 and Tables 3-4 (in supplementary material) respec- tively. Experimental results on Minilmage with the other three attack mechanisms (i.e., FFGSM, RFGSM and RPGD) are shown in Tables 5-10 (in supplementary material). Each entry in these ta- bles gives the average classification accuracy (with 95% confidence intervals) of the corresponding test case, and the best results for each test case are marked in bold.
The experiments were conducted in six different test cases (combinations): "Clean-Clean", "Clean-Adversariaa. "Adversarial-Clear Adversarial". The first part of each combination (corresponding to row) represents the training data used in the inner gradient update (or support set for Matching Networks and Relation Net- works) during the meta-testing, while the second part (corresponding to a column) represents the testing data (or query set for Matching Networks and Relation Networks) for evaluation. "Clean" means clean samples only; "Adversarial" means adversarial samples only; and "40%" means that 40% samples of each class are adversarial and the rest 60% are clean, which represents intermediate cases. Note that the combinations, "40%-Clean" and -40e--Avvrrrriia"", do not exist for 1-shot learning since there is only one sample per class. Based on the results in Tables we can make the following observations:
aadhersariallAddvrsarrii
-40%-Clear and "40%
1) Just like MAMI., ADML is indeed an effective meta-learner since it leads to quick learning from a small amount of new data for a new task. In the "Clean-Clean" cases, the general condition of meta-learning, ADML delivers desirable results, which are very close to the state-of-the-an given by R2D2, Relation Networks and MAML, and consistently better than those of MAML-AD and Matching Networks. For example, in the case of 5-way 1-shot classification with e 2 (Table TT. ADML gives an average classification accuracy of 48.00% which is very close to that given by R2D2 (i.e.. 49.52% and 51.80%) Relation Networks (49.67%) and MAML (48,47%) and it performs better than MAML-AD (43.13%) and Matching Networks (43.87%). Note that the proposed ADML focuses on the cases with adversarial samples, and it is reasonable that it performs slightly worse on the cases with only clean samples.
2) ADML is robust to adversarial samples since it only suffers from a minor performance degra- dation when encountering adversarial samples. For example, for the 5-way 5-shot classification with ε = 2 (Table 2). ADML gives classification accuracies of 57.03%, 58.06%, 55.27%, 58.12%. 12% and 55.22% in the five test cases respectively. Compared to the "Clean-Clean case (i.c., 59.38%), the performance degradation is only 4.16% in the worst-case and 2.64% on average. However, the classification accuracies given by the other meta-leamiig algorithms, including MAML-AD, drop

---

Under review as a conference paper at ICLR 2021
Table 1: Average classification accuracies MinilmageNer with FGSM Attack (5-way, 1-shot)
0.2
Method
Backbone
Meta-testing
Clean
Adversarial
Clean
Adversarial
Clean
28.63:11.544
48.47=1.78%
42.13:11.599
MAMI.
32-32-32-32
Adversarial
28.93 1.62%
30.73++ 1.66%
42.23+ 1.85%
40.17+ 1.76%
Clean
13.13--188%%
32.33:+
43.13= 1.88%
36.80+1.76%%
MAML-AD
32-32-32-32
Adversarial
32.47=11.60%
37.87
07.63=1.64999
37.13311.755
Clean
43.87.10.41%
30.02.10.399
43.88=00448%
36.14:10.409
Matching Nets
64-64-64-64
Adversarial
30.45=0.444%
30.80++0.43%
36.58=0.49%%
35.03++0.39%
Clean
49.67=0.85%
32.32:+:0.58%
49.45=0.844%
43.03-+0.7444
Relation Nets
64-96-128-256
Adversarial
32.99%1..7%%
32.85.10.63%%
42.98 42.98-0..559
40.89 79%
Clean
1..52.
