Few-Shot Transferable Robust Representation Learning via Bilevel Attacks
Authors: Hyeonjeong Ha
Minseon Kim
Sung Ju Hwang
Venue: Submitted to ICLR 2023 (2023)
Keywords: robust meta-learning
unseen domain
self-supervised learning
robustness

Abstract: Existing adversarial learning methods for enhancing the robustness of deep neural networks assume the availability of a large amount of data from which we can generate adversarial examples. However, in an adversarial meta-learning setting, the model needs to train with only a few adversarial examples to learn a robust model for unseen tasks, which is a very difficult goal to achieve. Further, learning transferable robust representations for unseen domains is a difficult problem even with a large amount of data. To tackle such a challenge, we propose a novel adversarial self-supervised meta-learning framework with bilevel attacks which aims to learn robust representations that can generalize across tasks and domains. Specifically, in the inner loop, we update the parameters of the given encoder by taking inner gradient steps using two different sets of augmented samples, and generate adversarial examples for each view by maximizing the instance classification loss. Then, in the outer loop, we meta-learn the encoder parameter to maximize the agreement between the two adversarial examples, which enables it to learn robust representations. We experimentally validate the effectiveness of our approach on unseen domain adaptation tasks, on which it achieves impressive performance. Specifically, our method significantly outperforms the state-of-the-art meta-adversarial learning methods on few-shot learning tasks, as well as self-supervised learning baselines in standard learning settings with large-scale datasets.

Under review as a conference paper at ICLR 2023
FEW-SHOT TRANSFERABLE ROBUST REPRESENTATION LEARNING VIA BILEVEL ATTACKS
Anonymous authors Paper under double-blind review
ABSTRACT
Existing adversarial learning methods for enhancing the robustness of deep neural networks assume the availability of a large amount of data from which we can generate adversarial examples. However, an adversarial meta-learning setting, the model needs to train with only a few adversarial examples to learn a robust model for unseen tasks, which is very difficult goal to achieve. Further, learning transferable robust representations for unseen domains is difficult problem even with a large amount of data. To tackle such a challenge, we propose a novel adversarial sele-supe meta-lcarning framework with bilevel attacks which aims to learn robust representations that can generalize across tasks and domains. Specifically, in the inner loop, we update the parameters of the given encoder by taking inner gradient steps using two different sets of augmented samples, and generate adversarial examples for each view by maximizing the instance classification loss. Then, in the outer loop, we meta-learn the encoder parameter to maximize the agreement between the two adversarial examples, which enables it to learn robust representations, We experimentally validate the effectiveness of our approach on unseen domain adaptation tasks, on which it achieves impressive performance. Specifically, our method significantly outperforms the ttate-of-the- art anva-aaversarial learning methods on few-shot learning tasks, as well as self- supervised learning baselines in standard learning settings with large-scale datasets.
INTRODUCTION
Deep neural networks (DNNs) are known to be vulnerable to imperceptible small perturbations in the input data instances (Szegedy et al., 2013). To overcome such adversarial vulnerability of DNNs, adversarial training (AT) (Madry et al., 2018), which trains the model with adversarially perturbed training examples, has been extensively studied to enhance the robustness of the trained deep network models. While the vast majority of previous studies (Zhang et al., 2019; Carlini & Wagner, 2017; Moosavi-Dezfooli et al., 2016; Wang et al., 2019; Rebuffi et al., 2021) have been proposed to defend against the adversarial attacks that maximize the classification loss, they assume the availability of a large amount of labeled data. Even with the recent progress in adversarial supervised learning, training on a large number of samples is essential to achieve better robustness (Carmon al., 2019; Rebuffi et al., 2021; Gowal et al., 2021). Recently, Carmon et al. (2019) employs larger dataset (i.e., TinyImageNet (Le & Yang, 2015)) with pseudo labels, Gowal al. (2021) utilizes generative model to generate additional samples from the dataset, and Rebuffi et al. (2021) leverages augmentation functions obtain more data samples.
On the other hand, a meta-learning framework (Koch et al., 2015; Sung et al., 2018; Snell et al., 2017; Finn et al., 2017; Nichol et al., 2018) which learns to adapt new task quickly with only a small amount of data, has been also known to be vulnerable to adversarial attacks (Goldblum al., 2020). Since meta-learning employs scarce data and has to adapt quickly to new tasks, is difficult to obtain robustness with conventional adversarial training methods which require large amount of data (Goldblum et al., 2020). Adversarial Querying (AQ) (Goldblum et al., 2020) proposed an adversarially robust meta-learning scheme that meta-learns with adversarial perturbed query examples with AT loss (Madry et al., 2018). Similarly, Wang et al. (2021) studies how to enhance the robustness of meta-learning framework with the adversarial regularizer in the inner adaption or outer optimization. However, previous works (Goldblum et al., 2020; Wang et al., 2021) show poor robustness unseen domains (see Table 1).

---

Under review as a conference paper at ICLR 2023
Papsan, sagransaiinn
Viiwn S(PE)
FO
F(O)
Qpery
(a) Robust meta-learning
(b) Inner adaptation
(c) Meta optimization
Figure 1: Overview of TROBA. (a) TROBA adapts the encoder to differently augmented sets of the support sets (blue, purple line). Then, it meta learns (black line) with both adversarial loss (red) and self-supervised loss (yellow). (b) During the inner adaptation, TROBA adapts encoders with the differently augmented support sets. (c) To generate adversarial examples for meta leaanlea we propose a bilevel attack with the instance siine wise attack that maximizes the difference between differently augmented query images, for the task- shared encoder f. Then, we train the framework to have an adversarially consistent prediction across multiple views with self-supervised loss while learning the encoder generalize across tasks, which enables it to learn robust representations that are transferable to unseen tasks and domains.
Since existing adversarial meta-learning approaches ( (Yin et al., 2018; Goldblum et al., 2020; Wang et al., 2021) mostly focus on the rapid adaptation to new tasks, while mostly reusing the features with little modification at the task adaptation step (Oh et al., 2020), the representations themselves may not be effectively meta- meta-learned to be robust across tasks, and thus they fail to achieve robustness when applied to unseen datasets (Section 4.1). The t-sne visualization of the feature space of AQ in Figure 2 shows that the embeddings of the adversarial examples have large overlaps across classes, which confirms this point.
To tackle such challenges, we propose novel and effective adversarial meta-learning framework which can generalize to unseen domains, Transferable RObust meta-learning via Bilevel Attack (TROBA). TROBA utilizes a bilevel attack scheme meta-learn robust representations that can generalize across tasks and domains, motivated by self-supervised learning (Figure 1). Specifically, redesign the instance wise attack proposed in Kim et al. (2020); Jiang et al. (2020) which maximizes the instance classification loss, by adapting the shared encoder to two sets of differently augmented samples of the same instance with inner gradient update steps and then attacking them (dynamic instance- -wine attack). Then, our framework learns to maximize the similarity between the feature embeddings of those two attacked samples, while meta-learning the shared encoder by BOIL (Oh et al., 2020), which allows it to learn robust representations for any given set of augmented samples. Since the robustness is achieved at the representation level without consideration of the labels rather than at the task level, our framework can generalize to unseen tasks and domains.
The experimental results from multiple benchmark datasets show that our aeta-adversarial learning framework is not only robust on few-shot learning tasks from seen domains (Table 3) but also on tasks from unseen domains (Table 1, 2) thanks to its ability to learn generalizable robust representations. Morcover, model even obtains comparable robust transfcrability to the self-supervised pre-trained models while using fewer data instances (Table 7). Our contributions can be summarized as follows:
We propose a novel adversarial heeannna framework with bilevel attacks, which allows the model to learn generalizable robust representations across tasks and domains.
Our framework obtains impressive robustness in few-shot tasks both in the seen domain and the unseen domains. Notably, on unseen domains, our model outperforms baselines by more than 10% in robust accuracy without compromising the clean accuracy.
Our framework achieves impressive robust transferability in unseen domains, that are com- petitive with that of the model pre-trained by SSL with larger data, while using significantly smaller amount of data for training.
2 RELATED WORK
Meta-Learning. Meta-learning (Thrun& & Pratt, 1998) aims to learn general knowledge across the distribution of tasks that can be utilized to rapidly adapt to new tasks with a small amount of data. Meta-learning approaches can be broadly categorized into metric-base (Koch et al., 2015; Sung al., 2018; Snell et al., 2017) gradient- based (Finn al., 2017; Nichol et al., 2018) approaches,
2

