On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learning
Authors: Ren Wang
Kaidi Xu
Sijia Liu
Pin-Yu Chen
Tsui-Wei Weng
Chuang Gan
Meng Wang
Venue: ICLR 2021 Poster (2021)

Abstract: Model-agnostic meta-learning (MAML) has emerged as one of the most successful meta-learning techniques in few-shot learning. It enables us to learn a $\textit{meta-initialization}$ of model parameters (that we call $\textit{meta-model}$) to rapidly adapt to new tasks using a small amount of labeled training data. Despite the generalization power of the meta-model, it remains elusive that how $\textit{adversarial robustness}$ can be maintained by MAML in few-shot learning. In addition to generalization, robustness is also desired for a meta-model to defend adversarial examples (attacks). Toward promoting adversarial robustness in MAML, we first study $\textit{when}$ a robustness-promoting regularization should be incorporated, given the fact that MAML adopts a bi-level (fine-tuning vs. meta-update) learning procedure. We show that robustifying the meta-update stage is sufficient to make robustness adapted to the task-specific fine-tuning stage even if the latter uses a standard training protocol. We also make additional justification on the acquired robustness adaptation by peering into the interpretability of neurons' activation maps. Furthermore, we investigate $\textit{how}$ robust regularization can $\textit{efficiently}$ be designed in MAML. We propose a general but easily-optimized robustness-regularized meta-learning framework, which allows the use of unlabeled data augmentation, fast adversarial attack generation, and computationally-light fine-tuning. In particular, we for the first time show that the auxiliary contrastive learning task can enhance the adversarial robustness of MAML. Finally, extensive experiments are conducted to demonstrate the effectiveness of our proposed methods in robust few-shot learning.

Published as a conference paper at ICLR 2021
ON FAST ADVERSARIAL ROBUSTNESS ADAPTATION IN MODEL-AGNOSTIC META-LEARNING
Ren Wang! Kaidi Xu²
Sijia Liu
Pin-Yu Chen?
Tsui- Ssi Weng? Chuang Gan
Meng Wang'
Rensselaerr Polytechnic Institute, USA
NNrtheeattern University, USA "MIT-IBM Watson AI Lab. IBM Research, USA "University Michigan, USA
Michiiga State University, USA
ABSTRACT
Model-agnostic meta-learning (MAML) has emerged cessful meta-learning techniques in few-shot learning. enables us to learn meta-iniifalizztiin of model parameters (that call meta-model) to rapidly adapt to new tasks using a small amount of labeled training data. Despite the generalization power of the meta-model. it remains clusive that how adversar- ial robustmess can be maintained by MAML in few-shot learning. In addition to generalization, robustness is also desired for meta-model to defend adver- sarial examples (attacks). Toward promoting adversarial robustness in MAML, we first study when a robustness- prommneinni regularization should be incorpo- rated, given the fact that MAML adopts a bi-level (fine-tuning vs. meta-update) learning procedure. We show that robustifying the meta-update stage is suffi- if
of the most suc-
cient to make robustness adapted to the task-specific fine-tuning stage the latter uses a standard training protocol. We also make additional justifi- cation the acquired robustness adaptation by peering into the interpretabil- ity of neurons' activation maps. Furthermore, we investigate how robust reg- ularization can efficiently be designed in MAML. We propose general but casily-optimized robustness-regullrized meta-learning framework, which allows the use of unlabeled data augmentation, fast adversarial attack generation, and computationaall--ige fine-tuning. In particular, we for the first time show that the auxiliary contrastive learning task can enhance the adversarial robustness of MAMI.. Finally, extensive experiments are conducted to demonstrate the effec- tiveness of our proposed methods in robust few-shot learning. Codes are available at hhttps://github com/ wom/wwngreen0//Mttttt...oooo.eee
INTRODUCTION
Meta-learning, which can offer fast generalization adaptation unseen tasks (Thrun & Pratt 2012
Novak & Gowin 1984), has widely been studied from model- and metric-based methods (San- toro et al. 2016 Munkhdalai Yu 2017 Koch et al.) 2015 Snell al.) 2017) optimization-
based methods (Ravi & Larochelle 2016 Finn et al. 2017 Nichol et al. 2018). In particular,
model-agnostic meta-learning (MAML) (Finn et al., 2017) one of the most intriguing bi-level optimization- based meta-learning methods designed for fast-adapted few-shot learning. That is, the learnt meta-model can rapidly generalized to unforeseen tasks with only a small amount of data. It has successfully been applied to use cases such as object detection (Wang et al., 2020), medical image analysis (Maicas et al. 2018), and language modeling (Huang et 2018).
In addition to generalization-abilii recent works (Yin et al.) 2018 Goldblum et al. 2019 Xu al. 2020) investigated MAML from another fundamental perspective, adversarial robustness, given by the capabilities of model defending against adversarially perturbed inputs (known as adversarial
"Conesponding: Ren Wang (wangren3481 1 17609@ gmail.com, renwang unich.edu). Work is done the MIT-IBM Watson AI L.bb

