On sensitivity of meta-learning to support data
Authors: Mayank Agarwal
Mikhail Yurochkin
Yuekai Sun
Venue: NeurIPS 2021 Poster (2021)
Keywords: meta-learning
sensitivity
robustness

Abstract: Meta-learning algorithms are widely used for few-shot learning. For example, image recognition systems that readily adapt to unseen classes after seeing only a few labeled examples. Despite their success, we show that modern meta-learning algorithms are extremely sensitive to the data used for adaptation, i.e. support data. In particular, we demonstrate the existence of (unaltered, in-distribution, natural) images that, when used for adaptation, yield accuracy as low as 4\% or as high as 95\% on standard few-shot image classification benchmarks. We explain our empirical findings in terms of class margins, which in turn suggests that robust and safe meta-learning requires larger margins than supervised learning.

On sensitivity of meta-learning to support data
Mayank Agarwal mayank. agarwal@ibbat..o wwt.rwwa@lbb.....m com
Mikhail Yurochkin 1,2 mikhaill.yrrochkinne
Yuekai Sun 3
yuekai Chmiich... edu
IBM Research," MIT-IBM Watson AI Lab,² University of Michigan".
Abstract
Meta-learning algorithms are widely used for few-shot learning. For example, image recognition systems that readily adapt unseen classes after seeing only few labeled examples. Despite their success, we show that modern meta-learning algorithms extremely sensitive to the data used for adaptation, i.c. support data. In particular, we demonstrate the existence of (unaltered, in-distribution, natural) images that, when used for adaptation, yield accuracy low 4% as 95% on standard few-shot image classification benchmarks. We explain our empirical findings in terms of class margins, which in turn suggests that robust and safe meta-learning requires larger margins than supervised learning.
high
Introduction
Meta-leaming, learning learn 29 is the problem of training models that adapt to tasks quickly, using only handful of examples. The problem is inspired by humans' ability to learn new skills or concepts at rapid pace (e.g. recognizing previously unknown objects after seeing only a single example (20)). Meta-learning has found applications in many domains, including
safety-critical medical image analysis 24 autonomous driving (35), visual navigation 4 and
legged robots control [40]. In this paper, we investigate the vulnerabilities of modern meta-learning
algorithms in the context of few-shot image classification problem (25), where meta-learner needs to solve classification task on classes unseen during training using small number (lypically I or of labeled samples from each of these classes to adapt. Specifically, we demonstrate that the performance of modern meta-learning algorithms on few-shot image recognition benchmarks varies drastically depending on the examples provided for adaptation, typically called support data, raising concerns about its safety in deployment.
Despite the many empirical successes of artificial intelligence, its vulnerabilities important explore and mitigate in our pursuit safe Al that is suitable for critical applications. Sensitivity to small (possibly adversarial) perturbations to the inputs
1 backdoor attacks allowing malicious model manipulations [6. algorithmic biases 2 and poor generalization outside of the training domain [8] are some of the prominent examples of AI safety failures. Some of these issues have
also been studied in the context of meta-learning, e.g. adversarial robustness 45 [ 4 and fairness B7. Most of the aforementioned Al-safety dangers are associated with adversarial manipulations of the train or test data, or significant distribution shifts at test time. In meta- meta-learning, prior works demonstrated that an adversary can create visually imperceptible changes of the test inputs ([] or the support data [44] 30 causing meta meta-leaming algorithms to fail on various few-shot image recognition benchmarks. In this work we demonstrate adversaryfreee and in-distribution failures specific to meta-learning. Sohn et al. 39 studied similar problem in the context of semi-supervised learning.
A distinct feature of meta-learning is the adaptation stage where the model is updated using scarce amount of labeled examples from a new task. In practice, these examples need to be selected and presented human for labeling. Then meta-learner adapts and can be used to classify the
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

Shall
Sweet
Bed
Pain
Telephone
Chimpanzee
Pain
Pickup truck
Wardrobs
6.3%
7.8%
11.3%
11.2%
21.2%
44.9%
60.2%
73.7%
88.0%
87.5%
94.6%
Figure I: Examples of CIFAR-FS support images (unaltered, i.e. not modified adversarially or in any other way) from two test tasks that yield vastly different 1-shot post-adaptation performances of popular meta-learning algorithm (MetaOptNet-SSVM Accuracy ranges from 6.3% to 94.6% suggesting extreme sensitivity of the meta-learner to the support data. Images mostly appear rep- resentative of the corresponding classes and would be hard to recognize potentially problematic without significant expertise of the training dataset from the human labeling the support data.
remaining images without a human. Currently, meta-learning algorithms choose support examples for labeling random. Dhillon al. [8] noted that the standard deviation of accuracies computed with random support examples may be large. We demonstrate that the support data is not carefully curated, the performance of the meta-leamer can be unreliable. In Figure we present examples of unaltered support images (i.e. they are not modified adversarially or in any other way) representative of the corresponding task (in (indiistribution) that lead vastly different performance of the meta-learner after adaptation. Support examples causing poor performance are not prevalent, however, they are also not data artifacts as there are multiple of them. The existence of such examples might be concerning when deploying meta-learning in practice, even when adversarial intervention is out of scope.
Our main contributions are follows:
We present simple algorithm for finding the best and the worst support examples and empirically demonstrate the sensitivity of popular meta-learning algorithms support data.
2. We demonstrate that a popular strategy for achieving robustness fails to solve the support data sensitivity problem.
? adapted to our setting
3. We explain the existence the worst case examples from the margin perspective suggesting that robust meta-learning requires class margins more stringent than classical supervised learning.
2 Meta-learning approaches
Meta-leaming approaches are typically categorized into model-based 334 26 33
metric-base
28 [4]. We refer to Hospedales et al. [15] for recent survey of the area. In this paper we mostly focus on the optimization- based method popularized by the Model Agnostic Meta Learning (MAML) [10] bi-level formulation (metric-based prototypical networks
17 41 (38) and optimization-Be based methods (10]
[8) are also considered the experiments). Let (Tr) be collection of tasks
T [A, D.} each consisting of support A, and query (or validation) D, datasets. MAML