---

Under review as a conference paper at ICLR 2023
and in this work, focus the gradient-based approaches to benefit from their versatility. Perhaps the most popular work in this direction is Model Agnostic Beaannn (MAML) (Finn et al., 2017) which uses bilevel optimization scheme. MAML consists of inner- and outer-optimizttoon loops, where in the inner loop, the model takes a few gradient steps to quickly adapt to a new task and in the outer loop, the parameters are meta-updated to generalize multiple tasks. To efficiently reuse the features of the encoder, ANIL (Raghu et al., 2019) updates only the classification head in the inner loop while keeping the encoder fixed. On the other hand, Oh et al. (2020) propose BOIL, which meta-learns the feature extractor while keeping the final classifier fixed, and show that it has better generalization over cross-domain adaption tasks compared to MAML or ANIL. Various approaches have been proposed to efficiently update the meta-learner; Li et al. (2017) propose to meta-learn the learning rate for each parameter, Li et al. (2017) propose to reduce the computation costs of MAML. with first-order approximation in the inner loop, and Nichol et al. (2018) propose to repeatedly sample a task to move the initialization toward the task.
Adversarial Training. Many existing works aim to enhance the robustness of model trained with supervised learning with labeled data, by utilizing adversarial examples generated by applying perturbations that can maximize its loss (Goodfellow et al., 2015; Carlini & Wagner, 2017; Papernot et al., 2016). The most popular approach to enhance the robustenss of general DNNs is Adversarial Training from Madry et al. (2018). which utilizes project gradient descent (PGD) to maximize the loss in the innermaximizztion loops while minimizing the overall loss on adversarial samples generated by the PGD attack. Zhang et al. (2019) theoretically shows the trade-off between clean accuracy and robustness in adversarial training (TRADES), and introduces regularized Kullback- Leibler divergence (KLD) loss that helps to enhance the robustness by enforcing the consistency in the predictive distribution between the clean and adversarial examples.
Adversarial Meta-Learning. Although meta-learning contributes to learning useful generalizable knowledge with scarce data, existing state-of-the-art meta-learning approaches are prone to adversarial perturbations. To tackle this problem, Yin et al. (2018) attempt to combine adversarial training (AT) (Madry et al., 2018) with MAML (Finn et al., 2017), referring the problem as adversarial meta-learning (A (ADML). ADML uses clean and adversarial examples simultancously to update the parameters both in the inner and outer optimization, and thus requires a high computational cost. However. Goldblum et al. (2020) later point out that ADML (Yin et al., 2018) may not obtain good robustness to strong attack since it uses relatively weak attacks during training. Then, they propose an adversarially robust meta-learner, Adversarial Querying (AQ), which trains with adversarial examples only from the query set. Wang et al. (2021) studies how to obtain robustness in meta-learning framework and suggest Robust-regularized meta-learner on top of the MAML (RMAML), where adversarial attacks are conducted only in the meta- optimization phase as in AQ (Goldblum et al., 2020). However, previous adversarial meta-learning methods are still vulnerable to adversarial attacks on unseen domains. This is mainly because they do not result in learning robust representations, as observed in Oh et al. (2020), Goldblum et al. (2020) and Wang et al. (2021), as the representations are reused with little updates during inner optimization steps. Thus the effect of meta-learning is minimal on the learned representations, which prevents them to achieve generalizable robustness. To tackle such a limitation, we propose a robust self-supervised meta-learning framework via bilevel attacks which meta-learns the representation layers to generalize across any adversarial learning tasks that are generated from randomly sampled instances.
3 TRANSFERABLEF ROBUST META-LEARNING VIA BILEVEL ATTACKS
One of the ultimate goals of meta- learnin is the generalization to unseen domains and tasks. Learning transferable robust representations that can generalize to unseen domains is a difficult problem even with large amount of labeled data. Yet, we aim to tackle this challenging problem only by learning with few samples per category, but with an effective meta-learning framework with a bilevel attack scheme. Before describing our methods, we first elaborate on the preliminaries of our framework.
3.1 PRELIMINARIES
Model-Agnostic Meta-Learning. Let us denote the encoder as fo and classifier as hy. Since meta-learning aims to learn to learn the new tasks, it needs to train on large number of tasks
3

---

Under review as a conference paper at ICLR 2023
sampled from task distribution p(T), where given task consists of the support set S, and the query set Q2 E D. Each set contains a n-way k-shot classification task, that classify n classes with images, Le., X i instances. The most popular framework for meta-learning is model-agnostic meta-learning (MAML) Finn et al. (2017), which meta-learns the model with a bilevel optimization scheme, with inner optimization and outer meta-level optimization steps. During the inner optimization, we adapt the shared initial parameter to each new task T to obtain task-adaptive parameters O and p", by taking a few gradient steps, as follows:
0%, = O, VVV.,sss (No)))
(1)
where S, is a support set of task 7, a is the step size and is a task-specific loss to conduct gradient step for inner updates (e.g. cross-entropy loss). There also exist different variants of the MAML framework with respect to which parameters to update. ANIL (Raghu et al., 2019) only meta-learns the final linear layer while fixing the encoder (i.e., H = 9). for rapid adaptation reusing the features. On the other hand, BOIL (Oh et al., 2020) only meta-learns the encoder, thus the representation layers, while keeping the final classifier fixed (i.e., μ = p!). We employ BOIL. (Oh et al., 2020) which only updates the encoder because our focus is on learning generalizable robust representations. In the meta-optimizztion phase, model parameters are updated with meta-objective via stochastic gradient descent (SGD) as follows:
new task while
0, + 1, BV.. (hy (for)),
where Q, is query set of task J, ,8 is meta step size and L is meta-objective. The meta-objective is a summation of losses from the query set of all given tasks, where the losses depend on what aims to be meta-leamed. To reduce the computation overhead in MAML, use Meta-SGD (Li et al., 2017) which learns the learning rate of parameters that enables to initialize and adapt any differentiable learner single step.
Attacking a meta-learner. To obtain robustness on few-shot tasks, Adversarial Querying (AQ) (Goldblum et al., 2020) proposes to generate attacks with only the query examples. The AQ employs the project gradient descent attack (PGD (Madry al., 2018)), which is class-wise attack that maximizes the cross-entropy on a given query image as follows,
8+41 IIB(s9 (6 ysign (V (hyr (Jor (x" + +.')))
(3)
where x9 and y" is a query image and its label of task respectively, B(x x² + c) is the loc norm-ball around x with radius c, y is step size of the attack, 8 is perturbation and the cross entropy loss (Loz) is calculated on the inner updated parameters (0T,, (4T,
Robust training loss. Various adversarial training methods have been proposed to enhance the model's robustness to adversarial attacks (Appendix A. Among them, we adapt the TRADES (Zhang et al., 2019) loss to improve robustness. TRADES proposes to regularize the model's outputs the clean and adversarial examples with Kullback- divergence (KLD) as follows:
LTRADEE LeR (lypr (Jor (x²)),,> v²)) 3
max SE ((2
LiT, (hyr (Sor (x9))) (Jo- (x + 8)))
where Lee is cross-entropy loss clean examples, LxL is KLD loss between clean and adversarial logit to obtain robustness, and 33 is a regularizer to control the trade-off between clean accuracy and robustness which normally set as 6.0. In our framework, we calculate the adversarial loss on query sets (x9, y²), which are different instances used in inner adaptation, to meta-learn robust representations in the meta-optimization phase.
3.2 ADVERSARIAL META-LEARNING WITH SELE-SUPERVISED LEARNING
Bi-level parameter augmentation in adversarial meta-learning. In recent self-supervised leam- ing (Chen et al., 2020; He et al., 2020; Grill et al., 2020), image augmentation is applied to produce multiple views of the same instance, which is used to learn non-linear transformation represen- tation space that leads to learning good quality of the visual representations. Motivated by the self-supervised learning concept, have transferable robustness in meta-learning, we propose
4

---

Under review as a conference paper at ICLR 2023
Algorithm 1 Transferable robust meta learning via bilevel attack (TROBA)
Require: Dataset D. transformation function t ~ T
Require: Encoder /, parameter of encoder 0, classifier h, parameter of classifier j
Require: adversary A(base, target, parameter)
while not done do
Sample tasks {r). Support set S(2", Query set Q(19, for i = 1. do
Transform input 1 (z=),, 12 (a=)
Fine-tune model with & (x"), y" and updates parameter OT
Fine-tune model with &2 (2(x),, y and updates parameter 05
Generate adversarial examples
t1 (xz) A(1 (z te2"),t(r"") (2("), (T))) to (2(2))ad A(t2((x)) (z²), 85)
Calculate losses on query set images
TTRADES: = Lce (hp (1 (foz j (41 (,*")),,"* + fxi (Joz (4 (2.)) Jor (41 (29))dd))
LIRADESS = Lax (fog (f2(2"))) ))),)))))))))))))))))))))))))) + LxL (xo (t2(x")), ; fog (t2 (x)))add
Loelf-oup = Caimilaritylo (Soz (19)ade), ), foz (12 (29)))))))
Lour LIRADES; + LTRADES, + foolf-oop
Compute gradient g" Voz 07 Cour
end for Update model parameters
8, 4 t 8, Σg" end while
bilevel parameter augmentation with self-supervised learning. Bilevel parameter augmentation en- ables the model to adapt the view-specific projected latent space to set of augmented samples of the given instance. Specifically, generate augmented parameters of the encoder, we first generate multiple views of images with stochastic data augmentation function & that is randomly selected from the augmentation set T, including random crop, random flip, random color distortion, and random grey scale as Zbontar et al. (2021). We then apply two random augmentations t1, f2 ~ to images from both support set (S = (xx),, (2xx),
), y² }) and query set (Q - (4 (x9), (2(x)), y²)).
Then, we generate multiple views of the shared parameters (0ī and 03) which are adapted parameters of encoder with differently transformed support sets (S, = (<1(), 12(x²), y²) }) as shown in Figure 1. Overall, we introduce parameter-level augmentation along with image-level augmentation to form a different view of single instances in the meta-lcarning framework, which we refer to as bilevel parameter augmentation.
Bilevel attack with dynamic instance-wise attack. On top of bilevel parameter augmentation, we propose a bilevel attack with dynamic instance-wise attack to obtain generalized robustness in few-shot tasks. We redesign the bastance-wise attack introduced in the self-supervised adversarial learning (Kim et al., 2020; Jiang et al., 2020), which generates adversaries by maximizing the instance classification loss in Equation 3. Specifically, we apply an instance-wise attack on our meta-learning framework, by generating adversaries that maximize the difference between the representations of the augmented samples of the same instance obtained by the encoder whose parameters are adapted to each view, as follows:
8t 11 +c) (8 + asign (v Coimilarity (fer (t1(x + 61), for (t
(5)
g++1 = II
8/ + asign V Caimitarity (feg (t2(x9) + 85), foz (t1(2
where 8, 52 are generated perturbations to maximize the difference between features from each bilevel augmented encoder ((FF and f05) respectively. The maximized loss Caintlarity is the instance-wise classification loss used in adversarial self-supervised learning (Kim et al., 2020). We use the differently transformed query counterpart sets as a target for dynamic instance wiise attack and calculate perturbations with the parameter of the augmented encoder.
Adversarial meta meta-nearning with bilevel attack. We now present a framework learn transferable robust representations via bilevel attack for unseen domains. The gradient (g) is calculated to minimize our proposed objective as follows:
g Voy.0 00.00%.0 Lour (byp foy foz L1 (29), (19) 112(x9), 1e (2(2:)) (ady ),
Cour
(6)
5