25.80.1 1.06%
49.52.1 1, 1.70%
41.24.1 1.2411..411
R2D2 (64C)
64-64-64-64
Adversarial
28.35=1.57%
30.94::1.199
40.94=1.6755
18.74+1.39%
Clean
51.00=1.70%
25.95=+0.88%
51.80=1.70%%
42.74=+1.305
R2D2
96-192-384-512
Adversarial
29.66
31.39.1..149
43.27 1.81%
399.6.1:1.577
Clean
48.00 1.8%%
43.00 %
48.00 1.87%
43.20:1: 1.70%
ADML (Ours)
32-32-32-32
Adversarial
40.10=1.73%%
40.70=1..44%
44.00=1.83%
1..50:::1.75%
Table 2: Average classification accuracies on MinilmageNet with FGSM Attack (5-way, 5-shot)
0.2
Method
Backbone
Meta-testing
Clean
Adversarial
Clean
Adversarial
Clean
61.45.10.11% %
06.85.10.88%
61.47-00.1%
53.05.10.864
MAML
32-32-32-32
40%
56.74=0.93%
43.05:+0.866
59.25=0.91%
54.67:0.9195
Adversarial
41.49=00.5%%
45.46:t0.97%
55.19=0.95%
53.33-10.925%
Clean
17.13.10.96%
41.65.10.92%
57.09-0.96%
49.71:10.88%
MAML-AD
32-32-32-32
40%
0..94:10.91%
5.952.0..0%%
52.08.10.999
Adversarial
40.21=
52.07:
51.23=0090%
51.36:20.944 94%
Clean
00.4%%
33.73-1...39
0..55=0.44%%
44.91:1:.4000
Matching Nets
64-64-64-64
40%
49.88
35.67++0.44%
52.72-0.45%%
45.45++0.42%
Adversarial
36.24=0.45%
37.91110.405
47.77=0.45%
46.19910.4449
Clean
63.85%
38.37:10.64%
63.86=0073%%
55,39100.60 68%
Relation Nets
64-96-128-256
40%
56.53+0.77%%
41.04+00.67%
59.02-0.700
55.06++0.68%
Adversarial
42.74.0.79%%
46.08:10.63%
56.85=0.73%
53.65400.69
Clean
6..5%
1.22%
65.48_1.35%%
51.60111.22 .24%
R2D2 (64C)
64-64-64-64
40%
59.28
40.33++1.204
62.08 1.49%
54.56+1.2294
Adversarial
36.07%1.59%%
43.00:11.38%%
55.27=1.619
$3.97-11.320
Clean
68.42.11.288
29.95.11.119
68.42
1.28%
54.60
R2D2
96-192-384-512
40%
61.11+11.66%
40.38:+ 1.35%
64.27
1.46 %
56.93++1.369
Adversarial
3..6%
44.07:11.36%
58.53 1.68%
$5.71:11.399
Clean
59.38.10.99%
57.03 %
61.28
58.33.1 0.96 %
ADML (Ours)
32-32-32-32
40%
18-00.009
55.22-+0.988 %
60.09=0.899%
59.13-+00.25%
Adversarial
58.06.10.96%
55.27-10.22%
59.02 0.88%
57.74.10.93%
substantially when there are adversarial samples. For example, for MAMI,, the accuracy drops from 61.45% ("Clean-Clean") to 36.65% "Clean-AAversarria" when injecting adversarial samples for lesting, which represents a significant degradation of 24.80 4480% Similar observations can be made for MAML-AD, Matching Networks, Relation Networks, R2D2 (64C) and R2D2, which represent substantial degradations of 15.48% 22.26%, 25 25.48%, 36. 14% and 38.47% respectively.
3) ADML generally outperforms all the other meta-learning algorithms in the test cases with adver- sarial samples. For instance, in the "dvers-advasarria""" cases of 5-way 5-shot learning with = 2 (Table P. ADML achieves an accuracy of 57.0 57.03%, which represents 20.38%, 15.38%, 23.30%, 18.66%, 27. 77.69% and 27.08% improvements over MAML, MAML-AD. Matching Networks, Re- lation Networks, R2D2 (64C) and R2D2 respectively. This clearly shows the superiority of the adversarial meta-training procedure of the proposed ADML compared to MAML-AD, the straight- forward adversarial meta-learner. Even so, MAML-AD still generally performs better than the rest meta-trainin algorithms. when dealing with adversarial samples. Note that exception occurs in the case "40%-Clean", where the accuracy of ADML is slightly lower than that R2D2, even with 40% adversarial samples. This implies that in the 5-shot learning cases with adversarial samples,

---

Under review as a conference paper at ICLR 2021
Clean Clean
Clean Adversoris
Adversafial-Cion
Adversar al Adversaii
mora
Wei AC
MARL-AD
MAMLAO
HOPL-G 40
Auerage 10
20Gann 200
Number Gradient
Number Inner Gradient
Number of Inner Gradiont
Number Gradient
Figure 2: Average loss over the gradient update step for 5-way 1-shot learning on MinilmageNet
6.50
Clean Clean
Clean-ddveririill
Adversarial-Cane
Adversarisl.