---

Published as a conference paper at ICLR 2021
examples/attack) (Goodfellow et al. 2014 al. 2019b). The challenge of lacking robustness of deep learning (DL) models has gained increasing interest and attention. And there exists a proactive arm race between adversarial attack and defense; see overview in (Carlini et al. 2019 Hao-Chen
et al. 2020).
There have existed many defensive methods in the context of standard model training, e.g., Madry
eet al.
2017: Zhang et al.] 2019b] Wong et al. 2020 Carmmon et al.] 2019 [ttnnorth et al. 2019 9 Xu
al. 2019a), however, few work studied robust MAML except (Yin et al., 2018 Goldblum et al.,
2019 to the best of our knowledge. And tackling such a problem is more challenging than robustify-
ing the standard model training, since MAML contains bi-leveled learning procedure in which the meta-update step (outer loop) optimizes a task-agnostic initialization of model parameters while the fine-tuning step (inner loop) learns a task-specific model instantization updated from the common initialization. Thus, it remains elusive when (namely, at which learning stage) and how robust reg- ularization should be promoted to strike graceful balance between generalization/rrhusnnes computation efficiency. Note that neither the standard MAML (Finn et al., 2017) nor the standard robust training (Madry et al. 2017: Zhang et al. 2019b) is as easy as normal training. Besides the algorithmic design in robust MAML, it is also important to draw in-depth explanation and analysis on why adversarial robustness can efficiently be gained in MAML. In this work, we aim to re-visit the problem of adversarial robustness in MAML (Yin et al.] 2018 Goldblum et al. 2019) and make affirmative answers to the above questions on when, how and why.
and
Contributions Compared to the existing works (Yin et al. 2018 Goldblum et al. 2019), we make the following contributions:
Given the fact that MAMI, is formed as bi-level learning procedure, we show and explain why regularizing adversarial robustness at the meta-update level is sufficient to offer fast and effective robustness adaptation on few-shot test tasks.
Given the fact that either MAML or robust training alone is computationally intensive, we propose a general but efficient robustness regulaaize meta-learning framework. which allows the use of unlabeled data augmentation, fast (one-step) adversarial example generation during meta-updating, and partial model training during fine-tuning (only fine-tuning the classifier's s head).
We for the first time show that the of unlabeled data augmentation, particularly introducing an auxiliary contrastive learning task, can provide additional benefits on adversarial robustness of MAML in the low data regime, 2% robust accuracy improvement and 9% clean accuracy improve- ment over the state-of-the-art robust MAML method (named as adversarial querying) in (Goldblum al. 2019.
Related work To train standard model (instead of a meta-model), the most effective robust train- ing methods include adversarial training (Madry et al., 2017). TRADES that places a theoretically- grounded trade-off between accuracy and robustness (Zhang al. 2019b), and their many variants
such as fast adversarial training methods (Shafahi et al., 2019 Zhang et al. 2019a] Wong et al.
2020 Andriushchenkoo & Flammarion 2020), semi-supervised robust training Carmon al. 2019
Stanforth et al. 2019). adversarial transfer learning and certifiably robust training (Wong & Kolter
2017|
al. 22188) Moreover, recent works (Hendryeks et al. 2019)] Chen et al. 2020aa
Shafahi et al. [220]] Chan et al., [2020] Utrera et al. |020) Salman et al. (0200) studied the transfer-
ability of robustness in the context of transfer learning and representation learning. However, the
aforementioned standard robust training methods are not directly applicable to MAML in few-shot
learning considering MAML's bi-leveled optimization nature.
A few recent works studied the problem of adversarial training in the context of MAML (Goldblum et al., 2019 Yin et al. 20188) Yin al. (2018) considered the robust training in both fine-tuning and meta-update steps, which is unavoidably computationally expensive and difficult in optimization. The most relevant work to ours is (Goldblum et al., 2019), which proposed adversarial querying (AQ) by integrating adversarial training with MAML. Similar to ours, AQ attempted to robustify meta-update only to gain sufficient robustness. However, it lacks explanation for the rationale behind that. We will show that AQ can also be regarded special case of proposed robustness- promoting MAML framework. Most important, we make a more in-depth study with novelties summarized in Contributions.
2

---

Published as a conference paper at ICLR 2021
Another line of research relevant to ours is efficient MAML, e.g.. (Raghu al. 2019 Song al. 2019 SS et al. 2019), where the goal is to improve the computation efficiency and/or the generaliza- tion of MAML. In (Song et al. 2019), gradient-free optimization was leveraged to alleviate the need of second-order derivative information during meta-update. In (Raghu et al. 2019). MAMI. was simplified by removing the fine-tuning step over the representation block of meta-model. It was shown that such simplification is surprisingly effective without losing generalization-abiiyy In (Su et al. 2019), self-supervised representation learning task was augmented to the meta-updating objective and resulted in a meta- model with improved generalization. Although useful insights were gained from MAML in the aforementioned works, none of them took adversarial robustness into account.
2 PRELIMINARIES AND PROBLEM STATEMENT
In this section, we first review -odel-agnostic meta learning (MAML) (Finn et al., 2017) and adver- sarial training (Madry et al. (0177). respectively. We then motivate the setup of robustness promoting MAMI. and demonstrate its challenges in design when integrating MAMI. with robust regulariza- tion.
MAML MAML attempts to learn an initialization of model parameters (namely, a meta-model) so that new few-shot task can quickly and easily be tackled by fine-tuning this meta-model over small amount of labeled data. The characteristic signature of MAML is its bi-level learning proce- dure, where the fine-tuning stage forms a task-specific inner loop while the meta-model is updated at the outer loop by minimizing the validation eπтоr of fine-tuned models over cumulative tasks. Formally, consider N few-shot learning tasks (T,) each of which has fine-tuning data set DD and validation set 'D', where DD is used in the fine-tuning stage and DDj is used in the meta-update stage. Here the superscript (/) is preserved indicate operations/parameter
the meta-upate stage. MAML is then formulated as the following bi-level optimization problem (Finn et al., 2017):
minimize w
1 E (w'ss Dj)
N
subject to
w/ = arg min,, le(w;; D., w), Vi [N]
where w denotes the meta-model to be designed, w/ is the T--specific fine-tuned model, (w':: D() represents the validation error using the fine-tuned model, (ww;; D: w) denotes the training error when fine-tuning the task-specific model parameters w, using the task- aags-tanoottic initialization w, and for ease of notation, [K] represents the integer set 21. K). In (I), the objective function and the constraint correspond to the meta-update stage and fine-tuning stage, respectively. The bi- level optimization problem is challenging because each constraint calls an inner optimization oracle, which is typically instantiated into a K -tee gradient descent (GD) based solver:
w (* a (w (M D; D,, w), k E [K], with w ( w.
We note that even with the above simplified fine-tuning step, updating the meta-model still re- quires the -econd-order derivatives of the objective function of ( with respect to (w.rt.) w.
Adversarial training The min-max optimization based adversarial training (AT) is known one of the most powerful defense methods to obtain robust model against adversarial attacks (Madry al.) 2017). We summarize AT and its variants through the following bobustness-regulariiee opti- mization problem:
minimize
Al ((( [[(w; v)] + Exx
Box.weepmmxximize (maximize j(w; + v)],
[|
(2)
R(w;D) D)
where ((W x, y) denotes the prediction loss evaluated the point x with label y, A 2 a regularization parameter, 5 denotes the input perturbation variable within the f ball of radius e, 9 represents the robust loss evaluated at the model w at the perturbed example x + given the true label y. and for ease of notation, let R(w; D) denote the robust regularization function for model w under the data set DD In the rest of the paper, we consider two specifications of R: (a) set g l and À 0; (b) TRADES regularization (Zhang et al., 2019b), where we define g as the cross-entropy between the distribution of prediction probabilities the perturhed example (x + 5) and that at the original sample x.
AT regularization (Madry et al. 2017). where
3