---

Under review as a conference paper at ICLR 2023
Table 1: Results of transferable robustness in S-way 5-shot unseen domain tasks that are trained on 5-way 5-ohot CIFAR-FS. Rob. stands for accuracy (%) that is calculated with PGD- 20 attack (c = 8./255., step size=e/ 10). Clean stands for test accuracy( (6) of clean images. All models are trained with PGD-7 attacks on 12.
CIFAR-FS +
Mini- Mati-lmmaeNNet
Tiered-ImageNet
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Roh.
Clean
Roh.
Clean
Roh.
MAML (Finn et al. 2017)
44.85
6.21
61.19
2.48
48.41
3.46
67.76
5.73
43.94
5,31
ADMI. (Yin et al., 2018)
28.66
6.53
40.06
11,36
31.18
5.21
39.36
11.26
27.43
3.18
AQ (Goldblum et al., 2020)
33.09
3.32
37.41
5,05
38.37
4.10
60.14
11.03
36.83
4.47
RMAML (Wang et al., 2021)
28.05
6.65
29.54
9.30
30.24
5.67
42.91
10.79
31.72
5.56
Ours
45.82
24.12
51.46
30.06
48.56
25.23
66.49
42.16
38.29
19.43
where Cour is the meta-objective loss to obtain generalized robustness, h2 is a meta-initialized classifier, and fe, and fo, are bilevel augmented encoder for each view. Further, the Cour consists of adversarial loss, i.e., TRADES (Zhang et al., 2019) loss, and self-supervised loss as follow,
Lour = =E [[eeel y²) + Lxx Ln] + Suele-sup 22du), n=1
where 2,, foz (Lx((() and L, (z() are a feature and logit of each multi-view instance with augmented encoder Jog and meta-initialized classifier hy respectively, Cçs. is a cross-entropy loss, padv is a logit of an attacked image generated from our bilevel attack which is dynamic instance-wise attack, fxt. a KL-divergence loss, and Seelr-sup is cosine similarity loss between two differently augmented features. This sum of the cross-entropy and KL-divergence loss is the TRADES loss to learn robustness for each augmented encoder for each task (Equation 4). The crucial component here is the self-supervised loss which regularizes features from the two different views, which helps it learn robust representations across any instances or augmentations, allowing it to achieve transferable robustness. The overall algorithm of TROBA is described in Algorithm 1.
model have robust consistency between the
4 EXPERIMENT
In this section, first validate the robustness of our model in unseen domain few-shot learning tasks (Section 4.1). Then, we analyze our model through ablation experiments on the type of loss, attack, and augmentations (Section 4.2). Specifically, our models also show comparable transfer robustness to that of the self-supervised framework trained a standard learning setting with large datasets, although we use a significantly smaller amount of data for pre-training (Section 4.3).
Experimental Setup. For meta-learning setting, we train our approach on ResNet12 with 5-way 5-shot images in both CIFAR-FS and Mini-ImageNet. We train our model with the BOIL (Oh et al., 2020) framework, and take a single step in both inner and outer optimization as done in (Li et al., 2017) during meta-training and the inner optimization of meta-testing steps. We adversarially train our model with &o PGD attacks with the epsilon of 8/255, alpha of 2/255 in steps. We evaluate the robustness against foo PGD attacks with the epsilon of 8/ 255 and 20 iterations for evaluation, following the standard procedure. The code will be available in Anonymous. More experimental details are in Appendix B.
4.1 RESULTS OF ADVERSARIAL ROBUSTNESS IN FEW-SHOT TASK
Robustness in unseen domain. Since our main goal is achieve transferable robustness in unseen domains, we mainly validate our meth- ods on unseen domain few-shot tasks. We meta- train our model on CIFAR-FS and meta-test on the benchmark datasets with different domains such as Mini-ImageeNet, TTered-Imagehty Flowers, and Cars. As shown in Table 1, pre- vious adversarial meta-learning methods have difficulty in achieving robustness on unseen do- mains. However, TROBA is able to show impressive
eaplune cutombiie
strp automable tid
Erd
therr
CUB,
(a) AQ
(b) TROBA
Figure 2: Visualization of feature on unseen domains, 11FARR10,,where models are trained on CIFAR-FS
robusthess in this cross-domain

---

Under review as a conference paper at ICLR 2023
Table 2:
Results of transferable robustness 5-way 5-shot unseen domain tasks that are trained on 5-way 5-shot Mini- Minii-mmaeeNe.. Rob. stands for accuracy(%) that is calculated with PGD-20 attack (e = 8./255.). Clean stands for test accuracy($)) of clean images, All models are trained with PGD-7 attacks on ResNet12.
Mini-Imagell
CIFAR-FS
Tiered- Metee--T
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
MAML (Finn et al., 2017)
66.75
12.97
65.33
13.10
52.82
4.46
71.01
4.86
43,66
2.77
ADML (Yin et 2018)
41.14
13.36
41,05
13.26
32.82
4.59
43.07
9.65
24.85
5.48
AQ (Goldblum et al., 2020)
61.97
30.73
47.61
14.21
45.64
13.19
65.40
25.01
37.29
8.85
RMAMI. (Wang et al., 2021)
37.94
10.59
30.49
8.24
27.30
6.26
42.52
13.08
37.76
5.43
Ours
65.45
36.51
59.64
29.73
53.70
20.64
69.84
36.49
42.25
14.42
Table 3: Comparison in the 5-shots seen domain tasks. All models are trained on CIFAR-FS and Mini- Amai-ema,,ee,, respectively, with PGD-7 attack in ResNet12. stands for reported results in Wang et al. (2021).
Table 4: Results of TROBA with different meta- learning frameworks in 5-shot tasks. All models are trained on CIFAR-FS and Mini-ImageNet, respec- tively, with PGD-7 attacks in ResNet12.
CIFAR-FS
Mini ImageNet Roh.
CIFAR-FS
Mini- ImageNet Clean
Clean
Roh
Clean
Rob.
ADML (Fian et al. 2017)
$3.06
22.45
26.72
6.81
TROBA
(Goldhlum al, 2020)
73.49
28.49
39.47
13:52
MMML (Finn al., 2017)
52.79
32.50
37.58
14.23
RMAMI. (Wang et al., 2021)"
57.95
35.30
43.98
21.47
+FOMAML (Finn et 2017)
53.42
35.95
33.87
15.60
Ours (Li al., 2017)
64.90
43.34
47.56
18.18
+Meta-GGD (Li et al., 2017)
64,90
43.34
47,56
18.18
task. also obtains significantly better clean accuracy over the adversarial meta-learning baselines, while obtaining competitive clean accuracy to MAML. In particular, TROBA shows better robustness compared to baselines even though the distribution of the unseen domain is highly different from the distributions of the meta-trained dataset (i.e., CUB, Flowers, Cars).
Further visualization of the representations of the instance- wise adversarial samples from the unseen domains shows that our model able to obtain well-separated feature space for attacked samples on this novel domain (CIFAR-10 10) even before adapting to it, while the previous adversarial meta- leatallennnng framework learns a feature space with large overlaps across the adversarial instances belonging to different classes (Figure 2). This suggests that the superior performance of our model (Table 1, 2) mainly comes from its ability to learn such transferable robust representations. In particular, TROBA has smoother loss surface to adversarial examples compared the bascline, which is why TROBA could demonstrate
(a) AQ
(b) Ours
Figure 3: Loss surface of unseen domain (Mini-ImageNett)
better robustness in unseen domain (Figure 3).
Robustness in seen domain. Even though TROBA is designed have transferable robustness in the unseen domain, our methods also show better robustness in seen domain few shot tasks compare to baselines, even with better clean accuracy (Table 3). addition, TROBA shows smoother loss surface to ad adversarial examples which also directly associated with better robustness and generalization (Figure 4). Our method is agnostic the meta- meta-learning approach, as shown in Table 4, which suggests that the type of meta-learning the main factor in achieving the transferable robustness. We only update the encoder
(a) AQ
(b) Ours
Figure 4: Loss surface seen do- main (CIFAR-FS)
strategy
in the inner optimization for all meta-learning algorithms.
4.2 ABLATION STUDY
To examine each component of our proposed methods, we conduct the ablation study on augmentation, loss. and attack. Through our ablation study, we verify the effectiveness of each component by their robustness on unseen domains.
Bilevel parameter augmentation contributes to learn generalized features. As shown in Ta- ble 5, image-only augmentation alone meaningfully contributes to learning generalized features
7