---

bi-level optimization problem is as follows 10
1 T min- = 0 72
Σ ((
(2.1)
such that 0, arg min E(0,, Ac), ; i 1,..., 6.
The first line of equation 2.1 is typically minimized using gradient- baasee optimization of 0 and is called mela-update. The second line is the adaptation step and its implementation differs depending on whether the fine-tuned 0, are treated as parameters of the end-to-end neural network or as the "head" parameters, i.e. the last linear classification layer. We refer to Goldblum et al. 112 for an empirical study the differences between the two adaptation perspectives.
MAML [T and Reptile (28] are examples of algorithms that fine-tune all network parameters during the adaptation. Instead of solving the argmin of 0g exactly they approximate it with small number of gradient steps. For one gradient step approximation equation 2.1
can be written as
1 E(B dE(0;A) A.), D,)) Σ 72
2
min
(2.2)
08
for some step size a. MAML directly optimizes equation differentiating through the inner gradient step, which requires expensive Hessian computations. Reptile introduces an approximation by-passing the Hessian computations and often performs better.
Another family of meta-learning algorithms considers as the neural network feature extractor parameters shared across tasks and adapts only the linear classifier parametrized with 0,, that takes the features extracted with 0 as inputs. The advantage of this perspective is that the adaptation minimization problem is convex and, for many linear classifiers, can be solved fast and exactly. Let a(0, A) denote a procedure that takes data in A, passes it through a feature extractor parametrized with 0, and returns 0;, i.e. optimal parameters of linear classifier using the obtained features to predict the corresponding labels. Then equation can be written as
1 Σ ((.. 71
min
(2.3)
This approach requires a(f, to be differentiable. R2D2 casts classification as multi-target ridge-regression problem and utilizes the corresponding closed-form solution as A(f,A). Lee et al.
21 propose MetaOptNet, where a69, .A) is differentiable quadratic programming solver [0, and implement it with linear support vector machines (SVM) and ridge-regression. Prototypical networks
3S is metric-based approach that can also be viewed from the perspective of equation 2.3 Here a(0, A) outputs class centroids in the neural-feature space and the predictions are based on the closest class centroids. Last-layer adaptation approaches, especially MetaOptNet, outperform full-network
approaches most benchmarks 211
Both adaptation perspectives have a weakness underlying our study: their test performance is based on an optimization problem with large number of parameters and as little as 5 data points (1-shot 5-way setting). To understand the problem, consider the last-layer adaptation approach: even when the feature extractor produces linearly separable representations, the dimension is large (for example, Lee et al. [1 utilize a ResNet-11 architecture with 2560-dimensional last layer features that we adopt in our experiments) making the corresponding linear classifier extremely sensitive to the support data. In Section 3 we demonstrate the problem empirically and provide theoretical insights in Section
2.1 Meta-learning benchmarks
Before presenting our findings, we discuss the meta-learning benchmarks we consider, Meta-learning algorithms are often compared in a few-shot image recognition setting. Each task typically has five unique classes, i.e. 5-way, and one or five examples per class for adaptation, i.e. 1-shot or 5-shot. Classes that appear at test time are not seen during training. Few-shot learning datasets are typically the derivatives of the existing supervised learning benchmarks, e.g. CIFAR-100 10 and ImageNet 77 Few-shot problem setup by disjoint partitioning of the available classes into train, validation and test. Tasks are obtained by sampling 5 distinct classes from the corresponding pool and assigning
3

---

subset of examples for adaptation and a different subset for meta-update during training or accuracy evaluation for reporting the performance.
CIFAR-FS 4 is a dataset of 60000 32 x RGB images from CIFAR-100 partitioned into 64, 16 and 20 classes for training, validation and testing, respectively. FC-100 KT is also derivative of CIFAR- 100 with different partition aimed to reduce semantic overlap between 60 classes assigned for training, 20 for validation, and 20 for testing. MinilmageNet 4 is subsampled, downsized version of ImageNet. It consists of 60000 84 x 84 RGB images from 100 classes split into 64 for training. 16 for validation, and 20 for testing.
3 Finding adaptation vulnerabilities
In this section we study the performance range of meta-learners trained with variety of algorithms:
MAML [OO, Ceta-Curvattre (MC) [32], Prototypical networks [3,, R2D2 [ and MetaOptNet with Ridge and SVM heads (21. At test time meta-learnrr receives support data and its performance is recorded after it adapts. Typical evaluation protocols sample support data randomly and report average performance across tasks. While this is useful measure for comparing algorithms, safety- critical applications demand understanding of potential performance ranges. We demonstrate that there are support examples the lead vastly different test performances. To identify the worst and the best case support examples for a given task we perform an iterative greedy search.
Let X' = { I k<[k] be set of potential support examples for a given task. K' is the number of classes, .M is the number of examples per class (we assume same M for each class for simplicity).
and [M] {O....,M
M - 1}. Let D be the evaluation set for this task. a J-shot setting, let be set of indices of the support examples (=f * z for any k,j + j' and 2 E [M] for any k. Denote R(2, X, D) a function computing accuracy of a meta learner on the query set D after adapting on A = {= kE[K]
2 {- RE K] jE(]]
Finding the worst/best case accuracy amounts to finding jE[J]
X(,,X,)) D). We solve this greedily by updating single index 2 at time, holding the rest of 2 fixed, iterating over [K] and [J] multiple times. We summarize the procedure for finding the worst case accuracy in Algorithm (the best case accuracy is analogous) [] Due to the greedy nature, this algorithm finds a local optima, but it sufficiently effective as we see in the following section.
indices mmnimizing/mmxximzzzii
Algorithm 1 Finding the worst case support examples
Input: trained meta-learner, potential support examples X' to search over, query data D. repeat
kE(K] Initialize indices Z = (=/ ]E("] randomly.
for E [J]. k [K] do
+ arg min. R(2,X, 2f E {M f2ftr
end for until R(Z,X' D) stops decreasing
Output: support examples indices (2/ ]E(
kE[K]
Visualizing the worst case support search search In Figure 2 we visualize a single iteration of Algorithm oon I-shot task from the CIFAR-FS dataset. This is a 5-way task with "snail", "red pepper", "bed", "plain", and "telephone" as classes. In round 1, i.e. k = 0, of iteration 1 we start with a random example per class and evaluate post-adaptation accuracy support "snail", i.e. { me[M]]- Here the first line corresponds to "snail" indexed with m = 0, i.e. =g. and posttadapattion accuracy of 73.5%. We select "snail" support image corresponding to the worst accuracy of 53.8% and proceed to round 2, i.e. k of iteration 1. In round we repeat the same procedure for the corresponding class "red pepper" (again the first line corresponds to "red pepper" indexed with m = O, i.e. z/)) holding the support "snail" image selected previously and
the query data D for each potential
'This is simple approach, however we found it faster and more efficient then a more sophisticated continuous relaxation using weights of the potential support examples with sparsity constraints.