4.45
0.40
0.40
Averinge Ancureey
6.40
0.35
6.35
Agergge
5.30
5.35
MANIL
HAMLLNC
MAPLLAD
c.00
0.20
0.00
10
8
10
Number of Inner-Grodiont Stops
Number Findr-Gradient Stops
Number Inner-Gradient Stops
Number Irnen Gradient Stops
Figure 3: Top-1 I accuracy over the gradient update step for 5-way 1-shot learning on MinilmageNet
the clean samples (even with a number smaller than 5) in the training data play an important role when classifying the testing data composed of clean samples.
4) When the perturbation of adversarial samples escalates, ADMI, maintains stable performance. For example, for 5-way 1-shot learning, when increases from 0.2 to 2 (Table D ADML only leads to minor degradations of 0.2%, 3.9% and 0.5% in the corresponding three cases involving adversarial samples. However, much more significant degradations can be observed when the other meta-learning algorithms are applied. For instance, the accuracies of MAML suffer from 13.50%, 13.30% and 9.44% drops in these three cases when increasing c from 0.2 to 2.
5) As expected, when lower perturbations exerted, the adversarial samples are not significantly dif- ferent from the corresponding clean samples, which brings about relatively close results in different test cases, not only for ADML, but also for the other meta-learning algorithms. For instance, for the 5-way 5-shot classification with 0.2 (Table 2). MAML gives a smaller gap of 8.42% between "Clean-Clee" Creann" and "Clean Adversaria"""" compared with that of 24.80% when e = 2.
Similar observations can be made for the results corresponding to CIFARIOO and the other three attack mechanisms (fi.e., Tables 3-10 in supplementary materials)). In addition, we show how the loss and Top-1 accuracy change in Figures [ and 3 during the meta-testing. Specifically, these two figures show that when ADML, MAML and MAML-AD are applied on MinilmageNet, how the losses and Top-1 accuracies change with the gradient update step during the meta-testing in the four test cases of 5-way 1-shot learning with
2. We observe that, for all the cases, the losses of the models learned with ADML drop sharply after only several gradient updates, and stabilize small values during the meta-testing, which are generally lower than those of the other two methods. Moreover, the Top-1 accuracies of the models learned with ADML rise sharply after only several gradient updates, and stabilize at values, which generally higher than those of the other two methods (a little bit lower than that MAML in "Clean-Clean" case). Similar trends can be observed in Figures 4-5 in supplementary materials for 5-way 5-shot learning with observations further confirm that ADML is suitable for meta-learning since it can quickly learn and adapt from small data for new task through only a few gradient updates.
These
CONCLUSIONS
In this paper, we proposed a novel method called ADML (ADversarial Meta-Learner) for meta- learning with adversarial samples, which features adversarial way for optimizing model param- eters 0 during meta-trane veea-training through the are-wlestlig between inner gradient update and meta- update using both clean and adversarial samples. The extensive experimental results have showed
8

---

Under review as a conference paper at ICLR 2021
that 1) ADML is effective meta-learner in the cases with only clean samples; 2) straightfor- ward adversarial meta-learner, namely, MAML-AD, does not work well with adversarial samples; in addition, 3) ADML is robust to adversarial samples generated by different attack mechanisms, and outperforms other meta-learning algorithms including MAMI on adversarial meta-learning tasks; and most importantly, 4) opens up interesting research direction and sheds light on dealing with the difficult cases with limited and even contaminated samples.
REFERENCES
Marcin Andrychowicz, Misha Denil, Sergio Gomez, Matthew W Hoffman, David Pfau, Tom Schaul, Brendan Shillingford and Nando De Freitas. Learning to learn by gradient descent by gradient descent. In NIPS, pp. 3981-3989, 2016.
Luca Bertinetto, Joao F. Henriques, Philip Torr, and Andrea Vedaldi. Meta-leaming with differen- tiable closed-form solvers. ICLR, 2019.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-leaming for fast adaptation of deep networks. In ICML, pp. 1126-1133 JMLR. org, 2017.