---

Under review as a conference paper at ICLR 2023
Table Ablation study of our proposed bilevel augmentation. Test accuracy($) on seen domain (CIFAR-FS) and unseen domains (Mini- (Mini-ImageNee ImageNet, Flower, Cars) of 5-way 5-shot task. Robustness is calculated with PGD-20 attack(e = 8,/255, step size=e/10), clean stands for accuracy of clean images. All models are adversarially meta-trained on CIFAR-FS with attack step 3 due to computation costs.
Augmentation level
CIFAR-FF
Mini-ImageNee
Tiered Imageeet
Cars
Image Aug.
Parameter Aug.
Clean
PGD &x
Clean
PGD too
Clean
PGD 6oo
Clean
PGD foo
63.10
36,98
15.08
51.57
25.05 28.05
38.99
14.36
65.82
41.39
44.64
15.75
53.25
40.08
16.88
Robust Accuracy (%)
80
CE+selfsup TRADES
Ours
O CE
TRADES
Ours
Accuracy (%)
30
40
20
10
0
CIFAR-FS
Mini
Tiered
Flower
CUB
CARS
Mini
Flower
CARS
Clean Accuracy
(b) Robustness
Figure 6: Ablation on meta-objectives in TROBA. Test accuracy(%) on the seen domain (CIFAR-FS) and unseen domains (Mini: Mini- Mini-ImageNet, Tiered: Ticred- Irreed-tmeeNet,, Flower, CUB, Cars) of 5-way 5-shot task. Legends denote the meta-objectives loss that used to train the model. All models adversarially meta-traing CIFAR-FS with attack step 3 due computation overhead. (a) Clean accuracy stands for the accuracy of clean images. (b) Robustness is calculated with PGD-20 attack(e 8./255., step size=e/10)
for unseen domains. However, when we apply parameter augmentation on top of the image aug- mentation, the model achieves significantly better clean and robust accuracy than the model trained with image-only augmentation, especially in the seen domain. This suggests that the bilevel pa- rameter augmentation is effective in learning consistent representations across tasks and views. To support our claim, we calculate the Centered Kerne Alignment (CKA) (Kornblith al., 2019) value, which measures the similarity between representations (When representations are identical, the CKA is 1). As shown Figure 5, when bilevel parameter augmen- tation is applied, features from the augmented parameters dissimilar than features with image augmentation only. These results show that bilevel parameter augmentation may generate more different multi-views of the same instances which helps learn invari- representations across views, that help it to achieve generalizable robustness.
0.20
clean
adv
0.15
Imaga Aug.
Bi-level Aug.
Figure 5: Effect of augmentation
Self-supervised loss regularized learn generalized features. TROBA leverages both adversarial loss and self- suf--sueeeieed loss in meta-objective; specifically, it uses TRADES loss (Equation 4) and cosine similarity loss between representations differently bilevel augmented views, as shown in Equation 7. The adversarial loss is calculated independently in each bilevel augmented network to enhance the robustness on each training sample. On the other hand, the self-supervised loss is computed between the representations of each bilevel augmented encoder enforce the consistency across features for samples attacked with our bilevel attack, which helps it to obtain a consistent representation space across perturbations and instances, which helps with its generalization (Figure 6). Notably, the self-supervised loss has a larger contribution when we conduct transfer learning to unseen domains with larger data (Appendix D.2).
Bilevel attack makes the model be robust on unseen domain attacks. We further analyze the effect of our bilevel instance- wise attack compared class-wise attack in Table 6. We observe that ad- versarial examples that are attacked with instance-win wise attack make the model more robust in unseen domains compared to class-wis attack. Specifically, instance-wise attack generates adversaries that have larger difference to clean examples in the representation level, and thus can be thought stronger attack. To demonstrate the effectiveness of instance- wise attack, we calculate CKA (Kornblith al., 2019) between clean and adversarial features from each bilevel augmented parameters. As
Cless-wise
Instance-wfae
0.80
0.70
view22
Figure 7: Effect of type of attack
8

---

Under review as a conference paper at ICLR 2023
Table 6: Ablation study of our proposed bilevel attack. Test accuracy(%) on seen domain (CIFAR- -FS and unseen domains MMine-mmageNet, Tiered- Image-e, Flower, Cars) of 5-way 5-shot task. Clean stands for accuracy of clean images. Rob, stands for robust accuracy that is calculated with PGD-20 attackle = 8./255.).
All models are adversarially meta-trained on CIFAR-FS with attack step 3 due to computation costs.
CIFAR-FE FS
Mini Mini-ImageNer
Tiered- ImageNet
Flowers
CUB
Attack type
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Bi-level class wise
66.69
40.48
42.15
17.13
53.91
27.4
69.66
38.83
50.01
21.2
Bi-level instance- wise
63.82
41.39
44.64
15.75
53.25
28.05
70.08
41.52
50.78
22.44
Table 7: Experiments results in robust full-finttuning of TROBA and the state-of-the-art adversarial self- supervised learning (SSL) models. While TROBA is trained CIFAR-FS, other models trained the LIFAR-10.. TROBA is pre-trained with bilevel attacks with 3 steps due to computational overhead. others are pre-traiend with PGD-7 attacks. All models are trained on ResNet18. We evaluate all models with PGD-20 steps and AutoAttack (AA) (Croce & Hein, 2020) with c8//255.
CIFAR-10
STL-10
CIFAR-100
Method
Clean
PGD-20
AA
Clean
PGD-20
AA
Clean
PGD-20
AA
RoCL (Kim 2020)
76.76
50.72
45.52
60.44
31.90
27.38
51.91
27.77
22.79
SSL
ACL (Jiang et al., 2020)
75.99
50.35
45.50
63.46
30.24
25.73
51.91
27.77
22.79
BYORL (Gowal et al., 2020)
76.39
50.51
45.37
62,85
28.15
24.23
52.37
28.09
23.11
Ours (3 steps)
74.26
49.38
44.31
53.46
32.65
28.96
50.23
27.05
21.96
shown in Figure 7, instance-wise attack produces more difficult adversarial examples that are highly dissimilar from clean instances. However, when the parameter is augmented with bilevel parameter augmentation, the class-wise attack also can show transferable robustness since self sulervupee loss supports it to obtain generalized robustness.
4.3 TRANSFERABLE ROBUSTNESS IN DIFFERENT DOMAINS
To demonstrate the power of our adversarially transferable meta-trained model, we further evaluate our model on a standard transfer learning scenario that employs full data to fully train the encoder with the linear layer on top of it. Specifically, we want to evaluate the generalizable robustness of the representations learned by our encoder against a self-supervised learning model trained with a large amount of data. We evaluate our model the seen domain, CIFAR- 100, as well as on two unseen domains, which are CIFAR-10 and STL-10 respectively. As shown in Table 7, our model shows comparable clean accuracy and robustness in the unseen domains despite the difference in the amount of data used to train the model. Our model is pre-trained with scarce data, and we have even reduced the number of the steps for the bilevel attack cost, but obtains competitive performance to the model trained with larger data. The experimental results suggest that we may use our method as a means of pretraining the representations to ensure robustness for a variety of applications, when the training data is scarce.
steps to reduce the computational
5 CONCLUSION
We proposed novel adversarial self-supervised meta-learning framework that can learn transferable robust representations using only few data via bilevel attack, which introduces novel bilevel parameter augmentation along with dynamic instance-wist attack. Specifically, the bilevel attack leverages self-supervised learning effectively generate robust representation of multi-views with differently augmented encoder, which allows learning non-linear transformation task-adaption that brings good robust generalization power. While previous adversarial meta-learning methods extremely vulnerable to unseen domains, our model learned generalized robust representations which can demonstrate impressive transferable robustness on few-shot tasks in unseen domains. Moreover, we validate our models on larger data in unseen domains which shows comparable robust representations with eeffssupee learning (SSL) model with much fewer data. We hope that our work inspires adversarial meta-learning obtain a good robust representations only using few data.

---

Under review as a conference paper at ICLR 2023
REPRODUCIBILITY
Datasets. We use CIFAR-FS,, Mini-ImageNet, Tiered-ImageNet, CUB, Flower, and Cars for few-shot learning tasks. Further, we use CIFAR- 10, CIFAR-100, STL-10 10 for standard image classification tasks in transfer learning. More details are in Supplementary B.1.
Meta-frain. We trained models CIFAR-FS and Mini-ImageNet with ResNet12 and ResNet18 as the base encoder. All models are trained on 5-way 5-shot support set images and 5-way 15-shot query images. More details are in Supplementary B.2.
Meta-fest. We evaluate our models on few-shot learning tasks as described in Supplemen- tary B.4. For adversarial setting for few-shot robustness is written in Supplementary B.5.
Table 2, 3. Please see Section 4. and Supplementary B.2, B.4 reproduce the results in those Table.
Table 4, 9. Please see Section 4. to reproduce the results, and more details for hyperparam- eters are in Supplementary B.3. For adversarial setting, see Supplementary B.5,
Table 5. Please see Section 4.2 and Supplementary C.I to reproduce the Table 5, Detailed algorithm for bilevel parameter augmentation and image-only augmentations we utilized are described in Algorithm and Algorithm 2, respectivley.
Table Please see Supplementary C.2 to reproduce the Table 6. Bilevel attack is explained in Section 3.2, 4.2.
Table 7, 10, 12. Please see Supplementary C.5 to check the baselines, and see Supplemen- tary B.5 reproduce the results.
Table 8. Please see Supplementary C.4 to reproduce the results.
Table 11. Please see Supplementary D.2 to reproduce the results.
Table 13. Please see Supplementary F.2 to reproduce the results.
Table 14. Please see Supplementary reproduce the results.
Figure 4, 3. Please Supplementary G to reproduce the results.
Figure 5, 7. Please see Supplementary C.3 to reproduce the results.
REFERENCES
Luca Bertinetto, Joao F Henriques, Philip HS Torr, and Andrea Vedaldi. Meta-learning with differen- tiable closed-form solvers. International Conference on Learning Representationss 2019.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery in databases, pp. 387-402. Springer, 2013.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE symposium on security and privacy (sp). pp. 39-57. IEEE, 2017.
Yair Carmon, Aditi Raghumathan, Ludwig Schmidt, Percy Liang, and John Duchi. Unlabeled data improves adversarial robustness. Advances in Neural Information Processing Systems, 2019.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International Conference on Machine Learning, pp. 1697-1607. PMLR, 2020.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In IEEE Conference on Computer Vision and Pattern Recognition, pp- 15750-15758, 2021.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks, In International Conference Machine Learning, pp. 2206-2211 PMLR, 2020.
Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In International Conference Machine Learning, pp. 111261133 113.. PMLR, 2017.
10