---

Figure 2: Visualization of Algorithm D on random I-shot task for the MetaOptNet-SVA method on the CIFAR-FS dataset. We show iteration of the algorithm here, where the algorithm starts by randomly sampling a support image per class and then iterates over all data samples for all classes.
support images for other classes fixed. The algorithm finds the worst case support "red pepper" image corresponding to the post-adaptation accuracy of 37%. Then the algorithm proceeds analogously to rounds 3, 4, and 5 of iteration I, resulting in combination of support examples corresponding to 2.9% post-adaptation accuracy. This is already sufficiently low, however some tasks and higher-shot settings it may be beneficial to run additional iterations. iteration 2, the algorithm will again go through all the classes starting from the support examples found on iteration 1 instead of random ones. our experiments we always run Algorithm | for 3 iterations. In Appendix we empirically study the convergence of the algorithm justifying this choice.
Table 1: Accuracies for different meta-learning methods the CIFAR-FS dataset
Worst acc
Avg acc
Best acc
I-shot
5.91 + 1.94%
56.52 + 10.85%
80.04 6.83%
MAML
5-shot
13.88 + 7.28%
70.45 + 8.42%
85.15 = 6. 1.5%
10-shot
26.26 1 7.85%
70.88 1 7.82%
85.81 + 6.47%
1-shot
4.73 + 1.51 %
47.76 = 11.28%
69.81 = 8.37%
MC
5-shot
9.29 + 6, 6.13%
70.23 + 8. 82%
85.22 = 6.53%
10-shot
16.95 + 10.78%
70.62 + 7.89%
87.81 + 6.91 %
1-shot
5,06 + 2.37%
63.80 + 0.71%
84,88 = 6.29%
ProtoNets
5-shot
18.28 + 9.85%
80.06 = 0.46%
90.41 = 4.72%
10-shot
27.32 + 11.17%
82.95 0.44%
91.44 + 4.35%
1-shot
6.14 2.89%
68.86 + 0.68%
86,63 = 5.97%
R2D2
5-shot
14.73 8.21%
82.29 0.44%
92.34 4.21%
10-shot
29.30 + 12.16%
85.74 + 0.42%
93.41 = 3.81%
1-shot
5.17 2.97%
71.21 0.67%
87.40 + 5.95%
MetaOptNect Ridge
5-shot
16.81 + 11.57%
84.18 + 0.45%
93.15 = 4.43%
10-shot
32.10 + 16.26%
86.82 + 0.42%
93.89 = 3.59%
1-shot
5.27 1: 2.82%
70.79 1 0.69%
87.65 1 5.76%
MetaOptNet-SVi.
5-shot
14.92 + 8.60%
83.98 + 0.44%
93.36 = 4.60%
10-shot
22.24 + 10.13%
87.11 + 0.40%
93.56 = 3.98%
3.1 Performance range results
We summarize the worst, average and best accuracies six meta-learning algorithms on three benchmark datasets (see Section 2. for data descriptions) in 1-shot, 5-shot, and 10-shot setting in Tables and 3 All meta-learners are trained using code from the authors or more modern meta-learning libraries S
(see Appendix[A]ie for implementation and additional experimental details). For evaluation we randomly partition each class in each task into 400 potential support examples composing X' and 200 query examples composing D (all datasets have 600 examples per class). To compute average accuracy we randomly sample corresponding number of support examples per class; for the best and the worst case accuracies use Algorithm to search over support examples in X.
5

---

Table 2: Accuracies for different meta-learning methods on the FC100 dataset
Worst acc
Avg acc
Best ace
1 I-shot
7.32 + 1.49%
31.89 = 6.75%
50.13 + 6.75%
MAML
5-shot
7.51 3.59%
43.58 7.61%
61.64 8.50%
10-shot
10.51 2.86%
44.30 + 6.89%
64.98 7.27%
1 I-shot
6,53 1.56%
36.56 = 8.05%
56.75 5.57%
MC
5-shot
5.17 + 1.34%
47.12 = 7.02%
66.33 5.11%
10-shot
8.35 + 3.85%
49.12 = 6.67%
65.27 + 5.58%
1 1-shot
5.25 1.69%
37.21 = 0.50%
59.75 6.39%
ProtoNets
5-shot
5.57 + 2.99%
50.49 = 0,48%
70.31 + 6.41%
10-shot
9.93 + 4.39%
56.15 = 0.47%
72.94 + 6.23%
I-shot
6.13 + 1.63%
37.91 = 0.48%
59.67 + 6.17%
R2D2
5-shot
6.72 + 2.85%
54.35 = 0.49%
74.34 6.59%
10-shot
12.00 + 7.07%
61.72 = 0.47%
3.56% 77.94
1-shot
5,44 1.57%
39.13 = 0.51%
61.28
6.18%
MetaOpttet-Ridge
5-shot
5.97 3.29%
53.20 = 0.47%
72.65 6.43%
10-shot
11.56 + 2.78%
59.52 = 0.48%
75.30 1.56%
1-shot
5.29 1.57%
38.19 + 0.48%
60. 6.12%
MetaOptNett-SVM
5-shot
5.75 2.83%
54.45 = 0.49%
74.01 6.64%
10-shot
9.54 + 3.86%
60.52 = 0.48%
77.03 + 6.27%
Table Accuracies for different meta-learning methods on minilmageNet dataset
Worst
Avg acc
Best acc
I-shot
6.08 + 1.77%
47.13 + 8.78%
71.39 + 6. 6.74%
MAMI.
5-shot
10.15 + 8.40%
57.69 + 7.92%
79.60 + 5.43%
10-shot
20.88 + 7.22%
59.52 + 8.34%
79.94 + 3.41%
1-shot
4.46 + 2.05%
45.03 + 8.79%
65.98 + 6.23%
MC
5-shot
5.79 3.45%
60.47 7.57%
75.09 + 4.72%
10-shot
9.67 3.84%
60.54 7.45%
73.23 1 6.24%
1-shot
4.69 2.16%
53.42 0.59%
76.46 + 5.64%
ProtoNets
5-shot
9.53 4.91%
70.60 0.43%
85.33 3.60%
10-shot
15.39 1 5.17%
75.91 1 0.38%
87.31 1 3.24%
1-shot
6.10 3.27%
56.09 = 0.58%
78. 17 + 5.33%
R2D2
5-shot
12.03 + 5.51 %
72.04 + 0.43%
86.64 +: 3.34%
10-shot
15.78 +: 6.%
77.32 + 0.36%
86.70 + 1.99%
1-shot
119::.222
57.94 + 0.62%
79.15 + 5.05%
MetaOptNet-Ridee
5-shot
9.83 + 4.05%
74.80 + 0.43%
84.81 + 4.12%
10-shot
19.16 + 10.075
80.31 0.36%
89.72 + 2.99%
1-shot
4.82 1: 3.03%
59.03 + 0.62%
80.38 1 5.40%
MetaOptNer-SWW
5-shot
9.52 4.88%
75.54 0.40%
85.41 + 3.86%
10-shot
15.93 7.64%
80.16 + 0.37%
90.63 + 2.71%
Our key finding is the large range of performances of all meta-learning algorithms considered in 1-, 5-, and 10-shot settings. Prototypical networks have slightly better worst-case 5-shot accuracy on CIFAR-FS, but it has large variance and is likely due to our algorithm finding poor local optima on one of the tasks. We also see no differences between meta-learners adapting end-to-end, i.e. MAML and MC, and those adapting only the last linear classification layer, i.e. R2D2 and MetaOptNet. Goldblum et al. 122 showed that the last-layer adaptation methods produce good quality linear- separable embeddings. One could expect such methods to be less sensitive to support data, however, as we discuss Section linear separability is not sufficient the few-shot learning setting. 10-shot worst-case accuracies not poor (despite mostly remaining worse than random guessing), but