---

Published as a conference paper at ICLR 2021
Robustness-promote MAML Integrating MAML with AT is natural solution to enhance ad- versarial robustness of a meta-model in few-shot learning. However, this seemingly simple scheme is in fact far from trivial, and there exist three critical roadblocks elaborated below.
First, it remains clusive at which stage (fine-tuning or meta-update) robustness can most effectively be gained for MAML. Based on (T) and (2), we cast this problem as unified optimization problem that augments the MAML Ioss with the robust regularization under two degrees of freedom
characterized by two hyper- papeer-prraeterr Yout 2 0 and Tin 2 0:
minimize W
Σ
[8 (w: D.) + Your R, P.)
(3)
subject to
w/ arg minw, [4 ww; D. w) + Mi R. (w:; D.),, Vi E [N].
Here R, denotes the task-specific robustness regularizer, and the choice of (?im Yout) determines the specific scenario of peesttess-promoting MAML. Clearly, the direct application is to set Yin > and Yout > O, that is, both fine-tuning and meta-update steps would be carried out using robust training, which calls additional loops to generate adversarial examples. Thus, this would make computation most intensive. Spurred by that, we ask: Is it possible to achieve robust meta-model by incorporating robust regularization into only either meta- veeta-update or fine-tuning step (corresponding
Yin = 0 or Yout 0)?
Second, both MAML in T and AT in 2 are challenging bi-level optimization problems which need to call inner optimization routines for fine-tuning and attack generation, respectively. Thus, ask whether or not the computationally-
alternatives of inner solvers, e.g., partial fine-tuning (Raghu eet al. 2019) and fast attack generation (Wong et al. 2020). promise adversarial robustness in few-shot learning.
Third, it has been shown that adversarial robustness benefit from semi-supervised learning by leveraging (unlabeled) data augmentation (Carmon et al.] 2019; (Stanforth et af.) (019). Spurred by that, we further ask: Is it possible to generalize robustnesspromoting MAML the setup of semi-supervised learning for improved accuracy-robustnes. tradeoff?
3 WHEN TO INCORPORATE ROBUST REGULARIZATION IN MAML?
In this section, we evaluate at which stage adver- sarial robustness be gained during meta-training.
-- MAML
We will provide insights and step-by-step investiga-
- R-MAML R-MMAML Aah
tions to show when to incorporate robust training in
Robust aveuracy (1))
MAML and why it works. Based on (3) we focus on two robustne meta-training protocols.
(a) R-MAML where robustness regularization ap- plied to both fine-tuning and meta-update steps with
20
Tin; Yout > 0; (b) R-MAMLout. where robust regular-
ization applied to meta-update only, i.e., Tin 0 and Yout 0. Compared R-MAMLboth R-MAMLout is more user-friendly since it allows the use of stan- dard fine-tuning over the learnt robust meta-model when tackling unseen few-shot test tasks (known as meta-testing). In what follows, we will show that even if R-MAMLout does not use robust regularization in fine-tuning, it sufficient warrant the transferability of meta- meta-model's model's robustness to downstream fine-tuning tasks.
10
Attack power
Figure 1: RA of mota-models trained by stan- dard MAML, R-MAML and R-MAML versus PGD attacks of different perturbation sizes during meta-testing. Results show that ro- bustness regularized meta-update with standard fine-tuning (namely, R-MAMI sou)) ) has already been effective in promotion of robustness.
All you need is robust meta-update during meta-
training To study this claim, we solve problem (3) using R-MAMLooth and R-MAMLout re- spectively in the 5-way 1-shot learning setup, where I data sample at each of 5 randomly selected Minilmagenet classes (Ravi & Larochelle] 2016) constructs a learning task. Throughout this sec- tion, we specify R, in 33 the AT regularization, which calls 10-step projected gradient descent (PGD) attack generation method with = 2/255 in its inner maximization subroutine given by ( We refer readers to Section for more implementation details.
4

---

Published as a conference paper at ICLR 2021
We find that the meta- meta-model acquired by R-MAMLout yields nearly the same robust accuracy (RA) as R-MAML against various PGD attacks generated at the testing phase using different pertur- bation sizes the performance of the meta- meta-learning schemes over 2400 random unseen 5-way 1 1-shot test tasks. We also note that RA under turbed) test examples. It is clear from Figure that both R-MAMLout and R-MAMLooth can yield significantly better RA than MAML with slightly worse SA. It is also expected that RA decreases as the attack power increases.
{0, 2. ... 10}/255, shown in Figure [ Unless specified otherwise, we evaluate
O becomes the standard accuracy (SA) evaluated using benign (unper-
Spurred by experiment results in Figure we hypothesize that the promotion of robustness in meta-update alone (i.e. R-MAMLout) is already sufficient to offer robust represen- Iation, over which fine-tuned models can preserve robust- ness downstream tasks. In what follows, we justify the above hypothesis from two perspectives: (i) explanation of learned neuron's 's representation and (ii) resilience learnt ro- bust meta-me meta-model to different fine-tuning schemes the meta- testing phase.
Seed Images
JAMs (MAML)
IAMs (R-MAMML.... (R-MAMLesn)
(i) Learned signature of neuron's representation is cently shown in (Engstrom et al. 2019) that a robust model exhibits perceptually-alignet
neuron activation maps, which are not present if the model lacks adversarial robustness. To uncover such a signature of robustness, feature inversion technique (Engstrom et al. (2019) is applied to finding an in- verted input attribution map (IAM) that maximizes neuron's activation. Based on that, we examine if R-MAMLboth and R-MAMMout can similarly generate explainable inverted im- ages from the learned neuron's 's representation. We refer read- ers to Appendix 2 for more details on feature inversion from neuron's s activation.
JAMs
Figure 2: Visualization of randomly selected neuron's inverted input attri- bution maps (IAMs) under different meta-models. The first row shows the seed images. The second-fourth rows show IAMs corresponding models MAML, R-MAMLboth. and R-MAML-out: respectively. Ex- cept MAMI, R-MAML and R-MAMLout all catch high-level features from the data.
trained
In our experiment, we indeed find that both R-MAML-both and R-MAMLout yield similar IAMs inverted from neuron's s activation at different input examples, as plotted in Figure More intriguingly, the learnt IAMs characterize the contour of objects existed in input images, and accompanied by the learnt high-level features, e.g., colors. In contrast, the IAMs of MAML. lack such interpretability. The observations from the interpretability of neurons' representation justify why R-MAMI is as effective R-MAMLboth and why MAML does not preserve robustness.
(ii) Robust meta-update provides robustness adap- tation without additional adversarial fine-tuning at meta-testing Meta-testing includes only the fine-tuning stage. Therefore, we need explore if standard fine- tuning is enough to maintain the robustness. Suppose that R-MAMLout is adopted as the meta-training method solve problem ( we then ask if robustness-regularie meta-testing strategy can improve the robustness of fine- tuned model at downstream tasks. Surprisingly, we find that making an additional effort to adversarially fine-tune the meta-model (trained by R-MAML during testing does not provide an obvious robustness improvement over the standard fine-tuning scheme during testing (Table()). This consistently implies that robust meta-update (R-MAMLoul is sufficient render intrinsic robustness in its learnt meta-model regardless of fine-tuning strategies used at meta-testing. Figure(ST] in Appendix provides evidence that the visualization difference is small between before standard fine-tuning and after standard fine-tuning.
Table Comparison of difffrrnn strate- gies in meta-testing on R-MAMLout: (a) standard fine-tuning (S-FT), (b) adversarial fine-tuning (A-FT).
S-FT
A-FT
SA 40.9%
39.6%
RA
22.9%
23.5%
Adversarial querying (AQ) (Goldblum et al. 2019): A special case of R-MAML The recent
work (Goldblum et al. 2019) developed AQ to improve adversarial robustness in few-shot learning.
5