---

Under review as a conference paper at ICLR 2023
Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: A meta-learning approach. Advances in Neural Information Processing Systems, 13:17886-1789 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamesssin adversarial examples. In International Conference on Learning Representations, 2015.
Sven Gowal, Po-Sen Huang, Aaron van den Oord, Timothy Mann, and Pushmeet Kohli, Self- supervised adversarial robustness for the low-label, high-data regime. In International Conference on Learning Representations, 2020.
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 14:4218-4233 2021.
Cean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. Advances in Neural Information Processing Systems, 33:21271-21288, 2020.
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In IEEE Conference on Computer Vision and Pattern Recognition, pp. 9729-9738, 2020.
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness common corruptions and perturbations. International Conference on Learning Representations, 2019.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In Advances in Neural Information Processing Systems, 2020.
Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning.
Advances in Neural Information Processing Systems, 2020.
Gregory Koch, Richard Zemel, Ruslan Salakhutdinov, et al. Siamese neural networks for one-shot image recognition. In ICML deep learning workshop, volume 2, pp. 0. Lille, 2015.
Simon Kornblith, Mohammad Norouzi, Honglak Lee, and Geoffrey Hinton. Similarity of neural network representations revisited. In International Conference on Machine Learning, pp. 3519- 3529. PMLR, 2019.
Ya Le and X. Yang. Tiny imagenet visual recognition challenge. In http://cs233111 Instesoodddd 2015.
Zhenguo Li, Fengwei Zhou, Fei Chen, and Hang Li. Meta-sgd: Learning to learn quickly for few-shot 2017.
learning. arXiv preprint
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018.
Seyed-Mohsee -oosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574-2582, 2016.
Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-leariig algorithms. arXiv preprint arXiv: /803. 009999 2018.
Jaehoon Oh, Hyungjun Yoo, ChangHwan Kim, and Se- Young Yun. Boil: Towards representation
change for few-shot learning. International Conference on Learning Representations, 2020.
Tianyu Pang, Xiao Yang, Yinpeng Dong. Hang Su, and Jun Zhu. Bag of tricks for adversarial training. International Conference Learning Representations, 2022.
Nicolas Papemot, Patrick McDaniel, Xi Wu. Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. In IEEE symposium on security and privacy (sp), pp. 582-597. IEEE, 2016.
11

---

Under review as a conference paper at ICLR 2023
Aniruddh Raghu, Maithra Raghu, Samy Bengio, and Oriol Vinyals. Rapid learning feature reuse? towards understanding the effectiveness of maml. International Conference on Learning Representations, 2019.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation to improve adversarial robustness. Advances in Neural Information Processing Systems, 2021.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang. Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211-255 2015.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. International Conference Learning Representations, 2019.
Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for few-shot learning, Advances in Neural Information Processing Systems, 30, 2017.
Flood Sung, Yongxin Yang. Li Zhang, Tao Xiang, Philip HS Torr, and Timothy Hospedales. Learning to compare: Relation network for few-shot learning. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1 1199-1208, 2018.
Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 13Xiv:1312.6/99 2013.
Sebastian Thrun and Lorien Pratt. Learning learn: Introduction and overview. In Learning to learn, pp. 3-17. Springer, 1998.
Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive multiview coding. In European Conference on Computer Vision, pp. 776-794. Springer, 2020.
Ren Wang, Kaidi Xu, Sijia Liu, Pin-Yu Chen, Tsui- Wei Weng, Chuang Gan, and Meng Wang. On fast adversarial robustness adaptation in model-agnostic meta-learning. International Conference on Learning Representations, 2021.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2019.
Chengxiang Yin, Jian Tang, Zhiyuan Xu, and Yanzhi Wang. Adversarial meta-learning. arXiv 2018
preprint
Jure Zbontar, Li Jing, Ishan Misra, Yann LeCun, and Stéphane Deny. Barlow twins: Self-supervised learning via redundancy reduction. In International Conference on Machine Learning, pp. 12310- 12320. PMLR, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. International Conference on Machine Learning, 2019.
12

---

Under review as a conference paper at ICLR 2023
Supplementary Material
Few-Shot Transferable Robust Representation Learning via Bilevel Attacks
A RELATED WORKS
A.1 ADVERSARIAL LEARNING
The vulnerability of deep neural network (DNN) to imperceptible small perturbation on the input is well-known problem as observed in previous works (Biggio et al., 2013; Hendrycks & Dietterich, 2019; Szegedy et al., 2013). To overcome the adversarial vulnerability, many attack-based approaches for constructing perturbed examples (Goodfellow et al., 2015; Carlini & Wagner, 2017; Papernot et al., 2016) have appeared. On the other hand, Madry et al. (2018) proposes a defense-based approach against adversarial examples. Madry et al. (2018) utilizes a project gradient descent (PGD) in the perspective of robust optimization, which maximizes the loss in the inner- maximizaiii loops while minimizing the overall loss on tasks in outer-minimization loops, the so-called min-max formulation. Zhang al. (2019) theoretically shows the trade-off between clean accuracy and robustness in adversarial training. To improve both clean and robust accuracy. TRADES (Zhang et al., 2019) introduces regularized surrogate loss. Especially, the Kullback-Leibler divergence (KLD) in TRADES (Zhang et al., 2019) helps to enhance the robustness by enforcing consistency between representations of clean and adversarial examples. Afterward, significant advances in adversarial robustness have emerged. Kim et al. (2020); Jiang et al. (2020) proposes self-supervised adversarial learning mechanism coined with contrastive learning to obtain a robust representation without explicit labels. Since larger dataset is essential to have better adversarial robustness, Shafahi et al. (2019) leverages transfer learning to transfer learned robust representations into new target domains with only few data. Goldblum al. (2020) proposes robust supervised meta-learners with adversarial query images in few-shot classification tasks. However, previous works still have difficulty in obtaining generalized robustness on multiple datasets.
A.2 SELF SUPERVISED LEARNING
Conventional adversarial learning mechanisms in a supervised manner require the label information which needs expensive human labeling annotations. Self-supervised learning makes the neural networks possible to learn comparable representations to supervised representations, even it does not leverage labels (Grill et al., 2020). Many previous works focus on learning consistent representations to different distortions in the input (Koch et al., 2015; Chen et al., 2020; He et al., 2020; Tian et al., 2020). To learn the distortion-invarian representations, they enforce consistency between representations of two differently augmented inputs with the same instance-level identity. Especially, Chen et al. (2020) employs contrastive learning to maximize agreement only between positive pairs in mini-batch while negative pairs are handled the opposite. In advance, other works introduce asymmetry into network architecture or parameter update (Chen & Hc, 2021; 1 Grill et al., 2020) to improve performance. However, the existence of trivial solutions derived from asymmetry leaves room to improve. Zbontar et al. (2021) achieves comparable performance by introducing redundancy reduction terms in the training objectives, even does not require additional asymmetric networks or large batches.
A.3 SELF- SELE-SUPERVISED ADVERSARIAL LEARNING
Utilizing the advantages of self- supervseed learning, adversarial training mechanisms in a self- supervised manner have emerged to learn robust representations without relying on label information. Recent works leverage contrastive learning to obtain robust representation in a self-supervised manner (Kim et al., 2020; Jiang et al., 2020). Kim et al. (2020) first devises the instance-wise adversarial perturbation, which does not require explicit labels during the attack, and utilizes those perturbed examples in maximizing contrastive loss. Jiang et al. (2020) introduces dual stream with optimizing two contrastive losses against four augmented views, which are computed between clean views and adversarial images, respectively. However, these approaches highly rely large
13

---

Under review as a conference paper at ICLR 2023
batch sizes effectively create positive and negative samples for the contrastive learning framework. Gowal et al. (2020) injects adversarial examples on top of the BYOL framework (Grill et al., 2020) to achieve robustness to avoid the restrictions on large batch sizes. Although existing restrictions on large batch sizes or image augmentation have been relieved during extensive development in self-supervised adversarial training, obtaining robustness with scarce data is still difficult, even in supervised manner.
B EXPERIMENTAL DETAILS
B.I DATASET
For meta-training we use CIFAR-FS (Bertinetto et al., 2019) and Mini-ImageNet (Russakovsky et al., 2015). CIFAR-FS and Mini-ImageNe consist of 100 classes which 64, 16, and 20 for meta-training, meta-validation, and meta-testing, respectively. We validate our model on 6 benchmark few-shot datasets: CIFAR-FS (Bertinetto et al., 2019), Mini-ImageNer (Russakovsky al., 2015), Tiered-ImageNet (Russakovsky et al., 2015), Cars, CUB and VGG-Flower, for few-shot classification and 3 additional benchmark standard image classification datasets: CIFAR-10 10. CIFAR-100, and STL-10, for robust transferability. CIFAR-10 and CIFAR-100 consist of 50,000 training images and 10,000 test images with 10 and 100 classes, respectively. All images are used with 32x32x3 resolution (width, height, and channel) for meta-training. Especially, we apply TorchMeta' library to load the few-shot datasets into our frameworks.
B.2 META-TRAIN
We meta-train ResNet12 and ResNet18 as the base encoder network on CIRAR-FS and Mini- ImageNet. All models are meta-trained with tasks consist of 5-way 5-shot support set images and 5-way 15shot query set images, and meta-validated with only clean tasks consist of 5-way 1-shot support set images and 5-way 15-shot query set images. Especially, we train the model with randomly selected 200 tasks and validate the model with randomly selected 100 tasks. For optimization, we meta-train
models with 300 epochs under SGD optimizer with weight decay Ic-4. For data augmentation, we use random crop with 0.08 to 1.0 size, color jitter with probability 0.8, horizontal flip with probability 0.5, grayscale with 0.2, gaussian blur with 0.0, and solarization probability with 0.0 to 0.2. We exclude normalization for adversarial training.
In the of adversarial learning, generate adversaries with query set images, we take the gradient step within 1o0 norm ball with 8.0 and a 2.0/255.0 to maximize the similarity with target instance. To obtain robust representation, we utilize an adversarial loss and self-supervised loss which are TRADES (Zhang al., 2019) with a regularization hyperparameter of 6.0 and cosine similarity loss, respectively. Overall TROBA model figure is shown in Figure 8.
proposed bilevel attack with 3 steps and 7 steps. To
Three different meta- meta-learning frameworks are leveraged to train our model, which are MAML (Finn et al., 2017), FOMAML (Finn et al., 2017) and Meta-SGD (Li et al., 2017). Specifically, we only update the encoder parameters in inner optimization for all three meta-learning strategies. Detailed hyperparameters for meta-train and meta-test will be described in B.3.
B.3 HYPERPARAMETER DETAILS OF EACH META-LEARNING FRAMEWORKS
MAML We take single step for both inner optimization and outer optimization to meta-train ResNet12 on CIFAR-FS and Mini-ImageNNe. We use the same learning rate for both datasets, which are 0.3 and 0.08 for outer optimization and inner optimization, respectively. For both dataset, we use batch size 4.
FOMAML To reduce the computational cost, try adapt FOMAML (Finn et al., 2017), which is the first-order approximation of MAML (Finn et al., 2017). For ResNet18, we use a single step in both inner optimization and outer optimization, and use the learning rates 0.3 and 0.4 in outer optimization and inner optimization, respectively. For ResNet12, we use 3 steps for inner
phttps://g http://h......oootaaaaaaaaaaaaaa
14