---

we expect that with more support data available, the gap would narrow Finally, we note that the best-case accuracy is significantly better, especially in the 1-shot setting.
3.2 Worst case support examples are not artifacts
We have demonstrated that it is possible to find support examples yielding poor post-adaptation performance of variety of meta-leamnrs. It also important to understand the nature of these worst-case examples: are they data artifacts, i.e. outliers or miss- examples, or realistic images that could cause failures in practice? We argue that the latter is the case.
1. In Figure we presented several examples of the worst-case support images on CIFAR-FS they are correctly labeled and appear representative of the respective classes. Inspecting the images on the left closer we note that is often not easy to notice visually that such support examples could result in poor performance without significant expert knowledge of the dataset. Only the cellphone image labelled "telephone" and grey-scale image labeled "plain" seem potentially problematic. On the other hand, "snail" and "bed" images all appear normal. On the right figure, majority of the images also appear reasonable.
2. 10-shot setting should be lot more resilient to outliers, however Algorithm | continues to be successful in 10-shot setting, finding ten different examples per class leading to accuracy slightly better than a random predictor as shown in Tables
and
3. In Figure 3 we present histograms of accuracies visualizing the first iteration over classes of Algorithm I in 1-shot learning on CIFAR-FS. The right most histogram corresponds to post-adaptation accuracies for different choices of support image for class O and random choices for classes 1-4. The subsequent histogram is for different choices of support images for class 1, where image for class is chosen with Algorithm I and classes 2-4 are random, and analogously for the remaining three histograms. We see that the lower accuracy tails of the first two histograms contain multiple worst-case support examples in the corresponding classes. By the third histogram, the range of accuracies is below 50% for all possible support examples in the corresponding classes.
4. In Figure we present histogram of accuracies of 3991 unique combinations from CIFAR- FS of I-shot support examples evaluated by Algorithm throughout 3 iterations. There are 3335 distinct sets of examples each with less than 50% post-adaptation accuracy.
We present analogous analysis for other meta-learners and datasets in Appendix C where also conclude that worst-case adaptation examples are realistic and can cause malfunctions in practice.
3.3
Improving support data robustness with adversarial training
The issue of robustness has been studied in many contexts in machine learning, and adversarial vulnerability of deep learning based models has been explored extensively in the recent literature
While the support data sensitivity of meta learners presented in this work is a new type of non-robustness, it is possible to approach the problem borrowing ideas from adversarial training (22). The high-level idea of adversarial training is to use a mechanism exposing non-robustness to guide the data used for model updates. For example, if a model is sensitive to perturbations in the inputs, for an incoming batch of data we find the worst-case (by maximizing the loss) perturbations the inputs and use the perturbed inputs to updated model parameters. To converge, ad adversarial training needs to find model parameters such that the mechanism exposing non-robustness can no-longer damage the performance. Adversarial training has theoretical guarantees for convex models [2] and has been shown empirically be successful in defending against adversarial attacks on deep learning models [22]
B 2
We use adversarial training scheme in an attempt to achieve robustness support data in meta learning. Specifically, we use Algorithm to find worst-case adaptation examples during training instead of using random ones as in standard training. The result is quite intriguing: Tables 4 and 5 summarize performance of adversarially (in a sense of support data) trained meta-learners on train and test tasks. In most cases, adversarial training converged, i.c. we are no longer able to find detrimental worst-case support examples with Algorithm | on the training tasks, however we observe
With enough support data, last-layer methods should succeed their embeddings are linearly separable.
7

---

300
Derstin
250
200
Count
00
1.
43 Test Accuracy 196
70
Test Acturacy
Figure 3: Histogram of test accuracies on the first iteration of Algorithm T as it progresses through classes evaluating 1-shot combinations of images for adaptation CIFAR-FS test task with MetaOptNet-SVV SVM meta-learner.
Figure 4: Histogram of test accuracies computed during iterations of Algorithm [ evaluating different unique 1-shot combinations of images for adaptation on CIFAR-FS test task with MetaOPtNet-SSV meta-learner.
improvements of the worst-case accuracy the test tasks. Our experiment demonstrates that support data sensitivity in meta-learning is not easily addressed with existing methods and requires exploring new solution paths.
Table 4: Accuracies for different meta-learning methods trained in the standard manner and adversar- ially on the CIFAR-FS dataset
Method
Dataset
Training
Worst ace
Avg ace
Best acc
Standard
13.83 + 9.35 %
87.68 + 0.56%
96,91 + 3.15%
Train
Adversarial
46.34 + 14.93%
88.19 + 0.59%
97.94 + 2.89%
R2D2
Standard
6.14 + 2.89%
68.86 + 0.68%
86.63 + 5.97%
Test
Adversarial
6.76 + 2.69%
68.62 + 0.66%
87.46 + 5.86%
Standard
77.75 + 17.80%
99.23 1: 0.15%
99.81 + 0.99%
Train
Adversarial
90.08 + 14.22%
98.87 + 0.21 %
99.84 + 0.66%
MetaOptNet-Ridge
Standard
5.17 1: 2.96%
71.21 +: 0.67%
87.41 +: 5.95%
Test
Adversarial
5.38 +: 2.79%
71.81 1 0.67%
88.42 1 5.60%
Standard
9,74 = 9.00%
91.93 + 0.47%
97.58 + 2.51 %
Train
Adversarial
93.47 + 11.84%
99.08 0.19%
99.81 + 0.89%
MetaOptNet-SVN
Standard
5.27 = 2.82%
70.79 + 0.69%
87.66 = 5.76% 87.84 + 5.93%
Test
Adversarial
4.97 2.58%
71.11 - 0.70%
Meta-learning margin analysis
Meta-leamnrs, specifically those only adapting the last layer linear classifier, produce embeddings that appear (approximately) linearly separable even when projected into two dimensions as shown in Figure S (we used Multidimensional Scaling e4 to preserve the relative cluster sizes and distances between clusters). In the supervised learning context this would be considered an easy problem for, e.g., linear SVM in the MetaOptNet--SWM meta-learner. The problem, however, is that in the supervised learning context we typically have sufficient data, while in the few-shot setting meta-learners are restricted as little as a single example per class in high-dimensional space.
Lets take another look Figure 5 These are Multidimensional Scaling 24 projections of the em- beddings obtained with the MetaOptNet trained on CIFAR-FS. Embeddings in (a) and (c) correspond