Micah Goldblum, Avi Schwarzschild, Naftali Cohen, Tucker Balch, Ankit B Patel, and Tom Gold- stein. Adversarial attacks on machine learning systems for high-frequency trading. arXiv preprint 205V020002.09565, 2020.
lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Gregory Koch, Richard Zemel, and Ruslan Salakhutdinov. Siamese neural networks for one-shot image recognition. In ICML, volume 2. Lille, 2015.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning scale. In ICLR, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.006 06083, 2017.
Nikhil Mishra, Mostafa Rohaninejad, Xi Chen, and Pieter Abbeel. A simple neural attentive meta- learner. In ICLR, 2018
Devang Naik and Richard Mammone. Meta-neural networks that learn by learning. In IJCNN, volume 1, pp. 437-442. IEEE, 1992.
Nicolas Papernot, Patrick McDaniel, Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Asia CCS, pp. 506-519, 2017.
Sachin Ravi and Hugo Larochelle. Optimization as a model for few-shot learning. In JCLR, 2017.
Parsa Saadatpanah, Ali Shafahi, and Tom Goldstein. Adversarial attacks on copyright detection systems. arXiv preprint 13Xiv:190.007133, 2019.
Pouya Samangouei. Maya Kabkab, and Rama Chellappa. Defense gan: Protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv: 2018.
Adam Santoro, Sergey Bartunov, Matthew Botvinick, Daan Wierstra, and Timothy Lillicrap. Meta- learning with
neural networks. In ICML, pp. 1842-1850, 2016.
Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for shot learning. In NIPS, pp. 4077-4087, 2017.

---

Under review as a conference paper at ICLR 2021
Flood Sung, Yongxin Yang, Li Zhang, Tao Xiang, Philip HS Torr, and Timothy M Hospedales. Learning to compare: Relation network for few-shot learning. In Proceedings of the IEEE CVPR, pp. 1199-1208, 2018.
Christian Szegedy, Wojeiech Zaremba, Iya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Sebastian Thrun and Lorien Pratt. Learning to learn. Springer Science & Business Media, 1998.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Bonch, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint wrXiv:705.002044 2017.
Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al. Matching networks for one shot learning. In NIPS, pp. 3630-3638, 2016.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint urXiv:2001.085 .03994, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. arXiv preprint arXiv:1901.08572 2019.
Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen. Seeing isn't t believing: Practical adversarial attack against object detectors. arXiv preprint arXiv: 2018.
10


Reviews:
[{"review_id": "soPqPBoJP8s", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary\n\nThis paper presents a variant of MAML that aims to make the meta-learned initialisation robust to adversarial examples. The core idea of the proposed method, ADML, is to compute two task-specific parameters in the inner-loop: one on clean data and one on adversarial data. In the meta-learning step, the clean task-specific parameters are meta-learned on adversarial data while the adversarial task-specific parameters are meta-learned on clean data. The authors demonstrate robustness to a range of adversarial attacks on miniImagenet.\n\nPros:\n- As far as I'm aware, this is the first proposal to meta-learn for adversarial robustness\n- Method is agnostic to the model and the form of adversarial attack\n- Reported results demonstrate robustness to a range of adversarial attacks\n\nCons:\n- The method is not really explored in any depth\n- The method is limited to MAML\n- Considered attacks are relatively weak [see 1]\n\nRecommendation: rejection\n\nMotivation:\n\nWhile the idea of adversarial meta-training is well motivated and generally sound, the specific method in this paper is primarily proposed and not really explored in any depth. The authors demonstrate that a simple approach of mixing adversarial and clean data in the usual MAML update doesn't work very well, but don't go in to any details as to why this failure motivates their method. In particular, ADML formulates *two* task optimisation problems (Eq. 2) for the same variable (the initialisation) - one is adaptation under clean data and one under adversarial data. While intriguing, I'm missing a motivation: why would we want to consider two independent adaptation trajectories under best / worst case scenario, and not one trajectory under mixed data? \n\nGiven that ADML formalises two independent optimisation problems over the same variable, it is not at all clear how they should be combined. The algorithm itself does not indicate how this is done, the text indicates that the losses are simply averaged? If so, that induces a specific optimisation problem that is neither of the two presented in Eq. 2. Have you considered what what that optimisation problem looks like?\n \nPerhaps the least obvious choice in ADML is to swap clean and adversarial data in the meta-update. While interesting, there is no apparent explanation for this and as a reader I would like to know what motivates this design choice and how much it really matters. Given that the experimental section is restricted to miniImagenet only, some form of simple analysis would have gone a long way to shed light on the proposed method. I would have liked to see an ablation on the design choices of ADML to gain insight into which of these are responsible for the observed performance gain.