---

Published as a conference paper at ICLR 2021
AQ can be regarded as special of R-MAMLout with Yin 0 but setting Yout in That is, the meta-update is overridden by the AT regularization. We find that AQ yields about 2% RA improvement over R-MAMLous: which uses Yout = 0.2 in However, AQ leads to 11% degradation in SA, and thus makes a much poorer robustness-accuran tradeoff than our proposed R-MAML We refer readers to Table 2 for comparison of the proposed R-MAMML with other training baselines. Most importanly, different from (Goldblum et al., 2019), we provide insights on why R-MAMLout is effectivve in promoting adversarial robustness from mela-update fine-tuning.
4 COMPUTATIONALLY--RRII
MAML
In this section, we study if the proposed R-MAML can further be improved to ease of optimiza- tion given the two computation difficulties in (3: (a) bi-leveled meta-learning, and (b) the need of inner maximization to find the worst-case robust regularization. To tackle either problem alone, there have been efficient solution methods proposed recently. In (Raghu et al. 2019). an almost- no-inner-loop (ANIL) fine-tuning tuning strategy was proposed, where fine-tuning is only applied to the task-specific classification head following a frozen representation network inherited from the meta- model. Moreover, in (Wong et al. (020), a fast gradient sign method (FGSM) based attack generator was leveraged to improve the efficiency of AT without losing its adversarial robustness. Motivated by (Raghu et al. 2019; WWong et al. (020), we ask if integrating R-MAMLout with ANIL and/or FGSM can improve the training efficiency but preserves the robustness and generalization-ale -bbliity of a meta-model learnt from R-MAMLeut
R-MAML cout meets ANIL and FGSM We decompose the meta- model w = [w., wel into two parts: representation encoding network w, and classification head we- In R-MAML-ut- namely, (3) with Pin = 0, ANIL suggests to only fine-tune we over specific task T,. This leads to
W', arg min Ls (We,i, Wr; Di, w), with w = W,.
(ANIL)
We.s
ANII the initialized representation network w, keeps intact during task-specific fine-tuning. which thus saves the computation cost. Furthermore, if FGSM is used in R-MAMLont then the
robustness regularizer R defined in 2 reduces to
R R(w; D) = E(x.))ello(w:x + 8 (x), v)l. 8*(x) = 8, + XVgg(w;;
(FGSM)
where 5n is an initial point randomly drawn from uniform distribution over the interval [-c, c.. Note that in the original implementation of robust regularization R, multi-step projected gradi- ent ascent (PGA) is typically used to optimize the sample-wise adversarial perturbation d(w). By
contrast, FGSM only uses one-step PGA attack generation and thus improves the computation efficiency.
In Table we study two computationally-lin light alternatives of R-MAMML R-MAMLous with [NNIL (R-MAMLout -NILL) and R-MAML with FGSM (R-MAMLonn-FGSM)
Table 2: Performance of computation effiicicnnee alternatiees of R-MAML in SA, and computation time per epoch (in minutes).
SA
RA
Time
Compared to R-MAML find that
MAML
43.6%
3. 3.17%
42min
although --MSMM takes
AQ (Goldblum et al., 2019]
29.6%
24.9%
52min
less computation time, it yields even better RA with slightly worse SA. By contrast, o-MAMI-an--NN yields the least computation cost but the worst SA and RA. For comparison, we also present the performance the adversarial meta-learning baseline AQ [Goldblum et al. 2019). As we can see, AQ promotes the adversarial robustness at the cost of significant SA drop. e.g.. 7.56% worse than E-MAAMLou-ANIL Overall, the application of FGSM to R-MAMLout provides the most graceful tradeoff between the computation cost and the standard and robust accuracies. In the rest the paper, unless specified otherwise we will use FGSM in R-MAMI out-
R R-MAMI Lout
40.9%
22.9%
54min
R-MAMLoo MMAMLout-AA -ANIIL
37.46%
22.7%
36min
R- R-MAMLou
-GSM -GGM
40.82%
23.04%
44min

---

Published as a conference paper at ICLR 2021
5 SEMI-SUPERVISED ROBUSTNESS-PROMOTIEE MAML
Given our previous solutions to when (Sec. B and how (Sec. robust regularization could fectively be promoted in few-shot learning, we next ask: Is it possible to further improve our pro- posal R-MAMLout by leveraging unlabeled data? Such a question is motivated from two aspects. First, the use of unlabeled data augmentation could be key momentum improve the robustness- accuracy tradeoff (Carmon et al. 2019] Stanforth et al., 2019). Second, the recent success in self- supervised contrastive representation learning (Chen et al. 2020b He al.] (020) demonstrates the power of multi-viers view (unlabeled) data augmentation to acquire discriminative and generalizable visual representations, which guide down-stream supervised learning. In what follows, propose an extension of R-MAMI applicable to semi-supervised learning with unlabeled data augmentation.
R-MAML with TRADES regularization. We recall from (2) that the robust regularization R also be specified by TRADES (Zhang et al. 2019b), which relies only on the prediction logits of benign and adversarial examples (rather than the training label), and thus lends itself to the application of unlabeled data. Spurred by that, we propose R-MAMIl -MMAMML--TT--AAEEES which is variant of R-MAMLout using the unlabeled data augmented TRADES regularization. To perform data augmentation
experiments, we follow (Carmon al. 2019) mine additional (unlabeled) data with the same amount of Minilmagenet data from the original ImageNet data set. For clarity, we call R-MAML using TRADES or AT regularization (but without unlabeled data augmentation) R-MAMLou (TRADES) (TRADE))
(-MAML..(ATT).
We find that with the help of unlabeled data, improves the accuracy- robustness tradeoff over its supervised counterpart R-MAMLout using either AT TRADES regu- larization (Figure 3) Compared to R-MAMLeut:
50
R-MAML
M-LMLL TRADES OA R-MALML (TRADES)
R-MALML (AT)
Rohust accuracy accurayy
R-MAML - TRADES yields consistently better RA against different attack strength c E (2....,10)) 10}/255 during testing. Interestingly, the improvement be- comes more significant as increases. As RA is equivalent SA. and we observe that the superior performance of R-MAMLeut TRADEES
20
0,
in RA bears a slight degradation in SA compared to R-MAMI which indicates the robustness-accuracy tradeoff. S2 in Appendix dence that R-MAAMLou-TRAR TRADES has the ability to defend stronger attacks than R-MAMLout- and proper unlabeled data augmentation can further improve the accuracy-robustness tradeoff in MAML..
and R-MAML
Allack power
RA versus (testing-phase) PGD attacks at different values of perturba- tion strength e. Here the robust models are trained by different variants of R-MAMLout. including R-MAMI..--TRDDE. (with unla- beled data augmentation). R-MAML ing AT regularization but no data augmenta- tion (R-MAMLou and R-M R-MAMLous us- ing TRADES regularization but no data aug- mentation (R-MAMIouus (TRADEESS) (TRADES)).
Figure 3:
[ provides additional evi-
R-MAML with contrastive learning (CL). To improve adversarial robustness, many works, e.g.. (Pang et al. 2019 Sankaranarayanaan et al., 2017). also suggest that is important to encourage robust seman-
tie features that locally cluster according to class, namely, ensuring that features of samples in the same class will lie close each other and away from those of different classes. The above sugges- tion aligns with the goals of contrastive learning (CL) (Chen et al.) 2020b; Wang & Isola 2020). which promotes (a) alignment (closeness) of features from positive data pairs, and (b) uniformity of feature distribution. Thus, we develop R-MAML.... -CL by integrating R-MAML with CL.
Prior to defining R-MAMLou:-CL -CL, we first introduce CL and refer readers to (Chen et al. 2020b) for details. Given data sample x, CL utilizes its positive counterpart x given by a certain data transformation e.g.. cropping and resizing, cut-out, and rotation, x f(x). The data pair (x, ((x)) is then positive if x = x', and negative otherwise. The contrastive loss is defined by ((xie)) ((r:t))T(xttt ww/++
(cw(w.:pt) = )xxt
log w(xt:we)/ Ex wp.(xxx lep
(xx.w)))) F(x- (wa)/y
7