---

Table 5: Accuracies for different meta-lcarning methods trained in the standard manner and adversar- ially on the FC100 dataset
Method
Dataset
Training
Worst
Avg
Best
Standard
8,95 6.62%
84.24 + 0.60%
95.48 3.45% 97.11 + 2.97%
Train
Adversarial
45.01 + 12.55%
87.50 + 0.57%
R2D2
Standard
6.13 + 1.63%
37.91 + 0.48%
59.67 1 6.17% 60.87 + 6.30%
Test
Adversarial
6,44 = 1 1.68%
38.70 - 0.46%
Standard
14.27 1 11 1..2 %
92.54 + 0.45%
97.62 1: 2.51%
Train
Adversarial
79.67 +: 14.69%
96.83 + 0.38%
98.76 1: 2.26%
MctaOptNet-Ridge
Standard
5,44 = 1.57%
39.13 - 0,51 % 36.87 + 0.48% %
61.29 + 6.18%
Test
Adversarial
5.47 = 1.89%
59.07 + 6.63%
Standard
18,05 = 12.64% %
94.13 + 0.38%
98,28 + 2.09%
Train
Adversarial
90.37 = 12. 18%
97.12 = 0.39%
99.06 + 1.98%
MetaOpnNet-SVM
Standard
5.29 + 1.57%
38.19 + 0.48%
60.14 14 + 6.11%
Test
Adversarial
6.08 = 1.78%
35.92 = 0.45%
60.30 + 6.26%
(a) Train task embeddings (standard training)
(h) Test task embeddings (c) Train task embeddings (d) Test task embeddings
(standard training)
(adversarial training)
(adversarial training)
Figure 5: Projected embeddings of MetaOptNet-SVM for a train and a test task query data from
CIFAR-FS. We compare standard and adversarial training discussed in Section 3.3 Points are colored with their labels. Highlighted points are the worst-case support examples selected with Algorithm
to query data from train task for standard and adversarially trained models, and embeddings in (b) and (d) to query data from a test task for the corresponding models. All embeddings appear well-clustered, however embeddings in (c) have the largest separation and the smallest within-class variance. This wouldn't 't make a significant difference in supervised learning with enough data, but makes big difference for leamnin: when using Algorithm to find the worst-case support examples (highlighted in the figures), the corresponding accuracies are 1.8% for (a), 2.90% for (b), 99.4% for (c), and 5.70% for (d). We see that although embeddings are well-sepaaraed only (c) robust to support data selection. We present the projected embeddings for variety of meta-learners on the FC100 dataset in Appendix D we discuss next, robust meta-learning, addition to vanilla linear-separabiliy, requires features with bigger class separation and lower intra-class variances.
In the following theorem, we show that as long as the class embeddings are sufficiently separated, the probability of any two points sampled from the classes leading to a max-margin classifier with large misclassification rate is exponentially small. We note the high degree of separation (linear in embedding dimension) necessary to guarantee robustness to the choice of support data. This suggests unless the class embeddings are well separatdd, the resulting meta meta-learning algorithm will be sensitive to the choice of support data.
Theorem 4.1. Consider (binary) Gaussian discriminant analysis model:
X Y N(H, o²
X Y
N(-u,
FFor comparison, the accuracies of the corresponding supervised learning problems (i.e. linear classifiers trained using embeddings of all 400 per class potential support examples X, rather than a single example per class) are 99.6% for (a) and 94.3% for (b).

---

As long as μ. (d+ /2dt + 2 for some t >> O, then the max-margin classifier between two points
sampled independently from each cluster has misclassification rate at most Φ (0-d d / 2t) with probability at least (1 e
Proof. Consider a (binary) Gaussian discriminant analysis model:
X Y = 1~ o(,,
X Y 0 N
Define the core of the clusters as the sets
C1 f fxER"
|| - 2اl S ro),
Co f
R
|| + xll S ro).
It is a tedious geometric exercise to show that as long as μ 2ro. then the midpoint of any pair of points (x1, 2n) E C₁ x Cn falls outside C₁ U Cg. Further, the hyperplane
H = {x Rdd (z) ro)²= (11=) 1 112 [mmo1
bisects Co and C1 for any choice of 21, Fo. This implies the risk of any max-margin classifier constructed from 21 and Zn has miselassification error rate at most (-r)- where + is the N 1) CDF. We note that the probability of pair of independently sampled points To ~ (--u, Ia) falling in Ci and Co respectively is (r), where Fx is the CDF of x² random
N(,, Ia) and
scalar. By picking r + 22dl + 21 for some 0, the probability of x C1 and zo E Co is at
least (1 - e 1)
5
Conclusion
We studied the problem of support data sensitivity in meta-learning: the performance of existing algorithms extremely sensitive to the examples used for adaptation. Our findings suggest that when deploying meta-learning, especially in safety-critical applications such autonomous driving or medical imaging, practitioners should carefully check the support examples they label for the meta-learner. However, even when the data is interpretable for a human, e.g. images, recognizing potentially detrimental examples could be hard as we have seen in our experiments.
In our experiments, we considered popular few-shot image classification benchmarks. We note that meta-learning has also been applied to data other modalities such as language understanding O and speech recognition [16]. We expect our conclusions and Algorithm | for finding the worst-case support data apply in other meta-learning applications, however, an empirical study is needed to verify this.
Going forward, our results suggest that robustness in meta-learning could be achieved by explicitly encouraging separation and tighter intra-class embeddings (at least in the context of last-layer adaptation meta-learners). Unfortunately. the adversarial training approach, while successful in promoting robustness in many applications, fails to achieve robustness of meta-leamnrs to support data. In our experiments, adversarial training achieved well-separated and tight intra-class embeddings resulting in robustness on the train tasks (i.e., tasks composed of classes seen during training), but failed to improve on the test tasks. Our findings demonstrate that new approaches are needed to achieve robustness in meta-learning.
Finally, we note that our results provide new perspective on a different meta-leaming phenomenon studied in prior work. Setlur et al. (36] and Ni et al. [27] studied the importance of the support quantified the impact of the support data diversity, while Ni et al. [27] considered the effectiveness of the support data augmentation, and both concluded that meta-learning is insensitive to the support data quality and diversity. In our experiments with variation of adversarial training in Section 3.3 where support data during training is selected based on Al Algorithm| to find worst-case support examples, we achieved significant improvements in terms of the worst-case accuracies on the train tasks. Thus, the conclusion is different from 33 27 i.e. the
data during training. Setlur et al. 36
support data used during training has an impact on the resulting meta-learner from the perspective of sensitivity studied in our work.
10