---

Under review as a conference paper at ICLR 2023
Task my
Adversarial lass
Encoder 0,t
Linear
Task Support Us,))
Encoder
Imago-laval augmentation
Parametor-laval augmentation
Instanco-wise
Self-supervised loss
dynamic attack
Aaborrsen loss
Linear
Query Set (
Support (et
Task 1,2
Figure 8: Overall model figure of TROBA.
optimization, and 1 step for outer optimization. We use learning rate 0.3 and 0.2 for outer optimization and inner optimization, respectively. For both dataset, we use batch size 4.
To learn quickly, we use the Meta-SGD (Li et al., 2017) with the single step. We use single step in inner optimization and the 0.005 inner learning rate. For outer loop, outer learning rate for CIFAR-FS. For Mini-ImageNet, we use a same step size as CIFAR-FS but with different inner learning rate, 0.001, and outer optimization learning rate 0.001. For both dataset, we use batch size 4.
META-SGD
0.005
B.4 META-TEST
The trained models are evaluated with 400 randomly selected tasks from test set, where each task consists of 5-way 5-shot support set images and 5-way 15-shot query set images. We use a single step in both inner optimization and outer optimization. We especially use same learning rate and meta step size as the model is meta-trained.
B.5 ADVERSARIAL EVALUATION
FEW-SHOT ROBUSTNESS We validate the robustness our trained models against two types of attack, which are PGD (Madry et al., 2018) and AutoAttack (Croce & Hein, 2020). All 1.0 PGD attacks are conducted with the norm ball size e = 8./255., step size a = /550.. and with steps of inner maximization. AutoAttack3 is combination of 4 different types of attacks (i.e., APGD-CE, APGD-T, FAB-T, and Square). We use the standard version AutoAttack the test time.
SELF-SUPERVISED ROBUST LINEAR EVALUATION To compare TROBA with self-supervised pre-trained models, we apply robust full-fnettuiing In robust full-finetuning. the parameters of the entire network, including the feature extractor and the fe layer, are trained with adversarial examples. We generate perturbed examples with 4-x PGD-10 10 attack with = 8./25.. and step size a 2./255. training. All adversarially full-finetuned models are evaluated against lax. PGD-20 attack (e 8./255., 8./ /5550.) and Auto (Croce & Hein, 2020). Especially, in comparisons with self-supervised models, we pre-train ResNet18 based on FOMAML (Finn et al., 2017), which is the first-order approximation of MAML (Finn et al., 2017), and apply bilevel attacks with 3 steps to reduce the computational cost. Other self-supervised models are pre-trained with PGD-7 attacks. For optimization, fine-tune the pre-trained models for 110 epochs with batch size 128 under SGD optimizer with weight decay 5c-4, where Pang et al. (2022) demonstrated as optimal for robust fall-finetuning CIFAR datasets.
15

---

Under review as a conference paper at ICLR 2023
Algorithm 2 Transferable robust meta learning via image-only augmentation
Require: Dataset D, transformation function t ~ T
Require: Encoder /. parameter of encoder classifier h, parameter classifier j
Require: Adversary A(base, target, parameter)
while not done do
Sample tasks
{r). Support set S(x", y²), Query set Q(I9,
for r = 1, .... do
Transform input i (z=), t2 (a=")
Fine-tune model with & (x"), (2("), ) yf" and updates parameter 0r
Generate adversarial examples
4 (x9)ade = A(412x)) (x 0*), l2 (x9)adv A(l2(x*), (2 07)
Calculate losses on query set images
TTRADES; = (hy (for (to (f1(2"))) 8*) + Cx1 (fa (t1 (2 for (t1 (19)adu))
DERADESS = Lee (Mp (For (f2(2"))), ()))))))))))))))))))))))) fxi (fo- (t2(x9)), for (12 (12(29)ado))
Lsele- = Ceimilarity (for (t1 (x1) (odd)dd for (o)
Cour LrRADES; + LTRADES, + Leeis-sup
Compute gradient g" = Lear
end for Update model parameters 0, μ t 0, gg end while
C EXPERIMENTAL DETAILS OF ABLATION STUDIES
C.I ABLATION STUDY OF BILEVEL PARAMETER AUGMENTATION
To demonstrate how bilevel parameter augmentation is more effective than image augmentation in adversarial sule-supe meta-learning, we experiment in the same environment except for parameter augmentation in inner adaptation. Specifically, we generate augmented parameters of the encoder adapted with two differently transformed support set images simultaneously, while TROBA augments parameters independently for each augmented view. A detailed algorithm for applying image-only augmentation in adversarial sulf-super meta-lcarning described in Algorithm Experiment results reported in Section 4.2.
C.2 ABLATION STUDY OF BILEVEL ATTACK
The bilevel attack is based on the instance- wise attack (Kim et al., 2020) which does not require label information to generate adversaries, while the class-wise attack utilizes label to maximize the cross-entropy loss in the inner maximization of Equation 3. The bilevel class-wise attack is applied with the bilevel augmented parameters as done the bilevel attack. We use Lxo PGD attack with strength 8. 8./25.., step size 2./255., and the same number of iterations with bilevel attacks in all comparisons in the main paper.
C.3 CKA ANALYSIS
We calculate CKA demonstrate that bilevel attack constructs more confusing perturbed examples than class-wise attack, which helps in obtaining robust transferability. Specifically, we randomly selected 600 samples for the same tasks in charge of 10% for the entire dataset of CIFAR-FS that has 6,000 images per class. With randomly sampled tasks and the same pre-trained models, the parameter of the encoder adapted with two differently transformed support set images as done in meta-training (i.e., bilevel parameter augmentation). Here, generate adversaries with class-wise attack and bilevel attack independently with adapted encoders for each multiple view. Then we calculate CKA between the features of the clean and adversarial query set images with the same view, and average the CKA values over selected tasks, Results are reported in Section 4.2.
Phttps://git http:/ggihhhhhoooo thub. com.cra3mff///// watll///utttttttte
16

---

Under review as a conference paper at ICLR 2023
Table 8: Ablation study on adversarial loss in meta- objectivee TROBA. Test accuracy(%)) on benchmark data sets for shots.. Robustness is calculated with PGD-20 attack (c 8./255,, step size=</10), clean is for clean images. All models are adversarially meta-trained on CIFAR-FS, with R as the base encoder.
Mini-ImageNet
Ticrod-ImageNet
CUB
Flower
Cars
Adversarial Loss
Clean
PGD 6oo
Clean
PGD Ese
Clean
PGD &o
Clean
PGD &c
Clean
PGD too
AT (Madry al., 2018)
33.78
7.99
38.35
12.95
37.00
10.08
42.28
22.19 36.92
30,93
9.59
TRADES (Madry et al., 2018)
33.57
16.26
39.26
21.82
39,90
18.62
48.70
34,69
17.67
C.4 ABLATION STUDY OF META-ORIECTIVES
Our meta-objective consists of adversarial loss and self-supervised loss which are TRADES (Zhang et al., 2019) and the cosine similarity loss between differently augmented features as described in Equation 7. We compare two different meta-objectives of TROBA in the main paper. which are the case of using cross-entropy loss clean examples instead of adversarial loss, and using only TRADES loss without self-supervised loss terms, respectively. Further, we replace the adversarial loss term with AT (Madry et al., 2018), which is widely used to obtain robustness in adversarial learning, while utilizing the same self--uper loss. As shown Table 8, utilizing a TRADES (Zhang et al., 2019) loss an adversarial loss is more effective to obtain transferable robustness in adversarial meta-learning than a AT (Madry et al., 2018) loss.
C.5 COMPARISON WITH SELF-SUPERVISED PRE-TRAINED MODELS
We select baseline models with ACL (Jiang et al., 2020)'. BYORL (Gowal et al., 2020) and RoCL (Kim et al., 2020> for self-supervised pre-trained baselines. We implement BYORL on top of the BYOL (Grill et al., 2020)² framework, following description in the paper.
D ADDITIONAL EXPERIMENTAL RESULTS OF ROBUSTNESS
D.1 ROBUSTNESS ON UNSEEN DOMAINS WITH DIFFERENT META-LEARNING FRAMEWORK AND DIFFERENT ITERATIONS OF BILEVEL ATTACK
To prove that TROBA is an effective method obtain transferable robust representations, we experiment with three different types of meta-learning frameworks and different strengths of bilevel attacks. Specifically, we train TROBA on top of the MAML (Finn et al., 2017), FOMAML (Finn et al., 2017) and MetaSGD (Li et al., 2017) and apply bilevel attacks with 3 steps and 7 steps, respectively. Here, we only update the encoder parameters inner adaption, since we propose task adaptive attacks that maximize the difference between the features, further to learn generalized representations as BOII. (Oh et al., 2020) demonstrated.
As shown in Table 9, TROBA outperforms the previous adversarial meta-learning model (Goldblum et al., 2020) by more than 10% robustness regardless meta-learning strategies. Furthermore, we show outstanding robustness with only 3 steps of bilevel attacks (i.e., dynamic instance- attack) compared to AQ (Goldblum et al., 2020), which is trained with PGD-7 attacks (i.e., class wise attack). To demonstrate that bilevel attack is the representation level, we calculate CKA (Kornblith et al., 2019) between clean and adversarial features to measure the similarity in the feature level. Notably, the CKA value of features attacked with the bilevel attack is smaller than the CKA values of features attacked with the class-wise attack (Figure 7), which means that the bilevel attack constructs more confusing perturbed images that are more dissimilar from their clean examples. Through these remarkable results, we demonstrate that our proposed bilevel attack served as stronger attack that makes the model to have robust transferability to unseen domains, even with fewer gradient steps of attacks and little data.
effective attack than a class-wise attack in
D.2 ROBUSTNESS ON UNSEEN DOMAINS WITH LARGER DATASETS
pettps://githuie cww ii- http://tww.oooooeoeeeeeeeee/eeaa
17