---

Published as a conference paper at ICLR 2021
where p denotes the data distribution, p* (:,-) is the distribution of positive pairs, r(x: we) the encoded representation of x extracted from the representation network We. and T > 0 is a temperature parameter. The contrastive loss minimizes the distance of a positive pair among many negative pairs, namely, learns network representation with instance-wise discriminative power.
According to CL. then augment the data used to train R-MAML with their transformed coun- terparts. In addition, the adversarial examples generated during robust regularization can also be used as additional views of the original data, which in turn advance CL. Formally, we modify R-MAMLout. given by
3 with V/n 0, as
minimize
Σ 2i=1 [e(( + Tout (w::: D() + (er.eer, U Uptdv]]
N
(4)
subject to
w arg minw; (; w), Vi E [M],
where PCL > 0 is regularization parameter associated with the contrastive loss, p U pp repre- sents the distribution positive data pairs constructed by the standard and adversarial views of D', and w',, denotes the representation block of the model w/-
In T we compare the SA/RA performance of R-MAMLou- -CL with that previously-suggested variants of R-MAMLou including the versions R-MAMLou((AT) and R-MAML.
Table 3:
SA/RA performance of R-MAMLou -CL versus
other variants proposed R-MAM and baselines.
SA
RA
MAML
43.6%
3.17%
without using unlabeled data, and the version with unlabeled data R-MAMI-ou:TRRDDES. as well as 2 baseline methods including standard MAML and adversarial querying (AQ) in few-shot learning (Goldblum al. 2019). Note that we specify R4 in (4) TRADES regularization for R-MAMLou -CL We find that R-MAML -CL yields the best RA among all meta-learning methods, and improves SA over DEMAMMoo--TRDDIA In particular, the comparison with AQ shows that R-MAML -CL leads to 9% improvement in SA and 1.9% improvement in RA.
AQ (Goldblum et al. 2019
29.6%
24.9%
R-MAML (AT) (ours)
40.82%
23.04%
R- R-MAML (TRADES) (ours)
39.06%
23.56%
R-MAMLour TRADES (ours)
37.1%
25.51%
R-MAL -CL (ours)
38.60%
26.81 %
ADDITIONAL EXPERIMENTS
Key facts of our implementation. In the previous analysis, we con- sider I-shot 5-way image classi- fication tasks over MinilmageNet (Vinyals al. (016)). And we use four-layer convolutional neural net-
Table 4: Summary of baseline performance in SA and TA.
SA
MAML (FSL)
43.6%
3.17%
AQ (FSL) (Goldblum al. 2019
29.6%
24.9 %
Supervised standard training (non-FSL)
29.74%
3.51%
work for few-shot learning (FSL).
Supervised AT (non-FSL.)
28.22%
19.02%
By default, we set the training attack strength
2, YCT. 0.1, and set Tout = 5 (TRADES), Yout 0.2 (AT) via a grid search. During meta-testing, 10-step PGD attack with attack strength
used to evaluate RA of the learnt meta-model over 2400 few-shot test tasks. We provide experiment details in Appendix
Summary of baselines. We remark that in addition to MAML and AQ baselines, we also consider the other two baseline methods, supervised standard training over the entire dataset (non-FSL set- ting), and supervised AT over the entire dataset (non-FSL setting); see summary Table 4 The additional baselines demonstrate that robust adaptation in FSL is non- non-triveee trivirivil neither the supervised full AT or the full standard training can achieve satisfactory SA and RA.
Experiments on Additional model architecture, datasets and FSL setups. In Table SI of Ap- pendix we provide additional experiments using ResNet18. In particular, R-MAML CL leads to 13.94% SA improvement and 1.42% RA improvement over AQ. We also test our methods on CIFAR-FS (Bertinetto et al. 2018) and Omniglot (Lake et al. 2013), and provide the results in Ta- 5 and Fig respectively (more details can be viewed in Appendix 6 and Appendix The
8

---

Published as a conference paper at ICLR 2021
Table 5: SA/RA performance of proposed methods CIFAR-FS
(Bertinetto et al.
2018
I-Shot 5- Way
5-Shot 5- 5-Way
SA
RA
SA
RA
MAML
51.07% %
0.235
67.2%
0.225%
AQ (Goldblum al. 2019
31.25%
26.34%
52.32%
33.96%
R MAML (AT) (ours)
39.76%
26.15%
57.18%
32.62%
R-MAMI oou o (TRADES) (ours)
40.23%
27.45%
57.46%
34.72%
R-MAMI sntt -TRADES (ours)
40.59%
28.066%
57.62%
34.76%
R- R--MML...t -C (ours)
41.25%
29.33%
57.95%
35.30% %
results show that our methods perform well on various datasets and outperform the baseline meth- ods. On CIFAR-FS, study 1-Shot 5-Way and 5-Shot 5- 5-Way settings. As shown in Table the use of unlabeled data augmentation AR-MAML -CL) on CIFAR-FS can provide 10% (or 5.6%) SA improvement and 3% (or 1.3%) RA improvement over AQ under the 1-Shot 5-Way (or 5-Shot Way) setting. Furthermore, we conduct experiments in other FSL setups. On Omniglot, we compare AQ (Goldblum al., 2019) in the I-shot (5, 10, 15, 20)-Way settings.
R-MAMLour MTAAAOL (TRADES) Figure S3 shows that MM the number of classes in each task varies.
can always obtain better performance than AQ when
CONCLUSION
In this paper, we study the problem of adversarial robustmess in MAML. Beyond directly integrating MAML with robust training, we show and explain when a robust regularization should be promoted MAML.. We find that robustifying the meta-update stage via fast attack generation method is suff- cient to achieve fast robustness adaptation without losing generalization and computation efficiency in general. To further improve our proposal, we for the first time study how unlabeled data help ro- bust MAML. In particular, we propose using contrastive representation learning to acquire improved generalization and robustness simultaneously. Extensive experiments are provided to demonstrate the effectiveness of our approach and justify our insights on the adversarial robustness of MAML. In the future, we plan to establish the convergence rate analysis of robustness-aware MAML by leveraging bi-level and min-max optimization theories.
ACKNOWLEDGEMENT
This work was supported by the Rensselacr-IBM AI Research Collaboration (http://airc. rpi .edu), part of the IBM AI Horizons Network (http:// /wtmm httlbb..iiiAAHHo. biz/ATHorizons)
REFERENCES
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. arXiv preprint arXiv:2007.02617 2020.
Luca Bertinetto, Joao F Henriques, Philip Torr, and Andrea Vedaldi. Meta-learning with differen- tiable closed-form solvers. In International Conference on Learning Representations, 2018.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv: 2019.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves udversarial robustness. In Advances in Neural Information Processing Systems, pp. 11190-1 1201, 2019.
Alvin Chan, Yi Tay, and Yew-Soon Ong. What it thinks is important is important: Robustness transfers through input gradients. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 332-341, 2020.