---

Acknowledgments and Disclosure of Funding
This note is based upon work supported by the National Science Foundation (NSF) under grants no. 1916271, 2027737, and 2113373, Any opinions, findings, and conclusions recommendations expressed in this note are those of the authors and do not necessarily reflect the views the NSF.
References
[1] Brandon Amos and J Zico Kolter. Opıee:: Differentiable optimization as a layer in neural networks. In International Conference Machine Learning, pages 136-145. PMLR, 2017.
[2] Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine Bias. May 2016.
[3] Sébastien MR Arnold, Praateek Mahajan, Debajyoti Datta, Ian Bunner, and Konstantinos Saitas Zarkias. learn2learn: A library for meta-learning research. arXiv preprint arXiv:2008. 122844 2020.
[4] Luca Bertinetto, Joao Henriques, Philip Torr, and Andrea Vedaldi. Meta-learning with differentiable closed-form solvers. In International Conference on Learning Representations, 2019.
[5] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[6] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
[7] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Ieee, 2009.
[8] Guneet S Dhillon, Pratik Chaudhari, Avinash Ravichandran, and Stefano Soatto. A baseline for few-shot image classification. arXiv preprint (7Xiv:1909.027220 2019.
[9] Zi-Yi Dou, Keyi Yu, and Antonios Anastasopoulos. Investigating meta-learning algorithms for low-resource natural language understanding tasks. arXiv preprint 1rXiv:1908.1044 2019.
[10] Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adapta- tion of deep networks. In International Conference on Machine Learning. pages 1126 1135. PMLR, 2017.
[11] Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: A meta-learning approach. arXiv preprint 19100:1910.0000 2019.
[12] Micah Goldblum, Steven Reich, Liam Fowl, Renkun Ni, Valeriaa Cherepanova, and Tom Goldstein. Unraveling meta-learning: Understanding feature representations for few-shot tasks. In International Conference on Machine Learning, pages 3607-3616. PMLR, 2020.
[13] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- 2014.
ial examples. arXiv preprint
[14] Edward Grefenstette, Brandon Amos, Denis Yarats, Phu Mon Htut, Artem Molchanov, Franziska Meier, Douwe Kiela, Kyunghyun Cho, and Soumith Chintala. Generalized inner loop meta- learning. arXiv preprint 1910:01/1000/727,, 2019.
[15] Timothy Hospedales, Antreas Antoniou, Paul Micaelli, and Amos Storkey. Meta-learning in neural networks: A survey. arXiv preprint arXiv:2004. 05439, 2020.
[16] Jui- Yang Hsu, Yuan-Jui Chen, and Hung-yi Lee. Meta learning for end-to-end low-resource speech recognition. In ICASSP 2020-2020 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pages 7844-7848. IEEE, 2020.
[17] Gregory Koch, Richard Zemel, and Ruslan Salakhutdinov. Siamese neural networks for one-shot image recognition. In ICML. deep learning workshop, volume 2. Lille, 2015.
[18] Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Sara Beery, al. Wilds: A benchmark of in-the-wil wild distribution shifts. arXiv preprint 2rX1v:2012.07421, 2020.
11

---

[19] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[20] Brenden Lake, Ruslan Salakhutdinov, Jason Gross, and Joshua Tenenbaum. One shot learning of simple visual concepts. In Proceedings of the annual meeting of the cognitive science society, volume 33, 2011.
[21] Kwonjoon Lee, Subhransu Maji, Avinash Ravichandran, and Stefano Soatto. Meta-learning with differentiable convex optimization. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 10657-10665, 2019.
[22] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.0660
2017.
[23] Gabriel Maicas, Andrew P Bradley, Jacinto C. Nascimento, Ian Reid, and Gustavo Carneiro. Training medical image analysis systems like radiologists. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pages 546-554. Springer, 2018.
[24] Al Mead. Review of the development of multidimenssonal scaling methods. Journal of the Royal Statistical Society: Series D (The Statisticiaan, 41(1):27-39, 1992.
(25) Erik G Miller, Nicholas E Matsakis, and Paul A Viola. Learning from one example through shared densities on transforms. In Proceedings IEEE Conference on Computer Vision and Pattern Recognition. CVPR 2000 (Cat. No. PR00662), volume 1, pages 464-471. IEEE, 2000.
[26] Nikhil Mishra, Mostafa Rohaninejad, Xi Chen, and Pieter Abbeel. A simple neural attentive meta-learner. arXiv preprint arXiv:1707 1707,03 2017.
[27] Renkun Ni, Micah Goldblum, Amr Sharaf, Kezhi Kong. and Tom Goldstein. Data augmentation for meta-learning. In International Conference Machine Learning, pages 8152-8161. PMLR, 2021.
[28] Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-leaming algorithms. arXiv preprint 1803. 2018.
[29] Joseph D Novak, D Bob Gowin, and Gowin D Bob. Learning how to learn. cambridge University press, 1984.
[30] Eire Talea Oldewage, John F Bronskill, and Richard E Turner. Attacking few-shot classifiers with adversarial support sets. 2020.
[31] Boris N Oreshkin, Pau Rodriguez, and Alexandre Lacoste. TADAM: task dependent adaptive metric for improved few-shot learning. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pages 719-729, 2018
[32] Eunbyung Park and Junier Oliva. Meta-curvature. In Advances in Neural Information Processing Systems, volume 32, 2019, URL 1a30b52991b Paperd.ppppppppp
[33] Siyuan Qiao, Chenxi Liu, Wei Shen, and Alan L Yuille. Few-shot image recognition by predicting parameters from activations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 7229-7238, 2018
[34] Sachin Ravi and Hugo Larochelle. Optimization as a model for few-shot learning. 2016.
[35]
Ahmad El Sallab, Mahmoud Saeed, Omar Abdel Tawab, and Mohammed Abdou. Meta learning framework for automated driving. arXiv preprint arXiv: /706. 04038, 2017.
[36] Amrith Setlur, Oscar Li, and Virginia Smith. Is support set diversity necessary for meta-learning? arXiv preprint arXiv:2011. 140448, 2020.
[37] Dylan Slack, Sorelle A Friedler, and Emile Givental. Fairness warnings and fair-maml: learning fairly with minimal data. In Proceedings of the 2020 Conference on Fairness, Accountability and Transparency, pages 200-209, 2020.
[38] Jake Snell, Kevin Swersky, and Richard S Zemel. Prototypical networks for few-shot learning. arXiv preprint 1703::1703.0515. 2017.
[39] Kihyuk Sohn, David Berthelot, Chun-Liang Li, Zizhao Zhang, Nicholas Carlini, Ekin D Cubuk, Alex Kurakin, Han Zhang, and Colin Raffel. Fixmatch: Simplifying semi-supervised learning with consistency and confidence. arXiv preprint arXtv:2001.07688; 2020.
12

---

[40] Xingyou Song. Yuxiang Yang, Krzysztof Choromanski, Ken Caluwaerts, Wenbo Gao, Chelsea Finn, and Jie Tan. Rapidly adaptable legged robots via evolutionary meta-learning. arXiv preprint arXiv:2003.01239 2020.
[41] Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Koray Kavukcuoglu, and Daan Wierstra. Matching networks for one shot learning. arXiv preprint arXiv:1606.04000 2016.
[42] Abraham Wald. Statistical decision functions which minimize the maximum risk. Annals of Mathematics, pages 265-280, 1945.
[43] Mitchell Wortsman, Kiana Ehsani, Mohammad Rastegari, Ali Farhadi, and Roozbeh Mottaghi. Learning to learn how to learn: Self-adaptive visual navigation using meta-learning. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 6750-6759, 2019.
[44] Han Xu, Yaxin Li, Xiaorui Liu, Hui Liu, and Jiliang Tang. Yet meta learning can adapt fast, can also break easily. arXiv preprint arXiv:2009. 01679, 2020.
[45]
Chengxiang Yin, Jian Tang, Zhiyuan Xu, and Yanzhi Wang. Adversarial meta-leamiing arXiv preprint arXiv: 03316, 2018.
Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See 3 for limitations on finding
adaptation vulnerabilities and 3.33 for adversarial training limitations
(c) Did you discuss any potential negative societal impacts of your work? [N/A]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes]
(b) Did you include complete proofs of all theoretical results? [Yes]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as URL)? [Yes] Material for reproducbility of experiments is currently included in the supplement, and will later be released online
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See sections 3.1 and 3.3
(c) Did you report error bars (e.g., with respect to the random seed after running exper- multiple times with different seeds and standard deviations are reported for each experiment
iments multiple times)? [Yes] All experiments
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] We use machines on internal cluster with single V-100 GPU to run all our experiments
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you eite the creators? [Yes]
(b) Did you mention the license of the assets? [Yes] External existing assets used in this
work are either MIT or Apache licensed
(c) Did you include any assets either in the supplemental material Additional code for methods proposed in this work are included in the supplemental material
URL? [Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you're using/curating? [N/A]
13

---

(c) Did you discuss whether the data you are using/curating contains personally identifiable information offensive content? [N/A] Standardized image classification datasets are used with no known personally identifiable information available
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "icuDZnKa8Bp", "reviewer": "Reviewer_kYmb", "summary": "This work observes that meta-learners are incredibly sensitive to support data for fine-tuning and explains this phenomenon in terms of margins.", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "1)  Better understanding exactly how meta-learning works and understanding its properties is an interesting direction and is important given the popularity and success of meta-learning.\n\n2)  [1] examines sensitivity to support data (during training) from an adversarial view in which the worst-case support data is not natural images but adversarially perturbed ones.  It would be good to relate your work to the findings from this paper.\n\n3)  [2] studies the sensitivity of meta-learning to the support set during training rather than testing in Section 3.  This work should also be considered in your paper.\n\n[1] Attacking Few-Shot Classifiers with Adversarial Support Sets\n[2] Data Augmentation for Meta-Learning\n\nIf the authors relate their work to the above papers and justify the novelty and significance of their conclusions in the context of these works, I am open to raising my score.\n\n[Update: increased score to reflect that my comments were addressed]", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors do adequately address the limitations and impact of their work.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "JxI8dNtkd16", "reviewer": "Reviewer_fbrp", "summary": "This paper empirically finds that popular meta-learning algorithms are very sensitive to the selections of the support images. The author shows that six meta-learning algorithms can achieve testing accuracy within a wide accuracy (worst case accuracy is extremely poor) given different support samples. They also find that this problem cannot be trivially solved by adversarial training.\n", "questions": "", "limitations": "", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper is easy to follow and the topic and findings are interesting to me. The robustness to the support data seems important to areas such as medical data and autonomous driving. It’s interesting to see the robustness of large support samples (10-shot) is not robust enough to testing samples. However, the authors fail to get a solution to this problem and thus their analysis part is not enough to address how important the problem is.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "1) I wonder whether this sensitivity to support data is only to meta-learning or to the whole few-shot learning. For example, will the pre-trained feature embedding from regular supervised training or self-supervised learning suffer from the same problem?\n\n2) I think we need more analysis for the worst cases. For example, are the worst cases the same across different meta-learners?  How do the feature representations perform for the worst case images, are they on the boundary of classification? \n\n3) I am not sure how important the question is, especially for 1-shot cases. As long as your model is not 100% accurate for meta-test tasks, you can always find the misclassification cases, and set them to be support data in which case I don’t think it’s possible to get a good accuracy.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "4K1WBf-gnPr", "reviewer": "Reviewer_Yniy", "summary": "The paper studies the sensitivity of meta-learning to the support data. The paper presents an algorithm for finding the best and worst support examples relative to the test accuracy, and demonstrates empirically the sensitivity of several meta-learning methods to the support data. The paper explored using  adversarial robustness strategies, however, while these methods seem to work on the training tasks, they fail to generalize on new test tasks. The paper explores the sensitivity of meta-learning algorithm to the support data from the margin perspective, arguing that higher margins and interclass tightness leads to more robust meta-learning methods.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "## Originality\n\n- The paper presents a greedy search algorithm (Algorithm 1) to study the sensitivity of meta-learning algorithms to the support data. The empirical analysis presented in the paper to quantify this sensitivity is novel and useful for the meta-learning practitioners to be informed about.However, it’s limited only to few-shot classification tasks, and doesn’t include other meta-learning applications  for instance in language and speech. \n\n- Related work was discussed in the introduction and background section, some missing references include: “ Setlur, Amrith, Oscar Li, and Virginia Smith. \"Is Support Set Diversity Necessary for Meta-Learning?.\" arXiv preprint arXiv:2011.14048 (2020).” and the references within.\n\n## Quality\n\n- The submission is technically sound, and the claims are well supported empirically. The paper provides a simple theoretical analysis for the effect of increasing the classification margin on robustness.\n\n- The proposed greedy search method is appropriate and succeeds in finding the best and worst support training point, despite lacking the guarantees for global convergence. \n\n- Evaluation was performed only on computer vision tasks.\n\n## Clarity\n\n- The submission is clearly written, well organized, and easy to follow. \n- Algorithm 1 could be illustrated better with a figure or a running example.\n\n## Significance\n\n- The analysis is useful for the meta-learning community to be informed about, however, no direct solution for the problem was presented in the paper. The paper presents the insight that maximizing the classification margin and minimizing inter-class variations would improve robustness. Adversarial training didn’t improve the results significantly on new test tasks.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "- Empirical analysis was only conducted in a few-shot text classification setup.\n- Actionable solutions for mitigating the sensitivity of the meta-learning methods to support data wasn’t presented.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "-wGyAQYSZkv", "reviewer": "Reviewer_Vkec", "summary": "This paper is studying the performance of several meta-learning approaches depending on the support images used for meta-test tasks. \nFirst, the authors propose a simple greedy algorithm that select for each class in a given task, the image giving the worst/ the best performance. With this algorithm, they show that popular meta-learning approaches have a very high variance in their performance and that the worst case scenario is often worse than a random guess. The authors argue that the worst tasks found by their algorithm are not artifacts in the distribution, and can realistically appear. \nThen, they apply their algorithm to train the meta-learning methods in an adversarial way, by learning on the worst cases found by their algorithm. Even though the adversarial training improves the worst-case performance on the meta-training tasks, there are no improvements on the worst-case accuracy on meta-testing tasks.\nFinally, the authors argue that the worst-case performance are better when the task embeddings are sufficiently separated. ", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "__**Originality:**__  The paper presents an interesting approach to find worst/best case performance and a novel evaluation of performance for meta-learning methods. The evaluations are similar to some experiments in semi-supervised setting [1], but it was never investigated in the case of meta-learning.  \n This paper shows actual evidence that there is a high variance when evaluating meta-learners. It is the first time I see an actual computation of worst and best performance, even though the problem was already raised [2].\n\n__**Quality:**__  The paper propose a simple but effective greedy algorithm for computing worst/best case performance. If I understand correctly, the algorithm searches from *all* possible support images for a given class. I think it would be interesting to have the computing time of this algorithm, since it seems quite heavy to compute the performance for all possible images.   \nUsing an adversarial training scheme with the proposed algorithm is interesting, even though it did not help to improve the worst case performance. It shows that reducing the variance in performance is complicated. \n\n__**Clarity:**__  The main message and the writing of the paper are clear. The paper is also well-structured.  \nHowever, I think the discussions about the experiments could be improved, particularly section 3.2:\n- Each point in the section could benefit from their own conclusion to link it to the main point that worst support examples are not artifacts. Currently, the reader must draw the conclusion from each point themselves. \n- Figures 2 and 3 are hard to understand because they appear before their introductions and the explanations of the experiments in the text. This makes it difficult to understand the conclusions that we have to draw from them. \n- The meaning of an *iteration* of the algorithm should be clarified. If I understand correctly, an iteration means going through all support images for each class. I had to look at the code to really understand the algorithm.\n\n__**Significance:**__ I think the paper is valuable for practitioners. It brings concrete evidence that there is high variance in performance of meta-learning methods. This is currently a significant problem in few-shot learning. The adversarial training experiment is a naive idea to try to alleviate this problem. Even though the authors show that it doesn't work, it could help future work.\n\n__**Minor Remarks:**__\n\n- What projection method was used ? I assumed it was t-SNE.\n- Experimental details for ProtoNets and R2D2 are missing in the appendix. From the performance, I assumed the authors used a ResNet-12 backbone, similarly to MetaOptNet.\n- Why is there so much variance for MAML and MC on average accuracy ? The variance is a lot higher than for other methods, and I never saw that much variance for these algorithms. I assumed it was a typo when reporting results.\n\n[1]: Sohn et al., *FixMatch: Simplifying Semi-Supervised Learning with Consistency and Confidence.* NeurIPS 2020  \n[2]: Dhillon et al., *A baseline for few-shot image classification.* ICLR 2020", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors did not discuss potential negative impacts of their work. Even though the work presented here is not fully theoretical, it is high upstream of the applications. To study the possible negative impacts of this kind of work is to study the negative impacts of the whole field, since it is discussing the way we are evaluating meta-learning models. As any other field in machine learning, meta-learning could also be used for harmful applications, such as quick racial profiling of a user.", "review_text": "", "extra_scores": {"ethical_concerns": "I do not see any ethical issues with this paper.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "I spent about 5 - 6 hours to review this paper."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The submission investigates the extent to which few-shot classification algorithms are sensitive to the selection of support images. It introduces a greedy algorithm for finding the worst/best support sets for a learning episode and reports that the performance of all six evaluated approaches drastically varies as a function of the support set composition. When adversarial training is employed to increase robustness, the authors report success for training episodes, but crucially these benefits do not translate to test episodes. Finally, the submission presents theory that suggests that robustness in metric-based few-shot learners could be obtained by encouraging inter-class separation and tighter intra-class clusters.

Reviewers appreciated the paper's writing clarity and found the problem setting to be interesting and of practical significance to the community. The authors provided the clarifications requested by the reviewers. Some reviewers pointed out that the authors failed to propose an effective solution, to which the authors rightfully replied that "problem-reporting" submissions can still make a substantial contribution to the field, citing Szegedy et al.'s paper on adversarial examples as evidence. Some reviewers noted that the paper's impact could be increased by considering domains beyond image classification, but ultimately found that it meets the bar for acceptance as it stands.

I therefore recommend acceptance.
Decision: Accept (Poster)