---

Under review as a conference paper at ICLR 2023
Table 9: Results of transferable robustness with different meta-learmng framework and attack iteration 5-shot tasks. All models are trained with 5-way 5-ohot images on CIFAR-FS and Mini- -mai-emaeNet. Clean stands for test accuracy(%) of clean images, Rob. stands for accuracy(%) () that is calculated with PGD-20 attack (c ( 82/55..). All models are trained on 2 The number of attack iteration during training is marked in parentheses next to the meta-train dataset. Further, we denote (8) next the meta-learning strategies notice that we update only the encoder parameters during inner optimization.
CIFAR-FS (3 steps) +
Mini-InageNet
Gered-ImageNNt
CUB
Flowers
Curs
Clean
Rob.
Cleun
Rob.
Cleun
Rob.
Clean
Rob.
Cleun
Rob.
TROBA
+MAML (0) (Finn et al., 2017)
34,35
15.76
39.06
20.08
42.32
17.46
57.74
32.70
35.78
15.79
+FOMAML (0) (Finn et al., 2017)
32.06
16.69
37.97
22.15
37.65
17.50
56.68
34.08
36.33
18.45
+eetaSCD (0) (Li
2017)
44.64
15.75
53.25
28.05
50.78
22.44
70.08
41.52
40.08
16.88
AQ (Goldblum et 2020)
33.79
1.59
36,41
2.27
39.35
2.88
58.69
6.59
37.39
2.30
CIFAR FS (7 steps) +
Mini- Mini-ImageNet
tiered- ImageNet
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
TROBA
+MAMI. (0) (Finn al., 2017)
32.57
16.12
38.90
22.51
39.44
16.52
56.79
32.83
36.58
16.56
+FOMAML (0) (Finn et ul., 2017)
31.71
17.40
37.33
23.28
38.63
18.79
59.57
36.79
37.94
21.34
+MetaSGD (#) (Li et al., 2017)
45.82
24.12
$1.46
30.06
48.56
25.23
66.49
42.16
38.29
19.43
AQ (Goldblum et al., 2020)
33,09
3.32
37.41
5:05
38.37
4.10
60.14
11:03
36.83
4.47
Mini- Mini-ImageNet (3 steps) +
CIFAR-FS
tieredIImageNet
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
TROBA
+MAML (8) (Finn et nl., 2017)
$7.11
30.76
43.15
20.44
46.00
17.03
62.23
32.60
39.70
16.83
+FOMAML (0) (Finn al., 2017)
51.48
29.05
39.22
20.92
37.76
14.66
49.80
38.02
16.07
-eetSSGD (0) (Li et al., 2017)
66.48
37.36
59.73
29.35
53.33
20.20
68.93
33.39
42.09
13.73
AQ (Goldblum et al., 2020)
66.52
23.01
48.33
5.70
47.12
7.37
66.80
13.65
37.32
4.34
Mini Manii-Imageet(CCC (7 steps) +
CIFAR-FS
tiered- ImageNet
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Roh.
Clean
Rob.
Clean
Rob.
TROBA
+MAML (0) (Finn et al., 2017)
56.61
35.18
41.96
24.11
44.97
19.64
62.34
34.73
39.85
19.26
+OMAMM (8) (Finn et al., 2017)
53,42
35.95
37.91
22.15
39.88
17.40
59.66
33.64
39.93
17.94
McttaSGD (0) (Li
2017)
65.45
36.51
59.64
29.73
53.70
20.64
69.84
36.49
42.25
14.42
AQ (Goldblum et al., 2020)
61.97
30.73
47.61
14.21
45.64
13.19
65.40
25.01
37.29
8.85
Table 10: Experiments results for self-supervised robust full- finn--nitttingg of TROBA and the ofate-of-the-art
adversarial self seff-supervised models on unseen domains. While TROBA is trained on CIFAR-FF FSS with bilevel attacks, adversarial self-supervised models are trained on full-dataset of CIFAR-100. All models are trained on
ResNet18, and evaluated against PGD-20 attacks (e 8./25..) and AutoAttack (AA) (Croce & Hein, 2020)
CARS
CUB
AirCraft
Method
Clean
PGD &
AA
Clean
PGD &x
AA
Clean
PGD &
AA
(oCL et al., 2020)
35.00
8.11
5.67
17.21
2.55
1.71
33.63
8.76
5.61
SSL.
ACL (Jiang et al., 2020)
30.95
5.86
3.80
17.00
2.33
1.54
31.19
7.26
4.68
BYORL (Gowal et al,, 2020)
32.13
6.15
4.39
16.78
2.28
1.48
31.16
6.63
4.17
Ours (3 steps)
31.47
9,58
6.19
18.07
4.49
2.73
32.12
9,93
6.19
In the main paper, we validate our models on unseen domains with larger benchmark datasets for standard image classification, which are CIFAR-10 and STL-10. Furthermore, we also demonstrate the robust transfer- ability of our models in benchmark few-shot image classification tasks, which are Cars, CUB, and Aircraft that have 196, 200, and 100 classes, respectively. Es- pecially, we train our models on ResNet18 with bilevel attacks with 3 steps while other self superviee mod- els are trained with PGD-7 attacks due to computation costs. We use the same hyperparameters to validate with robust full-finetuning for all datasets, as we explained in Appendix B.5. Although our models utilize only scarce data to train, and even apply bilevel attacks with fewer gradient steps, we show even better robust representations compared to self-supervised pre-trained models while preserving clean accuracy (Table 10). Especially, our methods show a larger gap in fine- grained datasets, which have highly different distribution from mretn-t domains (i.e., CIFAR-FS). Further, we hope that our models to be robust in real-world adversarial perturbation such as common corruption (Hendrycks & Dietterich, 2019), we evaluate our fully finetuned models with adversarial examples on 100, with common corruption datasets on
Table 11: Test accuracy(%) of TROBA and self-supervised pre-traiend models on common corruption tasks of CIFAR-10.
Model
Accuracy
ACL. (Jiang et al., 2020)
68.6
BOOL (Gowal al., 2020)
69.01
AQ (Goldblum et al., 2020)
66.16
TROBA
67.9
18

---

Under review as a conference paper at ICLR 2023
Table 12: Experiments results for robust full finetuning TROBA with without self-supervised loss. Both models are trained on CIFAR-FS, with ResNet18 as the base encoder. Robust accuracy is evaluated with ls PGD-20 attacks with = 8. and the step size 8. 85/2550.. while AA stands for AutoAttack (Croce & Hein, 2020).
STL-10
CARS
CUB
AirCrafi
Lass
Clean
PGD Fov
AA
Clean
PGD Fou
AA
Clean
PGD &sv
AA
Clean
PGD Aue AA
TRADES
60.41
32.10
27.47
35.00
8.66
6.04
17.12
2,88
1,95
31.79
SRADES+Scl-sup
53,46
32.65
28.96
31.47
9.58
6.19
18.07
4.49
2,73
32.12
9.93
6.48
Table 13: Results of transferable robustness in 5-shots unseen domain tasks. TROBA trained CIFAR-FS. with ResNet18 as the base encoder. On top the pre-trained ROCL, we meta-train the model for 300 epochs as the same environment as TROBA is trained. Rob. stands for accuracy(%) that calculated with PGD-20 20 attack (c 8./255., step size=c/ (0)).. Clean stands for test accuracy(%) of clean images.
mini ImageNet
Tiered- ImageNet
CUB
Flowers
Cars
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
Clean
Rob.
TROBA ROCL (Kim al., TROBAATROBA
33.57
16.26
39.26
21.82
39.90
18.62
48.70
36.92
34.69
17.67
40.87
21.35
45.68
26.47
39.74
20.15
32.25
22.12
28.07
15.80
CIFAR-10. TROBA shows comparable accuracy with self-supervised pre-trained models common corruption tasks, even trained with little data and bilevel attacks with fewer inner maximization itera- tions (Table 11). From these results, we prove that TROBA learns good generalized representations with little data effectively.
E EFFECT OF SELF-SUPERVISHN CONCEPT IN TROBA
E.1 SELF-SUPERVISED LOSS
Existing adversarial meta-learning works are vulnerable to unseen domains, since the regularization to learn good representations themselves is insufficient but normally focuses optimization to rapidly adapt to new tasks. To learn good representations, we leverage self-supervised learning in adversarial meta-learning. Specifically, images by using cosine similarity loss as regularization. In robust full-finetuning, where larger data used finetune the model parameters, we observe that the model trained with self-supervised loss mostly shows better clean accuracy and robust accuracy on unseen domains (Table 12). Especially, self-supervised loss helps in obtaining generalized features more the distribution of the target domains is more different from the distribution of the meta-trained dataset.
enforce the consistent features between bilevel attacked
E.2 TROBA ON TOP OF THE PRE-TRAINED SELF-SUPERVISHD MODEL
We further verify whether our methods can support self-supervised pre-trained models to obtain transferable robustness in few-shot tasks unseen domains. Especially, we utilize ROCL (Kim et al., 2020) pre-trained on CIFAR-100, and further meta-train with TROBA on top of that model. As shown in Table 13, since self-supervised models learn representations that are color-invariant where colorjitter is normally used in data augmentation, TROBA is less effective in obtaining robust representations in the fine-grained datasets (i.e., CUB, Flowers, Cars) that are easily affected by colors. On the other hand, the meta-trained self-supervised pre-trained model achieves even better clean accuracy and robustness than TROBA, especially in general datasets (i.e, Mini-Iman metge,, Tiered- ImageNe), where TROBA helps in generalization on few-shot tasks on general domains.
F OBFUSCATED GRADIENT
All of the robust accuracies in paper are calculated with the strength 8./255., step size 8./2250.. and 20 steps. To check whether our model is under obfuscated gradient issues or not, experiment extremely large strength, where robust accuracy should be almost zero. Second, we use the same strength but different step sizes and steps, which are 4./2550. and 40, respectively, where robust
experiment with two different settings of l.o PGD attacks. First, apply PGD attacks with
19