---

Published as a conference paper at ICLR 2021
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From supe-supe pre-training to fine-tuning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 699-708, 2020a.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. arXiv preprini urXiv:2002.05777 2020b.
Adam Coates, Andrew Ng. and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelli- gence and statistics, pp. 215-223, 2011.
Krishnamurthy
Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O' O'Donoghue. Jonathan Uesato, and Pushmeet Kohli. Training verified learners with learned ver- ifiers. arXiv preprint arXiv:1805.10265 2018.
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Brandon Tran, and Alek- sander Madry. Adversarial robustness as a prior for learned representations. arXiv preprint arXiv:1906. 1000::9906.00455, 00945, 2019.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. agdel-agnostic meta- meta-learning for fast adaptation of deep networks. arXiv preprint arXiv:1703.03444 2017.
Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: A meta- learning approach. arXiv, pp. arXiv-1910, 2019.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 2014.
Han Xu Yao Ma Hao-Chen, Liu Debayan Deb, Hui Liu Ji-Liang Tang Anil, and Jain. Adversarial attacks and defenses in images, graphs and text: A review. International Journal of Automation and Computing, 17(2):151-17, 2020.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9729-9738, 2020.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference on Machine Learning, pp. 2712-2721, 2019.
Po-Sen Huang, Chenglong Wang, Rishabh Singh, Wen-tau Yih, and Xiaodong He. Natural language to structured query generation via meta-learning. arXiv preprint arXiv: 1800000000 2018.
Gregory Koch, Richard Zemel, and Ruslan Salakhutdinov. Siamese neural networks for one-shot image recognition. In /CML deep learning workshop, volume 2. Lille, 2015.
Brenden M Lake, Ruslan Salakhutdinov, and Joshua B Tenenbaum. Human-level concept learning through probabilistic program induction. Science, 35006266):1332-1333 2015.
Alcksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 1706::700.060000 060008 2017.
Gabriel Maicas, Andrew P Bradley, Jacinto C Nascimento, lan Reid, and Gustavo Carneiro. Training medical image analysis systems like radiologists. International Conference on Medical Image Computing and Cosputer-Assisted Intervention, pp. 546-556444 Springer, 2018.
Tsendsuren Munkhdalai and Hong Yu. Meta networks. Proceedings of machine learning research, 70:2554, 2017.
Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.0200 029999 2018
Joseph D Novak and D Bob Gowin. Learning how to learn. cambridge University press, 1984.
10

---

Published as a conference paper at ICLR 2021
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. Improving adversarial robustness via promoting ensemble diversity. arXiv preprint arXiv:
2019.
Aniruddh Raghu, Maithra Raghu, Samy Bengio, and Oriol Vinyals. Rapid learning feature reuse?
towards understanding the effectiveness of maml. arXiv preprini (90::099900991111 2019.
Sachin Ravi and Hugo Larochelle. Optimization as a model for few-shot learning. 2016.
Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adver- sarially robust imagenet models transfer better? arXiv preprint arXiv:2007.08489, 2020.
Swami Sankaranarayanan, Arpit Jain, Rama Chellappa, and Ser Nam Lim. Regularizing deep net- works using efficient layerwise adversarial training. arXiv preprint arXiv: (705.077000781 2017.
Adam Santoro, Sergey Bartunov, Matthew Botvinick, Daan Wierstra, and Timothy Lillicrap. Meta- learning with eeemory-augmente neural networks. In International conference on machine learn- ing. pp. 1842-1850, 2016.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems, pp. 3353-3364, 2019.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. In International Conference on Learning Rep- resentations, 2020. URL htRL:ttss:// http::::///peeereeeeeeee net wttp://wwweeteoorreoeeeeeeeeeooo
Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for few-shot learning. In Advances in neural information processing systems, pp. 4077-4087, 2017.
Xingyou Song, Wenbo Gao, Yuxiang Yang. Krzysztof Choromanski, Aldo Pacchiano, and Yunhao Tang. Es-maml: Simple hessian-free meta learning. arXiv preprint arXiv:1910.01215, 2019.
Robert Stanforth, Alhussein Fawzi, Pushmeet Kohli, et al. Are labels required for improving adver- sarial robustness? arXiv preprint 19X.v:1905.1372 2019.
Jong-Chyi Su, Subhransu Maji, and Bharath Hariharan. When does self-supervision improve few- shot learning? arXiv preprint 1rXivv1910.03560 2019.
Sebastian Thrun and Lorien Pratt. Learning to learn. Springer Science & Business Media, 2012.
Francisco Utrera, Evan Kravitz, N Benjamin Erichson, Rajiv Khanna, and Michael W Mahoney. Adversarially-trained deep nets transfer better. arXiv preprint arXiv:2007.05869 2020.
Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al. Matching networks for one shot learning. In Advances in neural information processing systems, pp. 3630-3638, 2016.
Guangting Wang, Chong Luo, Xiaoyan Sun, Zhiwei Xiong, and Wenjun Zeng. Tracking by instance detection: A meta-learning approach. In Proceedings of the IEEE/CVF Conference on Computer Vision and Paltern Recognition, pp. 6288-6297, 2020.
Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through align- ment and uniformity on the hypersphere. arXiv preprint arXiv:2005.10242, 2020.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1711.0083 2017.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020. URL URLnntps:://ppeerriii:
Han Xu, Yaxin Li, Xiaorui Liu, Hui Liu, and Jiliang Tang. Yet meta learning can adapt fast, it can also break easily. arXiv preprint arXiv:2009.0663 2020.

---

Published as a conference paper at ICLR 2021
Kaidi Xu, Hongge Chen, Sijia Liu, Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In Interna- tional Joint Conference Artificial Intelligence (ICAAI), 2019a.
Kaidi Xu, Sijia Liu, Pu Zhao, Yu Chen, Huan Zhang, Quanfu Fan, Deniz Erdogmus, Yanzhi Wang, and Xue Lin. Structured adversarial attack: Towards general implementation and better interpretability. In International Conference on Learning Representations, 2019b.
Chengxiang Yin, Jian Tang, Zhiyuan Xu, and Yanzhi Wang. Adversarial meta-learning, 2018.
Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerating adversarial training via maximal principle. arXiv preprint arXiv:/905.008: 2019a.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing. Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, 2019b.
12

---

Published as a conference paper at ICLR 2021
SUPPLEMENTARY MATERIAL
FRAMEWORK OF R-MAMLOuE
Algorithm ST shows the framework of R-MAML The initial inputs include model weights w, distribution of the training tasks p(T), and the step sizes a, 31 82, which correspond to fine-tuning, clean meta-update, adversarial meta-update. Each batch contains multiple tasks that sampled from the p(T). K' the number of gradient updates in fine-tuning. The adapted parameter w (K) is used to generate adversarial validation data DJ from the clean validation data Dj and to compute the loss value R, (w:
(w)), (K; D(). The attack generator can be selected from Projected Gradient Descent (Madry al., 2017), Fast Gradient Sign Method (Goodfellow et al. 2014). etc. Here is used to control the attack strength in the training.
Algorithm S1 R-MAML
Input:
The initialization weights w; Distribution over tasks p(T): Step size parameters a, B1, 82. while not done do
Sample batch of tasks Ti ~ p(T) and separate data in Tr into (D;, Dj)
for each T; do
w: (0) := w
for k = 1, .... K do
w; (k) w; 1k-1)
a V.. (wW (1-1);;110000))))) Di
; w)
end for
Using attack generator generate adversarial validation data Dj by maximizing adversar- ial loss (w (K), D)) with the constraint I/D; Di S
end for
31 V w ETTMpTT (i(w?") (K), ; w) fout Vw ΣTTDp(T :
10
11 end while
12 Return: w
2 DETAILS OF LEARNED SIGNATURE OF NEURON'S ACTIVATION
By maximizing single coordinate of the neuron activation vector (the output before the fully- connected layer) with a perturbation in the input, the perturbation will show different behaviors between a robust model and standard model (Engstrom et al. 2019). To be more specific, the feature pattern is revealed in the input under robust model, while standard model does not have such behavior. The optimization problem can be mathematically written in the following form
maximize subject to
r5 + 8)
(S1)
X, S 5, S 255 Xj,
where denotes the i-th coordinate of neuron activation vector. 5 is the perturbation in the input. X, is the j-th pixel of the image vector x.
3 VISUALIZATION OF IAMS BEFORE AND AFTER FINE-TUNING IN
Once obtain a model using R-MAMI we can test the impact of the standard fine-tuning on its robustness. F shows a randomly selected neuron's 's inverted input attribution maps (IAMs) before standard fine-tuning and after standard fine-tuning in the meta-testing phase. The second row shows IAMs the model before fine-tuning. The third row shows IAMs of the model after fine-tuning. One find that the difference is small between the IAMs before fine-tuning, suggests that robust meta-update itself can provide the robustness adaptation without additional adversarial training.
and after
13

---

Published as a conference paper at ICLR 2021
Seel Images
EMM
(AfresFT)
IA
Figure S1: Visualization of a randomly selected neuron's inverted input attribution maps (IAMs) before fine- tuning and after fine-tuning in meta-testing. The model obtained by R-MAML The second row shows IAMs model before fine-tuning. The third row shows IAMs the model after fine-tuning. One can find that the difference between the IAMs before fine-tuning and after fine-tuning is small, suggests that robust mcta-update itself can provide the robustness adaptation without additional adversarial training.
DETAILS OF EXPERIMENTS
To test the effectiveness of our methods, we employ the MinilmageNet dataset Vinyals et al. (2016), which is the benchmark for few-shot learning. MinilmageNet contains 100 classes with 600 samples in each class. We use the training set with 64 classes and test set with 20 classes. In our experiments, downsize each image 84 84 3.
we consider the 1-shot 5-way image classification task, i.e., the inner-gradient update (fine-tuning) implemented using five classes and one fine-tuning image for each class in one single task. In meta-training, Each batch contains four tasks. We set the number of gradient update steps K = in meta- training. For the meta-update, we use 15 validation images for each class. We the gradient step size in the fine-tuming a 0.01, and the gradient step sizes in the meta-update as 3, = 0.001, f2 0.001 for clean validation data and adversarial validation data, respectively.
R-MALML (c=2)
R-MAMI, -TRADES 22)
40
OUE
R-MALML (c
Robast accuracy (%)
R-MAML, -TRADES 4)
30
10
0
10
Antak power
Figure S2: RA versus festing-phased PGD attacks at different values perturbation strength Here the R-MAMI..us Each method trains two models under TRADESS
robust models are trained by --MAAM-----RRDDA the training attack strength of = 2,4, respectively. Results show that M-MAMI TRADES has the ability to defend stronger attacks than R-MAMI.....
14

---

Published as a conference paper at ICLR 2021
5 ADDITIONAL COMPARISONS ON MINILMAGENET
Figure S2 shows robust accuracy (RA) performance of models trained using our methods. One can see that R-MAMLLou-TRADDE has the ability defend stronger attacks than R-MAML-out-
In ST we compare the SARRA performance of variants of R-MAMLout including R- (AT), the TRADES regularization with unlabeled data R-MAMLout -TRADES, the version with contrastive learning R-MAMLon-CL. One can see that 6-MAMLout-C yields the best SA and RA among all meta-learning methods.
Table S1: SA/RA performance of different variants of proposed R-MAMLout under the 1-shot 5-way scenario ResNet18.
SA
RA
MAML
43.1%
5.347%
AQ (Goldblum et al. 2019
30.04%
20.05%
R- R-MAMLout (AT) (ours)
38.94%
19.94%
R-MAML -TRADES (ours)
41.94%
20.19%
R- R-MAMLout -CL (ours)
43.98
21.47%
EXPERIMENTS ON CIFAR-FS
We also test our proposed methods on CIFAR-FS (Bertinetto et al. 2018), which is an image classifi- cation dataset containing 64 classes of training data and 20 classes of evaluation data. The compared methods are the same as in Table We keep the settings to be the same as the test on Minilma- genet except we set 8. To perform data augmentation in experiments, unlabeled data for each training class from the STL-10 dataset (Coates et al. 2011).
mine 500 additional
Table and Table show the comparisons in 1-Shot 5- Bay and 5-Shot 5- 5-Way learning scenarios, respectively, One can see that our methods outperform the baseline methods MAML and AQ (Gold-) blum al. 2019). The results also indicate that semi-supervised learning (in terms TRADES and contrastive learning) can further boost the performance. In particular, as shown by S2 and SSa R-MAMI-outCC leads 10% SA improvement and 3% RA improvement compared to AQ under the MAML 1-Shot 5-Way setting, and 5.6% SA improvement and 1.3% RA improvement under the 5-Shot 5-Way setting.
Table S2: SA/RA performance our proposed methods on CIFAR-FS (1-Shot 5ayy..
(Bertinetto et al.
2018
SA
RA
MAML
51.07% %
0.235%
AQ (Goldblum et al. 2019)
31.25%
26.34%
R-MAML Mout (AT) (ours)
39.76%
26.15%
R-MAML (TRADES) (ours)
40.23%
27.45%
R-MAML TRADES (ours)
40.59%
28.06%
R-MAML -CL (ours)
41.25%
29.33%
EXPERIMENTS ON OMNIGLOT
We then conduct experiments on Omniglot (Lake et al. 2015). which includes handwritten charac- ters from 50 different alphabets. There are 1028 classes of training data and 423 classes of evaluation
15

---

Published as a conference paper at ICLR 2021
Table S3: SA/RA performance of our proposed methods CIFAR-FS (Bertinetto al.
2018
(5-Shot 5-Way).
SA
RA
MAML
67.2% %
0.225%
AQ (Goldblum et al. 2019
52.32%
33.96%
R-MAML (AT) (ours)
57.18%
32.62%
R-MAMLout (TRADES) (ours)
57.46%
34.72%
R-MAMLout
-TAAEES TRADES
(ours)
57.62%
34.76%
R-MAMLout- (ours)
57.95%
35.30%
data. Due to the hardness finding the unlabeled data with similar patterns, we only test our su- pervised learning methods Omniglot. We compare R-MAML (TRADE))) AQ (Goldblumi et al. 2019) in the 1-shot (5, 10, 15, 20y-Way settings. Figure. Tigure.S3]ssowe S3ows the results of RA/SA under 10. The results show that R-MAM (TRADES) can obtain better performance than AQ
90
95
R-MALMI, (TRADES)
R-MALMI (RADESS)
out
850
AQ
AQ
Robust aceuracy (8+
80
Standard accuracy
88
75
80
70
75
65
70
60
63
5
10
15
20
Number of classes each task
Number of classes each
RA
SA
Figure S3: Performance of R-MAML
MMAMMO (TRADES) and AQ (Goldblum et al. 2019) on Omniglot versus number of classes in each task (from 5 to 20 ways): (a) RA. (b) SA.
16


Reviews:
[{"review_id": "zjbmixlcD4p", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary\n\nThis paper investigates the adversarial robustness of model agnostic meta-learning (MAML). Adversarial robustness can be added to MAML in two places, meta-update stage and and fine-tune stage. It shows that robustifying the meta-update stage via fast attack generation method is sufficient to achieve fast robustness adaptation without losing generalization and computation efficiency in general. The paper also demonstrates that unlabeled data can help using contrastive representation learning to improve generalization and robustness. \n\nStrengths\n\nIt shows:\n1. adversarial training with the projected gradient descent (PGD) attack generation method is only needed at meta-update stage for MAML.\n\n2. computationally efficient adversarial training methods such as  almost-no-inner-loop (ANIL) fine-tuning strategy and FGSM are enough.\n\n3. training with unlabeled data using contrastive learning further improves generalization and robustness. \n\nWeaknesses\n\nAdversarial robustness of MAML has been studied in (Goldblum et al., 2019). This paper provides further investigation. The study seems to be straightforward and incremental. \n\nAll results are based on miniImageNet. MAML has also been applied in reinforcement learning. It is not clear the results in this paper carries out to the RL setting.\n\nDecision\n\nThe paper improves MAML with adversarial training at meta-update stage and unlabeled data through contrastive learning. However, the studies and techniques seem to be incremental compared with related work. \n\n\n=====POST-REBUTTAL COMMENTS======== \n\nThe authors provided additional experiments on CIFAR-FS and Omniglot. The results show that their methods outperform the baseline method adversarial querying (AQ). \n\nIt is still not clear whether the methods work in the reinforcement learning setting. As the original MAML paper shows that MAML works for RL problems, it is important to address this question. Otherwise, it could potentially limits the applicability of the proposed methods in the paper.\n\nI still have concerns over their novelty and the significance of their contributions. \n\nOverall, I applaud their effort to address my comments. I am more positive on the paper than before. My rating is a solid 6. The paper in the current stage does not warrant a higher rating for ICLR in my opinion.", "extra_scores": {}, "extra_text": {}}, {"review_id": "gImFr42ZFu0", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "It is an interesting paper empirically addressing adversarial robustness of model agnostic meta learning (MAML). The paper investigates where to incorporate robust regularization in MAML in order to improve adversarial robustness, and based on that *efficient* robust MAML methods are proposed. Interestingly, contrastive learning is incorporated and derive a more robust MAML model. \n\nMy concerns are listed as below:\n\n- The paper is highly empirical, whearas only one dataset is employed. The claims would be more convincing with more datasets.\n- The key point is not properly emphasized. For example, Section 4 and Section 5.1 (TRADES) do not provide very important insights compared with Section 5.2 (CL) — maybe Section 5.2  could be extended furthur with some other contents defered in the Appendix.", "extra_scores": {}, "extra_text": {}}, {"review_id": "fpH2KlYuoVd", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper explores a way to promote the adversarial robustness in Model-agnostic meta-learning (MAML). It conducts extensive experiments to show regularizing adversarial robustness at meta-update level is sufficient to offer fast and effective robustness adaptation on few-shot test tasks. However, it lacks the theoretical analysis for this conclusion. Also, the experiments only are conducted on few-shot image classification task on miniImageNet dataset. This makes this conclusion lack sufficient credibility.\n\nThis paper also shows the use of unlabeled data augmentation can provide additional benefits on adversarial robustness of MAML. Due to the low-data regime in few-shot classification, it is reasonable to introduce contrastive learning task to few-shot learning, which may facilitate the development of following research.\n\nIt is of great importance to investigate the adversarial robustness in meta-learning framework, such as MAML in this paper. It might give us insights on designing network structure. However, it would be better to give more insights on the way to integrate the adversarial robustness rather than list the experimental results.\n\nNovelty of this paper seems to be technically marginal. While the aggregation of adversarial robustness on meta-learning framework is new, detailed architecture explanation with novelty is lacked.", "extra_scores": {}, "extra_text": {}}, {"review_id": "W9ymJJrdE6t", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposes to integrate meta-learning (MAML specifically) and adversarial training (AT) to improve adversarial robustness of meta-learning in terms of fast and effective adaptation on few-shot test tasks. To achieve this, the authors provide extensive investigation and solid answers on when, how and why their method works.\n\nOverall I vote for accepting. The authors found that it seems to be natural to combine MAML and AT together to enhance the adversarial robustness of meta-learning, however, due to computational complexity and bi-level optimization in MAML and AT, they further pose the above three questions when, how, and why step by step, to which they also provide affirmative answers in the paper. Some suggestions are given in the cons part below.\n\nPros:\n\n1. Overall the paper is well-written. In particular, its motivation and contribution are clearly explained and summarized, which is quite fluent when reading.\n\n2. The paper presents visual evidence of when to incorporate robustness regularization in MAML by leveraging input attribution maps of neurons, which is reasonable and interesting for me.\n\n3. The paper leverages contrastive learning into MAML to help the model’s adversarial robustness, which is novel and interesting to me.\n\nCons:\n\n1. For the experiment part, more other few-shot learning datasets (such as Omniglot) or other few-shot settings (such as 5-way or 20-way) can be utilized to evaluate the proposed method as well as to present more data points.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The reviewers’ main concern was a lack of experiments, and additional experiments were provided by the authors.  While the rebuttal was not addressed by the reviewers, the AC feels that the rebuttal did address a number of experimental concerns well enough to justify accepting this paper.
Decision: Accept (Poster)