\n\nFinally I have a concern with the evaluation protocol: the algorithm suggests that adversarial examples are generated by drawing a fresh batch of data. In a K-shot regime, does this mean that you draw two batches of K samples per task adaptation? This would mean that ADML see twice as much data and result in unfair comparisons.\n \nMinor issues\n- There are several grammar and spelling mistakes that makes the paper look rushed (pages 1, 2, 3)\n- In the motivation, the authors use the phrase 'arm-wrestle'. What is meant by this analogy?\n- Problem statement: a meta-learner (at least MAML) does not take several datasets as input, only one at a time.\n- why are adversarial examples generated from a different batch of task data? Could they not be generated from the same batch?\n- Algorithm: (1) the variables \\bar{D} are never used and (2) L14 makes a nonsensical double assignment to \\theta.\n- Figure 1: the meta-update arrows should originate in the initialisation since that is what they are updating.\n- Experimental setup: you mention that 15 adversarial attack mechanisms where leveraged in the experiments, but the tables suggests that you only use 1 (at a time)?\n- Why does MAML-AD do worse on clean-clean? Should it not be exactly equivalent to MAML in this case?\n\nTypos:\n- \"none of existing works have well addressed\" -> \"existing works have not yet addressed\"\n- \"which, however, are\" -> \", which is\"\n- \"an existing meta-learning algorithms\" -> \"[...] algorithm\"\n-  \"we show such a approach\" -> \"we show such an approach\"\n- \"testing dataset\" -> \"test dataset\"\n- \"In the meta-training\" -> \"In the meta-training phase\" \n\nPost Rebuttal\n\nI have read the authors rebuttal and updated manuscript. The authors have taken some steps to clarify parts of the manuscript, but my main concerns remain and thus my score is unchanged. In particular, the authors did not clarify how the two optimisation problems in Eq. 2. relates and what this means algorithmically. The authors defend their empirical setup by stating that meta-testing is still K-shot. While this is true, it is also true that their method have enjoy a greater amount of meta-training compared to baselines. What I would have liked to see is an ablation that trains the baselines for 2x meta-updates, but this is unfortunately not provided. \n\nEchoing other reviewers, if stronger attacks are considered, these should not be relegated to appendix. \n\nReferences\n[1] Goldblum et. al. Adversarially Robust Few-Shot Learning: A\nMeta-Learning Approach. 2020.", "extra_scores": {}, "extra_text": {}}, {"review_id": "bqExpiExlE", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper presents ADML (ADversarial Meta-Learner), a method for general meta-learning when adversarial samples are present. In a sense, ADML extends MAML to deal with adversarial/contaminated samples in training. Building on top of MAML, the key insight is to validate or ground the model's updates from both angles: 1) to ground the parameter update from clean examples onto an adversarial set; 2) to ground the parameter update from the adversarial examples onto a clean set. Experimental evaluations on MiniImageNet and CIFAR 100 demonstrates the good performances of ADML over a series of meta-learning baselines. In addition, it's also shown that simply creating a mixed dataset with both clean and adversarial examples (i.e., MAML-AD) does not fully address the adversarial signals, thus validating the key insights of the two-way \"cross-grounding\" technique.\n\nThe paper is well written and the extension of MAML onto the adversarial setting is simple yet effective. One minor comment regarding the evaluation though is that there could a couple more ablation studies for ADML. For example, how sensitive is the ADML to the learning rates for the outer objective? Also for the clean-clean case, since MAML still performs slightly better than ADML, is it possible to modify/extend ADML such that it will still match MAML's performance when there's no adversarial examples in the training set?", "extra_scores": {}, "extra_text": {}}, {"review_id": "azsy_86AqSB", "reviewer": "AnonReviewer5", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "### Contributions ###\n* The authors study a new kind of problem, the robustness of few-shot learners against adversarial attacks \n* The paper propose a new meta-learning algorithm ADML that uses adversarial and clean examples during meta-training (both for train-train and train-test). \n\n### Significance ###\nCombining meta-learning with adversarial robustness is an interesting research direction that might inspire follow-up work. However, it remains unclear if any practical applications would benefit from adversarially robust few-shot learners. A clearer motivation would be desirable.\n\n### Originality ###\nIn principle, combining gradient-based meta-learning such as MAML with adversarial training (similar to the proposed baseline MAML-AD) is a natural fit that does not require novel research. The novel methodological contribution of ADML is that meta-train-train is done separately for clean and adversarial examples and that meta-train-test evaluates the loss of the adversarially trained parameters on clean train-test data (and vice versa). While this is an interesting idea and empirical evidence seems to support this idea (see below for some major caveat), the paper lacks any theoretical justification for ADML. At least a well motivated intuition would be required.\n\n### Clarity ###\nSome details remain unclear:\n* From Algorithm 1, it seems that 2K samples are used for meta-train-train and 2k for meta-train-test, because clean and adversarial examples are constructed based upon different samples. This would make it an uneven comparison to standard meta-learning, that would do actual K-shot training.\n* For adversarial attacks like PGD, hyperparameters like step-size and number of steps are not stated\n\n### Quality ###\nThe paper does not follow established procedures for evaluating adversarial robustness:\n* the threat model is not clearly stated\n* the main evaluation in the paper is done based upon a weak attack, namely FGSM\n* most importantly, the authors are using only transfer attacks for robustness evaluation (and also during meta-training). That is: adversarial examples are computed based upon a pretrained network  (paragraph after Equation 1). This is not at all motivated; the natural thing would be to compute adversarial examples always based on the current model (\\theta in Algorithm 1)\n\nIn summary, the presented results need to be taken with care because all observed effects might be due to using weak attacks. \n\n### Recommendation ###\nBecause of the lack of motivation for adversarial meta-learning, lacking intuition for ADML, and particularly the robustness evaluation against a very weak attack, the paper is a clear reject to me.\n\n### Recommendation after Author Response ###\nI have read the authors response and appreciate the clarification by the authors. I was aware that other attacks (FFGSM, RFGSM, RPGD), were in the supplementary material. However, I don't see any reason for focusing on the particularly weak FGSM in the main paper. The main evaluation should always be based on the strongest not the weakest attack. Moreover, also RPGD was used as a transfer attack and as such is quite weak. \nIn summary, I keep my recommendation of rejecting the paper.", "extra_scores": {}, "extra_text": {}}, {"review_id": "QnZLt90q4SV", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper focuses on few shot learning with adversarial training samples in both during meta-training and meta-testing phases. The paper builds their model on top of MAML with an addition of a unique training scheme that interchanges adversarial and clean examples of tasks used in inner gradient and outer gradient optimization of MAML. Instead of mixing up clean and adversarial examples in both inner gradient optimization and outer gradient optimization the paper suggests using them in a mutually complementary fashion. Here, the core idea is to estimate the target initial MAML model such that when the model updated with clean support examples is robust against adversarial query samples, and vice versa.\n\nThe paper is overall definitely interesting because adversarial attacks in few-shot learning is not a studied topic, to the best of my knowledge, and the proposed approach appears to be effective, especially compared to a meaningfully-defined baseline called MAML-AD. \n\nHowever, the paper suffers from three main shortcomings. First, only FGSM is used as the adversarial sample generation method and other well-known techniques are not considered. It could have been much better to incorporate several other well-established attack techniques.\n\nSecond, the paper presumes that the same attack technique is being used during training & testing. This is hardly a realistic assumption. It could have been definitely interesting to see the robustness of the ADML model when it is attacked by a different model at test time (in generation of query and/or support samples of few-shot classes).\n\nThird, some simple & directly applicable defense methods, such as local spatial smoothing, are not considered. Such techniques could have been used to define additional baselines.\n\nTo sum up:\n\nPros:\n- Paper is well written, gives sufficient background information and states the ideas clearly,\n- Defines & tackles a novel problem,\n- Reports promising results.\n\nCons:\n- Only FGSM is being evaluated as the adversarial example generation method.\n- The same attack approach (FGSM) is used for both training and testing. \n- Existing defense techniques are not utilized.\n- Although intuitively & experimentally ADML is convincing compared to MAML-AD, the theoretical justification is weak. (This is a rather minor point as most state-of-the-art methods in FSL & adversarial attacks are explained only intuitively)\n- It is unclear why (only) matching nets & relation nets are being considered as baselines, other (more) recent methods could have been evaluated for robustness, \n\nFinally, minor points: there is a typo on P1 (\"decent\") and the works on adversarial attacks on related problems, such zero-shot learning, can be included into the discussion for completeness.\n\nPost-rebuttal: I'd like to thank the authors for the rebuttal and for pointing out some additional results that I had initially missed. While they're definitely welcome, it is still not clear to me why the main work is based on FGSM and why simple defense techniques have not been considered, both of which significantly weaken the manuscript.  I also see that very similar concerns have been raised in the other reviews , confirming that these weaknesses of the manuscript are quite salient. ", "extra_scores": {}, "extra_text": {}}, {"review_id": "KL3fCuB2Zt", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summarization of the contribution:\n\nThis paper presents a novel ADversarial Meta-Learner (ADML), the claimed first work that tackles adversarial samples in meta-learning. In its core algorithm, a given model is diverged simultaneously by a set of clean  samples and a set of perturbed counterparts to generate two inner models, which are then meta-updated in an adversarial manner using new sets of clean/adversarial samples.\n\n\nStrengths:\n\nThe paper addressed an important topic in meta-learning, i.e., meta-learning with adversarial samples. On two datasets, the experiments, especially the ablation studies (page 6), are carefully designed, and the results were also discussed\n in detail (page 7-8).\n\n\nWeaknesses:\n\n1. The paper gives no sensitivity analysis of the hyper-parameters. For example, on page 4, \\alphas and \\betas were set at different values but no reason was given.\n\n2. There is neither open-sourced code nor plan for releasing the code in the paper. Thus, it is questionable whether the proposed method is reproducible.\n\n3. The idea of combining meta-learning with adversarial defense has already been proposed and well studies, such as in \"Adversarial Attacks on Graph Neural Networks via Meta Learning, ICLR 2019\".\n\n4. The experiments are not thoroughly conducted. MiniImageNet and CIFAR100 are all small scale datasets with only 60k samples each. Indeed, image classification is an important task and a benchmark for meta-learning. Still, it would be more informative to test the proposed method with multiple types of data, say graph data as mentioned above.\n\n5. Meta-learning, by its definition, is a learning framework, which is not necessarily tantamount to few-shot/one-shot learning, and is different from the latter in many ways. However, the whole experiment section has focused on few-shot learning using classic few-shot learning tasks. This gives us an impression that the title \"adversarial meta learning\" is somewhat misleading. Actually, a recent work \"Adversarially Robust Few-Shot Learning: A Meta-Learning Approach, NeurIPS 2020\" adopted\n nearly the same setting and datasets and achieved superior results.\n\n6. Another main problem is that there was, unfortunately, no theoretic analysis on the proposed algorithm, but only some intuition behind its design. It would be interesting to dive deeper, mathematically, to show how the algorithm\n works under the hood and to be more confident about where and when it holds true.\n\n\nRecommendation and reason: Weak Reject.\n\nOverall, this is a good paper.  However, it is a little bit below the standard of ICLR, considering its novelty, experiments, writing, and depth of analysis.\n\n\nAdditional comments:\n\n1. The language of the paper needs to be polished and refined.\n2. Page 1: it is better to rephrase the sentence about MAML to give a clearer description of it.\n3. Page 3: each task is a 5-way classification task: it is better to explain what is a \"5-way\" task for the readers who are not familiar with few-shot learning.\n4. Page 6: the paper considered several attack mechanisms including FGSM, FFGSM, RFGSM, and RPGD. But in reality, the attacker may not divulge the mechanism to be used. So can this method be attack mechanism-agnostic\n i.e. be resistant to an attack without having known the mechanism in advance?", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes a new meta-learning algorithm which promises greater robustness to adversarial examples. I will be brief, as the fault with the paper is quite clear: the experimental results are not sufficient. The attack used (FGSM) is particularly dated and weak, and the comparison to existing defences is insufficient. Additionally, prior work (Adversarially Robust Few-Shot Learning: A Meta-Learning Approach) obtains better results, and is not compared against. The reviewers provided further criticism regarding the motivation for and explanation of the method, but the empirical aspects of the paper are where it primarily falls short of the publishable standard for ICLR.

I recommend rejection, and invite the authors to consider demonstrating robustness to a wider range of attacks (including non-gradient based), and a more thorough comparison to defence methods, before resubmitting to another conference.
Decision: Reject