---

Under review as a conference paper at ICLR 2023
Table 14: Test accuracy (%) on benchmark data sets for 5-shots. Robustness calculated with PGD-20 attack (e 8.,255., step size=e/10) 10), clean is for clean images. All models are adversarially meta trained on CIFAR-FS.
CIFAR-FS
Mini-Image Vet
Tiarad-ImageNet
CUB
Cars
Strength (e)
Step size
Steps
Clean
PGD
Clean
PGD
Clean
PGD 6z.
Clean
PGD Es
Clean
PGD fxc
3
8.0/255.0 0
8.0/2530:1
20
53.42
35.95
32.06
16.69
37.97
22.15
37.65
17.50
36.33
18.45
8.0/255.0
4.0/2550.0
-00
53.04
35.35
31.70
16.01
38.06
21.98
37.77
18.12
36.10
18.02
8.0/2550.0
8.0/255.0 0
8.0/2530.0 0
20
$1.90
36.01
31.71
17.40
37.33
23.28
38.63
18.79
37.94
21.34
8.0/255.0
4.0/2550.0
40
52.50
36.39
31.95
17.49
38.44
24.22
38.18
18.87
37.41
20.92
300.0
8.0/2330.0
0.59
37.53
accuracy should be the same robust accuracy from original evaluation setting. Specifically, demonstrate TROBA trained on CIFAR-FS with ResNet12 as the base encoder, and further on top of the FOMAML reported in Table As shown in Table 14, verify that models do not have any obfuscated gradient issues.
20

---

Under review as a conference paper at ICLR 2023
G VISUALIZATION OF LOSS SURFACE
We visualize the loss surface of our model and baseline AQ (Goldblum et al., 2020) model. As shown in the Figure our model has a smoother loss surface both in the seen domain and unseen domain while the baseline has a relatively less smooth surface.
(a) AQ
(b) Ours
(a) AQ
(b) Ours
Figure Seen domain (CIFAR-FS)
Figure 10: Unseen domain (Mini-Imagee ImageNet)
(a) AQ
(b) Ours
(a) AQ
(b) Ours
Figure 11: Unseen domain "Tiered-ImageNe
Figure 12: Unseen domain (CUB)
(a) AQ
(b) Ours
(a) AQ
(b) Ours
Figure 13: Unseen domain (Cars)
Figure 14: Unseen domain (Flowers)
21


Reviews:
[{"review_id": "tQgcII2xuAT", "reviewer": "Reviewer_WWPz", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper develops a new algorithm for adversarially robust few-shot MAML.  The interesting part is that the adversarial robustness transfers across domains.  Experiments are conducted on multiple datasets and against multiple baseline methods.", "summary_of_the_review": "This area of work is valuable, but the proposed method seems only applicable to MAML even though the baseline methods work with better quality few-shot learning algorithms.  This might be a major performance limitation of this paper.  In order to convince me that it is not a limitation, I would suggest either adapting the method to a better few-shot learner than MAML or demonstrate that it can outcompete competitors even when they use very strong meta-learning algorithms.", "strength_and_weaknesses": "In my opinion, the strength here is the transferability of robustness across domains.  The empirical results otherwise do not seem very strong.\n\nIt would be good to test on higher performing meta-learning algorithms such as R2D2 and MetaOptNet, as in the AQ paper, at least as baselines for AQ since they may not be applicable to your method instead of only testing on MAML.  The numbers in the AQ paper look higher even for directly comparable experiments such as seen domain 5-shot mini-ImageNet.  It seems like a major flaw that your method can only be used with MAML despite MAML not being a very good few-shot learning algorithm.  This is my central critique of this paper.\n\nAlgorithm 1 is impossible to understand, especially the arguments of the loss function in the gradient computation.\n\nSome of the tables are a bit weird and contain numbers which are very hard to compare.  For example, Table 7 contains the proposed method as well as other methods trained against other stronger attacks.  In many cases, the competitors outperform the proposed method.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "htbsyC7QvH", "reviewer": "Reviewer_Xygn", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "It proposes a adversarial meta-learning framework with bilevel attacks, which allows the model to learn generalizable robust representations across tasks and domains. The framework obtains higher robustness in few-shot tasks both in the seen domain and the unseen domains.", "summary_of_the_review": "It combines a few existing techniques to achieve good performance in adversarial meta-learning. It provides visualization results to demonstrate why it performs better, which is easy to follow. My main concern is that the technical contribution may be limited as most of the techniques are adopted from prior works. ", "strength_and_weaknesses": "\\+ The visualization of the representations of the instance-wise adversarial samples from the unseen domains in Figure 2 shows that the model is able to obtain well-separated feature space for attacked samples on this domain (CIFAR-10) even before adapting to it, while\nthe previous adversarial meta-learning framework learns a feature space with large overlaps across the adversarial instances belonging\nto different classes.\n\n\\+ TROBA shows smoother loss surface to adversarial examples in Figure 4 which is directly associated with better robustness and generalization.\n\n\\+ The ablation study checks the performance of each component, such as it compares the performance with or without augmentation, and with instance-wise or class-wise attack. It also checks the performance of the loss function compared with CE + selfsup loss or TRADES loss only. \n\n\\- The technical contribution may be limited. It adopts many techniques in this paper. Most of techniques are proposed in prior works such as \nTRADE loss,  data augmentation with random crop/flip/color distortion, and instance-wise classification loss in adversarial self-supervised learning. It combines these techniques but the technical contribution may not be significant. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "ebhoqNRzTGJ", "reviewer": "Reviewer_NDZi", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces self-supervised adversarial learning into adversarial meta-learning, and proposes a transferable robust meta-learning via bilevel attack (TROBA) method by using a bilevel attack scheme. Specifically, TROBA is built on BOIL and TRADES by adding a self-supervised loss. Extensive experiments effectively show the effectiveness of the proposed method.  ", "summary_of_the_review": "The overall of this work is great. However, there are still multiple parts that are not clear, which need to be further clarified.", "strength_and_weaknesses": "- **Strength**: \n1. This paper is well organized and easy to follow.\n2. The core parts of the proposed TROBA are clear.\n3. The experimental results seem to be good. \n\n- **Weakness**: \nOverall, the key contributions especially the technique contribution are not clear. This is because self-supervised adversarial learning and TRADES have been widely used in general adversarial training, and BOIL is one existing meta-learning method extended from MAML. If the bilevel parameter augmentation and attack are the main technique contribution, the difference and effectiveness of this strategy compared to the normal data augmentation used in general self-supervised adversarial learning should be clearly claimed and demonstrated. If the entire framework is the main contribution, it would be interesting to see the effectiveness of this framework of using different adversarial training methods and different meta-learning methods.     \n\n- Several main concerns are as follows:\n1. What’s the main difference between the proposed bilevel parameter augmentation and the normal data augmentation? Is it different only because of the usage of Siamese network with different parameters? Could you verify the effectiveness of this operation by experiments?\n2. What’s the main difference between the bilevel attack and the normal self-supervised adversarial learning? Is it different only because of the swapping operation of two views? Could you verify the effectiveness of this operation by experiments?\n3. It is not clear if the adversarial example l_n^adv used in Eq. (7) is generated by class-wise attack or instance-wise attack. \n4. It is not clear how to update the backbone and classifier in Eq. (2) for readers. Note that the classifier is fixed in BOIL. \n5. I am not sure if all the comparison methods employ the same backbone and the same epsilon of attack. Does this paper re-implement all these methods in the same framework?\n6. It is doubtful for the experiment in Table 7. Are the results still for 5-shot classification? Note that the splits used in CIFAR-FS and CIFAR-100 are different. Why not directly perform other models on CIFAR-FS? How many samples used for training for TROBA and how many samples used for other models? This part should be clearly explained, otherwise the results are doubtful. \n7. Do all the comparison methods employ the same input image size of 32 * 32?\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "JH0MW7MpU4J", "reviewer": "Reviewer_KTHv", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method to solve the problem of adversarial meta-learning, where the difficulty lies in the few-shot learning of each inner loop task. The proposed method consists of 1) generating adversarial query examples by attacking a contrastive loss between clean and perturbed images; 2) using two independent augmentations in both inner loop optimization and attack; 3) adversarial meta learning with TRADES loss and a contrastive loss. Experimental results show that the proposed method achieves improved robustness performance compared with several baselines.", "summary_of_the_review": "The proposed method targets the problem of adversarial meta-learning using techniques from contrastive learning. The incorporation of existing loss functions is not novel, and performance gain in experiments are expected due to the effectiveness of contrastive learning loss functions.", "strength_and_weaknesses": "Strength:\n\nThe studied problem is interesting and practical as learning with few examples per task is important in some applications.\n\nExperimental results show the effectiveness of the proposed loss function in terms of robustness. Ablation studies also verify that each individual design is effective.\n\n\nWeaknesses:\n\nThe major weakness of this work is that the proposed loss function seems to be a combination of the adversarial meta-learning method AQ and the objective function of contrastive adversarial learning. The proposed loss function thus inherited the advantages from both domains. The technique is not novel.\n\nThe title of the paper suggests learning transferable representations for adversarial few-shot learning. My feeling is that the word transferable seems to be redundant since meta-learning for few-shot learning itself already has the implication of improving the transferability of representations. This work mainly uses self-supervised learning methods, specifically contrastive learning loss function, to learn better representations that can transfer to different tasks or domains without explicit transfer methods (e.g. things like task augmentation or domain alignment) beside meta-learning. Therefore, in my opinion it is perhaps better to claim it as few-shot self-supervised robust representation learning.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject