Title: Mixture of Adversarial LoRAs: Boosting Robust Generalization in Meta-Tuning
Venue: NeurIPS 2024
Accepted: yes
Keywords: meta-tuning

few-shot learning
Abstract: This paper introduces AMT, an \textbf{A}dversarial \textbf{M}eta-\textbf{T}uning methodology, to boost the robust generalization of pre-trained models in the out-of-domain (OOD) few-shot learning. To address the challenge of transferring knowledge from source domains to unseen target domains, we construct the robust LoRAPool by meta-tuning LoRAs with dual perturbations applied to not only the inputs but also singular values and vectors of the weight matrices at various robustness levels. On top of that, we introduce a simple yet effective test-time merging mechanism to dynamically merge discriminative LoRAs for test-time task customization. Extensive evaluations demonstrate that AMT yields significant improvements, up to 12.92\% in clean generalization and up to 49.72\% in adversarial generalization, over previous state-of-the-art methods across a diverse range of OOD few-shot image classification tasks on three benchmarks, confirming the effectiveness of our approach to boost the robust generalization of pre-trained models. Our code is available at \href{https://github.com/xyang583/AMT}{https://github.com/xyang583/AMT}.

Mixture of Adversarial LoRAs: Boosting Robust Generalization in Meta-Tuning

Abstract

This paper introduces AMT, an A dversarial M etaT uning methodology, to boost the robust generalization of pre-trained models in the out-of-domain (OOD) few-shot learning. To address the challenge of transferring knowledge from source domains to unseen target domains, we construct the robust LoRAPool by meta-tuning LoRAs with dual perturbations applied to not only the inputs but also singular values and vectors of the weight matrices at various robustness levels. On top of that, we introduce a simple yet effective test-time merging mechanism to dynamically merge discriminative LoRAs for test-time task customization. Extensive evaluations demonstrate that AMT yields significant improvements, up to 12.92% in clean generalization and up to 49.72% in adversarial generalization, over previous state-of-the-art methods across a diverse range of OOD few-shot image classification tasks on three benchmarks, confirming the effectiveness of our approach to boost the robust generalization of pre-trained models. Our code is available at https://github.com/xyang583/AMT.

1 Introduction

Few-shot learning (FSL) has recently been revolutionized by large-scale pre-trained vision transformer models [1, 2, 3, 4, 5]. Their generalization capability can be further enhanced with a few annotated examples, achieving impressive performance across a broad spectrum of downstream tasks [6, 7, 8, 9, 10]. Building on this foundation, meta-tuning emerges as a powerful strategy that integrates the broad generalization capabilities of pre-trained prior knowledge with the adaptive flexibility of meta-learning, allowing models to quickly adapt to new tasks in few-shot scenarios [11, 12].

Despite its success, the robust generalization of meta-tuning to defend against adversarial attacks [13, 14, 15] and adapt to out-of-distribution (OOD) downstream tasks [16, 17, 18] remains an ongoing challenge. However, it is crucial for various real-world applications such as medical imaging diagnostics and autonomous driving to simultaneously achieve competitive performance on adversarial examples or out-of-distribution data. Deployed models often encounter novel environments with distribution shifts between training and test data, including variations in hospital equipment and protocols [19] or diverse urban road scenarios [20]. Moreover, these models are vulnerable to adversarial attacks leading to harmful diagnoses or unsafe driving decisions. For instance, adversaries can perturb sensor signals to deceive 2D or 3D medical imaging models [21], manipulate traffic signs with malicious stickers [22], or fool the autopilot into following unsafe trajectories [23].

In this paper, we delve into leveraging adversarial training and meta-tuning to enhance robust generalization of pre-trained vision transformers across different domains. Compared with previous meta-tuning approaches, this involves two unique aspects. Firstly, when incorporating adversarial

examples, the model should learn to adapt to the worst-case tasks while preserving its inherent generalization capabilities. Inspired by the observation that the singular values distribution of weight parameters undergoes significant changes during fine-tuning [24], we aim to explicitly strengthen the principal components of pre-trained model weight matrices during meta-tuning. To this end, we inject perturbations on both input and principal singular values and vectors via the incremental meta-update of the Low-rank Adapter (LoRA) [25, 26] on top of frozen pre-trained parameters. Secondly, the adversarial perturbation needs to simulate wide distribution variations from the training environment, and care must be taken to avoid interference when training with multiple perturbation types [27, 28]. Thus, we introduce an adaptive robust LoRAPool constructed by meta-tuning different LoRAs in parallel for different attack strengths. To adapt to novel tasks from unseen distributions, we view the robust LoRAPool as the basis and integrate meta-updated principal components into the pre-trained model through a test-time merging mechanism for downstream task customization.

Our main contributions are summarized as follows:

We propose AMT, a novel adversarial meta-tuning approach for enhancing the robust generalization of pre-trained vision transformers across diverse domains.

By injecting the adversarial perturbations on the inputs, singular values and vectors of the weight matrices, the core components of pre-trained model weights are consolidated for worst-case tasks. We further enhance this approach with the adaptive robust LoRAPool meta-tuned under varying perturbation budgets, without compromising the pre-trained model's inherent capabilities.

We integrate discriminative principle components into the pre-trained model via a simple yet effective test-time merging mechanism for customizing task-specific feature extractors, which is compatible with other test-time fine-tuning methods.

We experimentally evaluate our method on challenging large-scale out-of-domain few-shot image classification benchmarks, including Meta-Dataset [16] that consists of 9 OOD datasets, as well as BSCD-FSL [29] and fine-grained datasets [30] comprising another 8 OOD datasets. Our method achieves impressive few-shot performance across domains, significantly outperforming previous state-of-the-art methods in clean generalization by up to 12.92% and in adversarial generalization by up to 49.72%.

2 Related work

Out-of-Domain Few-shot Learning and Meta-Learning. Out-of-Domain Few-Shot Learning (OOD-FSL) aims to transfer prior knowledge learned on source domains to unseen target domains to address the few-shot learning problem [16, 17, 18, 29, 31, 32, 33, 34, 35, 36]. Meta-learning relies on episodic training to learn parameter initialization [37, 38, 39], optimization rule [40, 41, 42] or a transferable metric space [43, 44, 45, 46, 47] as prior knowledge for quick adaptation to new tasks. To tackle distribution shifts, many methods are proposed by building a universal feature representation with multiple feature extractors [32, 31], conditioning batch normalization parameters [48, 30, 33], or test-time gradient-based fine-tuning [34]. Most related to our work is FLUTE [33], which jointly trains the feature extractor with multiple sets of Feature-wise Linear Modulation (FiLM) [49] parameters on multiple training datasets and combines them as the initialization for gradient descent at test time. Our method AMT stands in the single source domain setting and differs from previous works in that our adversarial meta-tuning does not compromise the pre-trained model, and the adaptive merging mechanism of the robust LoRAPool performs task customization in a non-parametric manner without the requirement of gradient descent, ensuring scalability with newly added components to the pool.

Vision Transformers in Few-shot Learning . Vision Transformers (ViTs) have gained prominence as the foundation model due to their ability to capture long-range dependencies in data [50, 51, 52]. Selfsupervised pre-training effectively endows vision transformer with data-driven and well-generalized prior [1, 2, 53, 54], especially for the few-shot learning task. In the spirit of transfer learning, one line of works leverages self-distillation framework to seek universal feature representations without meta-training [55, 56, 57] and directly learns auxiliary visual prompts [58] and attention scaling matrices [59] on the support set through gradient descent during meta-testing. Another important research direction is developing meta-learning techniques to enhance pre-trained models with input-conditioned prompts [8] and task-specific masks [11]. PMF [12] contributes a strong baseline by meta-tuning the full model. In this work, we also ground our method on pre-trained vision transformers and show that adversarial meta-tuning can further boost their robust generalization across downstream tasks. Also, our contribution is orthogonal to other existing test-time fine-tuning methods and provides a better starting point to improve their performance at test time.

Adversarial Training for Out-of-Distribution Generalization. Adversarial training [13] is one of the most effective defense techniques to improve the model adversarial robustness by minimizing a locally maximized loss function via adversarial perturbation on inputs [13, 60, 61, 62, 63, 64, 65] and model parameters [66]. Despite widely recognized trade-offs between adversarial robustness and clean accuracy [67, 68], and between in-distribution (ID) and out-of-distribution (OOD) generalization [63, 69], there exist strategies to achieve better balances among these trade-offs. These strategies include modified adversarial training regime [65], dual sets of parameters [70, 71, 72], model ensemble [73], multi-scale patch perturbations [74], or partial fine-tuning strategy [75]. Furthermore, since adversarially perturbed input data can be viewed as a special type of OOD data [76], recent studies [77, 78, 79] have demonstrated that adversarial pre-training can enhance generalization performance on downstream datasets and improve robustness against distribution shifts. Compared with sample-wise adversarial attacks, where all samples in each domain share the universal perturbation, the distributional attacks in a low-rank structure show the capability of making the models resistant against adversarial perturbations of higher magnitude [80, 81] Inspired yet different from the previous attack methods, our method utilizes a mixture of adversarial low-rank adaptors customized for meta-tuning to enhance the robust generalization of clean pre-trained models.

Adversarial Meta-Learning. There is a series of works that leverage adversarial training to enhance the few-shot learner's adversarial robustness [14, 15, 82, 83]. However, compared with standard few-shot learning, the adversarially trained model has degraded clean accuracy [14]. Adversarial training is also utilized to improve the cross-domain few-shot learning performance by attacking individual image pixels [84] and features [85, 86]. For example, StyleAdv [86] perturbs each sample style in a task through attacking statistical information of AdaIN [87] and updating all parameters. Our approach diverges from these existing methods, aiming to further enhance the generalization performance of large-scaled pre-trained models. To achieve this, we propose to inject double perturbations on inputs as well as singular values and vectors over the entire query set as a whole during meta-tuning, while keeping all pre-trained parameters frozen to preserve prior knowledge.

Parameter-Efficient Few-Shot Learning. To reduce the computational cost associated with fullmodel fine-tuning, various parameter-efficient fine-tuning (PEFT) methods have been proposed that only update a small set of parameters, including inserting soft prompts [88, 89], adding adapter modules [90, 91, 92], and introducing low-rank matrices [25, 93, 94]. Recent works have shown that PEFT achieves comparable or superior performance than standard fine-tuning in the few-shot setting for large language models [95]. In this work, we explore crafting the small parameter sets via meta-tuning to boost robust generalization of pre-trained vision transformers. Concretely, we leverage LoRA [25] as the core parameter-efficient component for constructing the adaptive robust pool, as it enables low-rank updates to be merged into network weights without additional computational or memory costs incurred during inference.

3 Problem Formulation

In this work, we focus on out-of-domain few-shot image classification where our goal is to find parameters θ that generalize well on unseen target domains with the single-source training domain. In this context, the model not only needs to learn novel concepts from limited data but also to generalize well across diverse domains. For each domain, there exists a dataset collected from that environment. During training, we only have access to the single source training dataset D seen tr , from which each task T = ( S , Q ) is randomly sampled as the input. The support set S contains K annotated images for each of the N categories: S = { x s , y s } NK s =1 , while the query set Q contains M images Q = { x q , y q } M q =1 . At evaluation time, the aim is to tackle tasks with novel classes sampled from previously unseen datasets D unseen test .

4 Methods

We introduce our approach in this section. The overall framework of our AMT is illustrated in Figure 1. It contains two components: (i) adversarial singular value and vector perturbation, which explicitly perturbs the singular values and vectors to highlight the principal components in the worstcase tasks; (ii) Adaptive robust LoRAPool, which consists of several adversarially meta-tuned LoRA modules and test-time merging mechanism to adaptively merge them for task customization.

Query Set

Attack

𝜖

!

𝜖

"

𝜖

#

Perturbation Budgets

Support Set

Adversarial Query Set

😈

𝑆

[:#]

%/'

𝑉

[:#]

(

𝑈

[:#]

𝑆

[:#]

%/'

😈

𝑆

[:#]

%/'

𝑉

[:#]

(

𝑈

[:#]

𝑆

[:#]

%/'

😈

𝑆

[:#]

%/'

𝑉

[:#]

(

𝑈

[:#]

𝑆

[:#]

%/'

…

…

Adversarial Meta-Tuning

Test-time Merging

Robust LoRAPool

Trim

𝑊

$

# 𝑊

Pre-trained

Residual

Weights

❄

❄

Frozen

😈

Adversarial Perturbation

Meta-Tuning Forward

Test-time Merging Forward

ViT Block

ViT Block

…

❄

❄

Query Set

𝑓

%

(𝒮, 𝑥

&

)

ViT Block

❄

merging coefficient

😈

😈

😈

4.1 Preliminaries

Adversarial Meta-Tuning . We ground our method on a large-scale pre-trained Vision Transformer [50] and then meta-tune the model in an episodic manner [43], following PMF [12]. To robustify the learned meta-knowledge, adversarial meta-tuning adopts the worst-case optimization by injecting the adversarial perturbation δ to the query image x q through the minimax strategy [14, 15]. The intuition here is to make the meta-tuned model have the same prediction in the worst-case task.

We consider the l ∞ norm bounded perturbations in this work, so the corresponding optimization problem can be formulated as min θ max ∥ δ ∥ ∞ ≤ ϵ L ( f θ ( S , x q + δ ) , y q ) where f θ denotes predicted logits of a query example with the model parameters θ , and L is the meta-task loss, which is usually the cross-entropy loss for image classification. The inner maximization problem can be efficiently solved by gradient-based methods. In practice, Projected Gradient Descent (PGD) [13] is the most popular method to generate adversarial perturbations δ . Specifically, when the step size is α , PGD optimizes δ by running the following update rule for multiple iterations. Here, Π is the projection operator to clip δ so that ∥ δ ∥ ∞ ≤ ϵ .

Low Rank Adaptation . LoRA [25] is one of the popular parameter-efficient fine-tuning approaches for transformer models. Given a pre-trained weight matrix W ∈ R d in × d out , LoRA approximates incremental updates to the parameter matrix with a low-rank decomposition △ W = AB , where A ∈ R d in × r and B ∈ R r × d out , and the rank r ≪ min( d in , d out ) . The LoRA approach can be applied to all the linear layers in the vision transformer. For an input x and a hidden state h = Wx , LoRA modifies forward process as h = ( W + △ W ) x = Wx + ABx . When fine-tuning, W is frozen while A and B are trainable. In addition, A is randomly initialized via Gaussian initialization while B is initialized to zero, resulting in the incremental update AB = 0 at the beginning.

4.2 Adversarial Singular Value and Vector Perturbation

Drawing inspiration from the insight that the distribution of singular values undergoes significant changes during fine-tuning [24], we aim to explicitly strengthen the principal components of pretrained model weight matrices to enhance the model's generalization capability across diverse

target domains. Using the on-the-fly generated adversarial query samples, we inject the worstcase perturbation on singular values and vectors over the entire query set. However, meta-tuning the full model and performing multiple singular value decomposition (SVD) during training are computationally expensive. To this end, we adopt the LoRA formulation to update model parameters during meta-tuning and initialize the incremental updates of LoRA with the result of SVD of weight matrices for the multi-head self-attention (MHA) layer and feed-forward network (FFN) layer in the vision transformer [26].

Formally, for a weight matrix W ∈ R d in × d out and its singular value decomposition W = U diag( S ) V T , where U ∈ R d in × min( d in ,d out ) , V ∈ R d out × min( d in ,d out ) and S ∈ R min( d in ,d out ) represent the left/right singular vectors and the singular values in descending order, respectively. In the LoRA formulation △ W = AB with the rank r , the top r singular values and corresponding vectors are utilized to initialize A ∈ R d in × r and B ∈ R r × d out , while the residual singular values and vectors are used to calculate the residual matrix W res ∈ R d in × d out for error correction:

In Equation (2), we have W = W res + AB . During training, W res is kept frozen, so the updates of A and B in the subspace approximate the modification of principle singular value and vectors.

To boost the generalization performance of the model, we utilize the sharpness-aware minimization (SAM) [96] to update A and B . Specifically, we find the worst-case perturbation δ A and δ B in the neighborhood of A and B by gradient ascent. δ A is calculated by the following equation where M is the size of query set and η 1 depicts the size of the neighbourhood. δ B can be calculated similarly.

Here, we omit other parameters in θ for notation simplicity. We then use the gradient based on the worst-case neighborhood to update A and B . Given the learning rate η 2 , the update rule for A is as follows. B is updated similarly using the same learning rate.

Different from prior adversarial meta-learning works [14, 15], this paper focuses on improving both the clean accuracy and cross-domain robustness for few-shot learning [63]. The meta-objective function of AMT is the combination of both aspects:

where L CE is the original cross-entropy loss, D KL is the Kullback-Leibler divergence and λ adv is the trade-off coefficient. Note that here we use few-shot task loss instead of global classification loss in StyleAdv [86] to generate the adversarial attacks, by which we leverage label randomness to avoid the potential performance degradation caused by true label leaking effect [62].

4.3 Adaptive Robust LoRAPool

Robust LoRAPool Construction . To simulate various distributional shifts for the unseen tasks, we adversarially meta-tune P LoRAmodules in parallel by Equation (4), each corresponding to a different robustness level controlled by the size of the adversarial budget, i.e., ϵ in Equation 1. Therefore, we will obtain a robust LoRAPool composed of P LoRA modules ϕ = [ A 1 B 1 , . . . , A P B P ] . Algorithm 1 shows our adversarial meta-tuning pipeline.

Test-time Merging . Given several LoRA modules, the challenge in the evaluation time is to adaptively merge these modules in robust LoRAPool into the pre-trained model to fit the new tasks. It is commonly assumed in domain generalization that unseen distributions fall within the convex hull of the training environments [97, 98], so we consider the LoRAs in the pool as the bases and learn a convex combination adapted to the task at hand.

Algorithm 1 Robust LoRAPools

1: Input : Source training domain D seen tr ; pre-trained weight residual matrix W res ; P sets of attack configuration candidates; 2: Output : Adversarially meta-trained LoRAPool; 3: Initialize adversarial LoRAPool: ϕ = {} 4: for i = 1 to P (in parallel) do 5: Sample the i -th set of ϵ i , α i from attack configuration candidates. 6: Initialize the LoRA parameter AB via Eq. (2); 7: while not converged do 8: Sample a task T = {S , Q} ∼ D seen tr . 9: Generate adversarial query set Q adv = { x adv q , y q } q M =1 with ϵ i , α i via Eq. (1) 10: // Perturb singular value and vectors 11: δ A = η 1 · 1 M ∑ M q =1 ∇ A L ( f W res + AB ( S , x adv q ) , y q )) 12: δ B = η 1 · 1 M ∑ M q =1 ∇ B L ( f W res + AB ( S , x adv q ) , y q )) 13: // Update AB via SGD 14: A ← A -η 2 · 1 M ∑ M q =1 ∇ A L ( f W res +( A + δ A ) B ( S , x adv q ) , y q )) 15: B ← B -η 2 · 1 M ∑ M q =1 ∇ B L ( f W res + A ( B + δ B ) ( S , x adv q ) , y q )) 16: end while 17: ϕ = ϕ ⋃ AB 18: end for

To estimate the coefficient of this combination, we propose blending intra-class compactness and inter-class divergence on the support set as the criterion to extract the most discriminative features for classification. To reduce the computational cost of calculating pair-wise similarity between all support samples, we leverage the class prototype to approximate the cluster center of each class and calculate sample-prototype distances. Formally, for the i -th LoRA in the pool and the c -th class out of the total N classes, we denote the class prototype as the average of per-class support features p i,c = 1 K ∑ y s = c f W res + A i B i ( x s ) . The intra-class compactness C i and the inter-class divergence V i are then respectively defined as,

̸

where γ ( · , · ) denotes the cosine similarity between two feature vectors. After calculating the intraclass compactness and inter-class divergence for each LoRA, the merging coefficient ζ i for each LoRA module can be estimated as

where β and λ stand for smooth and balance factors, respectively. The operation Top k before softmax refers to selecting the top k LoRA modules with the largest score and the rest LoRAs are deactivated for the current task. The merged weight matrix is then calculated as W ′ = W res + ∑ P i =1 ζ i A i B i . To address the issue of interference stemming from redundant components during merging [99], we introduce singular value trimming, retaining only the largest topρ % singular values and resetting the rest to zero to obtain the final task-specific weight ̂ W :

This design provides high expressiveness and flexibility by specifying suitable LoRAs for novel tasks, significantly enhancing the model's adaptation ability to generalize across unseen domains. Algorithm 2 in the Appendix A shows our test-time merging algorithm pipeline.

Network Inference . After obtaining the task-specific feature extractor through test-time merging, we can employ it directly for inference and perform the nearest-centroid classification [44, 12]. To further improve the few-shot performance in each novel task, our AMT is compatible with other cutting-edge test-time fine-tuning approaches, and thus we introduce a variant AMT-FT, which allows for additional full [12] or efficient [59] fine-tuning.

5 Experiments

We evaluate the effectiveness of the proposed AMT on three cross-domain few-shot image classification benchmarks in Section 5.1. Additionally, we present ablation studies in Section 5.2, conduct a broader analysis in Section 5.3, and compare our approach with other PEFT methods in Section 5.4.

Experimental setup . We evaluate AMT using the large-scale cross-domain few-shot classification benchmarks Meta-Dataset [16], BSCD-FSL [29] and fine-grained datasets [30].Note that, in the main experiments, all methods utilize a single model trained on the source domain ImageNet to analyze the trade-offs between robustness and generalization. The details of each benchmark are described in Appendix B.1. And training and evaluation details are included in Appendix B.2. We conduct a comprehensive hyperparameter study in Appendix H.

Baselines . We adopt the state-of-the-art PMF [12] as the meta-tuning baseline method and use ATTNSCALE [59] as the baseline for an efficient test-time fine-tuning approach. To evaluate our approach against previous adversarial few-shot learning methods, we choose StyleAdv [86] as the representative. All methods employ a Vision Transformer [50] which is DINO-pretrained [1] on ImageNet-1K in our main experiments.

5.1 Comparison with State-Of-The-Art Methods

Clean OOD-FSL . In Table 1, we evaluate AMT on Meta-Dataset to investigate its generalization performance on OOD few-shot learning problem in both the 5 -way 1-shot and 5 -shot settings. We group approaches in two settings. The tuning-free setting does not involve additional training on the support set. We adaptively merge meta-tuned LoRA into pre-trained models via our nonparametric test-time merging mechanism and perform prototype-based classification. Aside from this, the test-time fine-tuning setting allows for training on the support set according to different fine-tuning methods, such as fine-tuning full parameters [12] or partial parameters [59]. Our proposed method AMT consistently achieves superior performance across all domains in the tuning-free setting, up to 12.92% on Omniglot, compared with previous state-of-the-art methods. Moreover, thanks to the flexible design of LoRAPool and the meta-learned well-generalized initialization for pre-trained models, AMT demonstrates strong compatibility with advanced fine-tuning approaches, further boosting few-shot learning performance, with the improvements of 3.92% and 4.3% over PMF [12] and ATTNSCALE [59], respectively. Notably, unlike previous StyleAdv [86], our robust generalization improvement does not sacrifice the in-domain clean accuracy. We attribute this to our adaptive robust LoRAPool design, which completely inherits the pre-trained knowledge and performs customization by injecting discriminative information for unseen tasks. We take a further comparative analysis on BSCD-FSL [29] and fine-grained dataset [30] in Table 2 and under the variable-way-variable-shot setting in Table 18 of Appendix K. The overall performance improvement demonstrates the effectiveness of our method.

Adversarial OOD-FSL . We evaluate adversarial robustness under distribution shifts for previous state-of-the-art methods using the PGD-10 attack [13] in Table 3. We observe that the naturally trained meta-tuning method PM [12] is not adversarially robust. The style adversarial attack method StyleAdv [86] is also highly vulnerable to adversarial attacks in most domains and sacrifices nearly seven percentage points in-domain performance. In contrast, our method AMT consistently outperforms previous state-of-the-art methods by a wide margin in terms of both in-domain and out-ofdomain robust accuracy, achieving up to 49.72% on Omniglot. Additionally, our method AMT-FT exhibits synergy with the adversarial test-time fine-tuning strategy, further boosting the in-domain and out-of-domain few-shot adversarial robustness. To take a step further, we measure adversarial robustness against AutoAttack [100] and unseen attacks under distribution shifts in Table 19 and Table 20 of Appendix M, respectively. The results indicate that AMT consistently boosts adversarial generalization across domains. Intriguingly, as shown in Figure 4 of Appendix L, AMT can also handle natural corruptions under distribution shifts. As a whole, AMT improves the trade-offs between adversarial robustness and clean accuracy [68, 63], as well as between ID and OOD generalization [3].

5.2 Ablation Study

Component Analysis . In Table 4, we demonstrate the effectiveness of various components in our method: adversarial perturbation on query images and singular values and vectors, robust LoRAPool, test-time merging, and singular value trimming. For the method incorporating adversarial perturbation

on query images, we randomly sample the attack budget from attack configuration candidates used in training the robust LoRAPool. We find that this strategy improves OOD generalization but sacrifices in-domain accuracy. For the method without test-time merging, we adaptively determine the suitable LoRA in the pool based on the minimum cross-entropy loss observed in the support set. Relying solely on minimizing the cross-entropy loss on the support set can lead to overfitting, particularly on Omniglot and Traffic Sign, which have a large domain gap relative to the source domain. The degraded overall performance when removing adversarial perturbations on singular values and vectors, regardless of whether we use test-time merging strategy, verifies the role of our double-perturbation mechanism for effective robust generalization enhancement.

Effectiveness of Adversarial Perturbation on Singular Value and Vectors . To demonstrate the benefits of our adversarial attack strategy, we further compare AMT against the variant removing the adversarial perturbations on singular values and vectors, as shown in Figure 2. We find that our AMT can significantly amplify the magnitude of the top singular values for FFN layers (see Figure 3 in Appendix D for MHA layers). We argue that the double adversarial perturbation explicitly forces the model to focus more on the most critical components, thereby enhancing its resilience against worst-case scenarios during meta-tuning. Therefore, this improves the model's robust generalization capability, allowing it to adapt more effectively to novel downstream tasks across diverse domains.

Different Pool Designs and Adversarial Perturbation Strategies . As shown in Table 8 of Appendix G, the proposed robust LoRAPool with perturbation-specific parameters effectively avoids interference between different attacks and significantly enhances the out-of-domain generalization

without in-domain compromise. Furthermore, we compare with SAM [96] and the original LoRA initialization [25] in Table 9 and Table 10 of Appendix G, where the superior performance validates the efficacy of our adversarial singular value and vector perturbations in boosting the model's generalization capability. See Appendix G for more details. Moreover, in Table 16 of Appendix I, we observe that the simple pixel-level adversarial attacks can effectively simulate larger domain shifts than static data augmentation [101] and achieve comparable or superior generalization improvements compared to the learnable adversarial transformation method [102].

5.3 More Analysis

Alternative Test-time Merging Strategies . Before finalizing our test-time merging mechanism, we experimented with various design choices. The first idea involves employing a parametric linear classifier to evaluate the compatibility of LoRAs with novel tasks, similar to FLUTE [33]. To train the classifier, we input a batch of adversarial samples, each generated by attacking a different robust LoRA within the pool, to estimate which LoRA generated it. The classifier's mean output on the support set serves as the merging coefficients for a novel task. Additionally, we explored simply averaging LoRA weights or logits, similar to model soups [103]. Appendix E Table 6 compares these alternative strategies using the robust LoRAPool. We see that our AMT, with the introduced intra-class compactness and inter-class divergence criteria, achieves superior overall generalization. In contrast, the linear classifier may not accurately indicate the robustness level of adversarial perturbations based on semantic characteristics. Though logit averaging demonstrates comparable performance, it requires storing all LoRA parameters for extracting query features on each task. Our method merges the LoRAPool into the pre-trained model for adaptation on the support set, maintaining the same amount of parameters for query feature extraction as the baselines [12, 59].

Compatibility with Other Pre-training Methods . We evaluate the effectiveness of our AMT across different pre-training regimes on the Meta-Dataset. Previous state-of-the-art methods [12, 58, 59] employ DINO [1] pre-training on ImageNet, which utilizes the class token for self-distillation learning. We choose iBOT [2] as the representative approach using patch reconstruction as a proxy task for

(a) The Impact of Singular Values and Vectors Perturbation on Accuracy

(b) Changes in Top Singular Values of FFN Across Layers

90

80

76.0679.4

80.93

w/o Singular Value Perturbation

w/ Singular Value Perturbation

w/SingularValuePerturbation

w/oSingularValuePerturbation

Ao

2.0 -

Accuracy(%)

70

09

6

5.568.4

63.925.75

61.763.10

58.0

64

23

96

63

61

628

61.383.22

TopSingularValue

1.5

50

40

9.

9.742.63

1.0

30

20

0.5

10

0

OTD

VGG

0.0

0

4

5

Layer

6

7

8

9

10

11

self-supervised pre-training, DeIT [104] for supervised pre-training with strong regularizations and AdvPre [28] for adversarial pre-training. As shown in Table 7 of Appendix F, AMT achieves average performance improvements of 5.97%, 4.58%, 6.41% and 6.36% over DINO, iBOT, DeIT and AdvPre, respectively, demonstrating its effectiveness across supervised, self-supervised and robust pre-training methods. Intriguingly, we find that AMT significantly enhances the compromised in-domain clean accuracy for the adversarially robust model [28], even outperforming clean pre-trained models.

5.4 Comparison with Other Parameter-Efficient Fine-Tuning Methods

We compare AMT with other parameter-efficient fine-tuning methods in Table 17 of Appendix J. We observe that single Adapter-based and LoRA-based methods achieve comparable performance in adversarial meta-tuning and outperform full-model and FiLM-based meta-tuning. Besides, the superiority of the FiLM/Adapter Pool over the FiLM/Adapter signifies that our adversarial pool design contributes to the OOD performance without compromising in-domain accuracy. Also, our approach, which incorporates additional perturbation in singular values/vectors and non-parametric test-time merging mechanism utilizing the criteria (i.e., Algorithm 2) that adaptively integrates the LoRAPool into pre-trained weights, enjoys significant performance improvement over FiLM/Adapter Pool. Moreover, unlike the FLUTE-style test-time fine-tuning strategy that requires further tuning of pool components, our framework shows better compatibility with different test-time fine-tuning approaches, including LoRA tuning, full fine-tuning [12], and attention scaling [59]. More details are included in Appendix J.

6 Conclusions and Limitations

This paper introduces AMT employing adversarial meta-tuning to augment the robust generalization for pre-trained vision transformers. Upon generated adversarial query images at various robustness levels, we perturb the singular values and vectors to explicitly reinforce the principal components and maintain a robust LoRAPool containing perturbation-specific low-rank updates. The discriminative meta-updated components in the pool are adaptively selected and merged for customizing the model to adapt to novel tasks through a non-parametric test-time merging mechanism. Extensive experiments have demonstrated that AMT with substantial improvements in robust generalization sets new benchmarks in out-of-domain few-shot image classification tasks. Our analysis also contributes to the deeper understanding of adversarial training advancement in the few-shot setting.

Although LoRAPool has demonstrated effectiveness across different datasets and tasks, one limitation is the need for manual setting of the adversarial budget, particularly the size ϵ , for each module. Furthermore, our exploration has been limited to adversarial budgets containing l ∞ bounded perturbations, potentially restricting the ability of our method to model various types of distributional shifts. In our future work, we aim to address these limitations by expanding our exploration to include different types of adversarial perturbations and enhancing the adaptability of our method based on the specific dataset used in meta-tuning.

References

Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 9650-9660, 2021.

Jinghao Zhou, Chen Wei, Huiyu Wang, Wei Shen, Cihang Xie, Alan Yuille, and Tao Kong. ibot: Image bert pre-training with online tokenizer. International Conference on Learning Representations , 2022.

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning , pages 8748-8763, 2021.

Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision. arXiv preprint arXiv:2304.07193 , 2023.

Renrui Zhang, Xiangfei Hu, Bohao Li, Siyuan Huang, Hanqiu Deng, Yu Qiao, Peng Gao, and Hongsheng Li. Prompt, generate, then cache: Cascade of foundation models makes strong few-shot learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15211-15222, 2023.

Kun Song, Huimin Ma, Bochao Zou, Huishuai Zhang, and Weiran Huang. Fd-align: Feature discrimination alignment for fine-tuning pre-trained models in few-shot learning. Advances in Neural Information Processing Systems , 36, 2024.

Renrui Zhang, Rongyao Fang, Wei Zhang, Peng Gao, Kunchang Li, Jifeng Dai, Yu Qiao, and Hongsheng Li. Tip-adapter: Training-free clip-adapter for better vision-language modeling. arXiv preprint arXiv:2111.03930 , 2021.

Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16816-16825, 2022.

Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Learning to prompt for vision-language models. International Journal of Computer Vision (IJCV) , 2022.

Xiangyang Zhu, Renrui Zhang, Bowei He, Aojun Zhou, Dong Wang, Bin Zhao, and Peng Gao. Not all features matter: Enhancing few-shot clip with adaptive prior refinement. arXiv preprint arXiv:2304.01195 , 2023.

Markus Hiller, Rongkai Ma, Mehrtash Harandi, and Tom Drummond. Rethinking generalization in few-shot classification. arXiv preprint arXiv:2206.07267 , 2022.

Shell Xu Hu, Da Li, Jan Stühmer, Minyoung Kim, and Timothy M Hospedales. Pushing the limits of simple pipelines for few-shot learning: External data and fine-tuning make a difference. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9068-9077, 2022.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Micah Goldblum, Liam Fowl, and Tom Goldstein. Adversarially robust few-shot learning: A meta-learning approach. Advances in Neural Information Processing Systems , 33:1788617895, 2020.

Ren Wang, Kaidi Xu, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Chuang Gan, and Meng Wang. On fast adversarial robustness adaptation in model-agnostic meta-learning. arXiv preprint arXiv:2102.10454 , 2021.

Eleni Triantafillou, Tyler Zhu, Vincent Dumoulin, Pascal Lamblin, Utku Evci, Kelvin Xu, Ross Goroshin, Carles Gelada, Kevin Swersky, Pierre-Antoine Manzagol, et al. Meta-dataset: A dataset of datasets for learning to learn from few examples. In International Conference on Learning Representations , 2020.

Luisa Zintgraf, Kyriacos Shiarli, Vitaly Kurin, Katja Hofmann, and Shimon Whiteson. Fast context adaptation via meta-learning. In International Conference on Machine Learning , pages 7693-7702, 2019.

John Cai, Bill Cai, and Shen Sheng Mei. Damsl: Domain agnostic meta score-based learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 2591-2595, 2021.

Till J Bungert, Levin Kobelke, and Paul F Jaeger. Understanding silent failures in medical image classification. In International Conference on Medical Image Computing and ComputerAssisted Intervention , pages 400-410. Springer, 2023.

Andreas Geiger, Philip Lenz, and Raquel Urtasun. Are we ready for autonomous driving? the kitti vision benchmark suite. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 3354-3361, 2012.

Fu Wang, Zeyu Fu, Yanghao Zhang, and Wenjie Ruan. Self-adaptive adversarial training for robust medical segmentation. In International Conference on Medical Image Computing and Computer-Assisted Intervention , pages 725-735. Springer, 2023.

Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1625-1634, 2018.

Qingzhao Zhang, Shengtuo Hu, Jiachen Sun, Qi Alfred Chen, and Z Morley Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15159-15168, 2022.

Behnam Neyshabur, Hanie Sedghi, and Chiyuan Zhang. What is being transferred in transfer learning? Advances in Neural Information Processing Systems , 33:512-523, 2020.

Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685 , 2021.

Fanxu Meng, Zhaohui Wang, and Muhan Zhang. Pissa: Principal singular values and singular vectors adaptation of large language models. arXiv preprint arXiv:2404.02948 , 2024.

Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. Advances in Neural Information Processing Systems , 32, 2019.

Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. Advances in Neural Information Processing Systems , 36, 2024.

Yunhui Guo, Noel C Codella, Leonid Karlinsky, James V Codella, John R Smith, Kate Saenko, Tajana Rosing, and Rogerio Feris. A broader study of cross-domain few-shot learning. In European Conference on Computer Vision , pages 124-141, 2020.

Hung-Yu Tseng, Hsin-Ying Lee, Jia-Bin Huang, and Ming-Hsuan Yang. Cross-domain fewshot classification via learned feature-wise transformation. In International Conference on Learning Representations , 2020.

Nikita Dvornik, Cordelia Schmid, and Julien Mairal. Selecting relevant features from a multi-domain representation for few-shot classification. In European Conference on Computer Vision , pages 769-786, 2020.

Lu Liu, William Hamilton, Guodong Long, Jing Jiang, and Hugo Larochelle. A universal representation transformer layer for few-shot image classification. arXiv preprint arXiv:2006.11702 , 2020.

Eleni Triantafillou, Hugo Larochelle, Richard Zemel, and Vincent Dumoulin. Learning a universal template for few-shot dataset generalization. In International Conference on Machine Learning , pages 10424-10433, 2021.

Wei-Hong Li, Xialei Liu, and Hakan Bilen. Cross-domain few-shot learning with task-specific adapters. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7161-7170, 2022.

Yanbin Liu, Juho Lee, Linchao Zhu, Ling Chen, Humphrey Shi, and Yi Yang. A multimode modulator for multi-domain few-shot classification. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 8453-8462, 2021.

Xu Luo, Jing Xu, and Zenglin Xu. Channel importance matters in few-shot image classification. In International Conference on Machine Learning , pages 14542-14559, 2022.

Chelsea Finn, Pieter Abbeel, and Sergey Levine. Model-agnostic meta-learning for fast adaptation of deep networks. In International Conference on Machine Learning , pages 1126-1135, 2017.

Alex Nichol, Joshua Achiam, and John Schulman. On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999 , 2018.

Aniruddh Raghu, Maithra Raghu, Samy Bengio, and Oriol Vinyals. Rapid learning or feature reuse? towards understanding the effectiveness of maml. arXiv preprint arXiv:1909.09157 , 2019.

Zhenguo Li, Fengwei Zhou, Fei Chen, and Hang Li. Meta-sgd: Learning to learn quickly for few-shot learning. arXiv preprint arXiv:1707.09835 , 2017.

Eunbyung Park and Junier B Oliva. Meta-curvature. Advances in Neural Information Processing Systems , 32, 2019.

Antreas Antoniou, Harrison Edwards, and Amos Storkey. How to train your maml. arXiv preprint arXiv:1810.09502 , 2018.

Oriol Vinyals, Charles Blundell, Timothy Lillicrap, Daan Wierstra, et al. Matching networks for one shot learning. Advances in Neural Information Processing Systems , 29, 2016.

Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical networks for few-shot learning. Advances in Neural Information Processing Systems , 30, 2017.

Boris Oreshkin, Pau Rodríguez López, and Alexandre Lacoste. Tadam: Task dependent adaptive metric for improved few-shot learning. Advances in Neural Information Processing Systems , 31, 2018.

Ruibing Hou, Hong Chang, Bingpeng Ma, Shiguang Shan, and Xilin Chen. Cross attention network for few-shot classification. Advances in Neural Information Processing Systems , 32, 2019.

Carl Doersch, Ankush Gupta, and Andrew Zisserman. Crosstransformers: spatially-aware few-shot transfer. Advances in Neural Information Processing Systems , 33:21981-21993, 2020.

James Requeima, Jonathan Gordon, John Bronskill, Sebastian Nowozin, and Richard E Turner. Fast and flexible multi-task classification using conditional neural adaptive processes. Advances in Neural Information Processing Systems , 32, 2019.

Ethan Perez, Florian Strub, Harm De Vries, Vincent Dumoulin, and Aaron Courville. Film: Visual reasoning with a general conditioning layer. In Proceedings of the AAAI conference on artificial intelligence , 2018.

Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 , 2020.

Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10012-10022, 2021.

Zhengzhong Tu, Hossein Talebi, Han Zhang, Feng Yang, Peyman Milanfar, Alan Bovik, and Yinxiao Li. Maxvit: Multi-axis vision transformer. arXiv preprint arXiv:2204.01697 , 2022.

Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 16000-16009, 2022.

Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. BEit: BERT pre-training of image transformers. In International Conference on Learning Representations , 2022.

Yangji He, Weihan Liang, Dongyang Zhao, Hong-Yu Zhou, Weifeng Ge, Yizhou Yu, and Wenqiang Zhang. Attribute surrogates learning and spectral tokens pooling in transformers for few-shot learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9119-9129, 2022.

Bowen Dong, Pan Zhou, Shuicheng Yan, and Wangmeng Zuo. Self-promoted supervision for few-shot transformer. In European Conference on Computer Vision , pages 329-347, 2022.

Han Lin, Guangxing Han, Jiawei Ma, Shiyuan Huang, Xudong Lin, and Shih-Fu Chang. Supervised masked knowledge distillation for few-shot transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 19649-19659, 2023.

Chengming Xu, Siqian Yang, Yabiao Wang, Zhanxiong Wang, Yanwei Fu, and Xiangyang Xue. Exploring efficient few-shot adaptation for vision transformers. arXiv preprint arXiv:2301.02419 , 2023.

Samyadeep Basu, Shell Hu, Daniela Massiceti, and Soheil Feizi. Strong baselines for parameter-efficient few-shot fine-tuning. In Proceedings of the AAAI Conference on Artificial Intelligence , pages 11024-11031, 2024.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236 , 2016.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning , pages 7472-7482, 2019.

Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations , 2019.

Tianyu Pang, Min Lin, Xiao Yang, Jun Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning , pages 17258-17277, 2022.

Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems , 33:2958-2969, 2020.

Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. Advances in Neural Information Processing Systems , 31, 2018.

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 , 2018.

Aditi Raghunathan, Sang Michael Xie, Fanny Yang, John Duchi, and Percy Liang. Understanding and mitigating the tradeoff between robustness and accuracy. arXiv preprint arXiv:2002.10716 , 2020.

Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 819-828, 2020.

Sylvestre-Alvise Rebuffi, Francesco Croce, and Sven Gowal. Revisiting adapters with adversarial training. arXiv preprint arXiv:2210.04886 , 2022.

Ruiyi Zhang, Rushi Qiang, Sai Ashish Somayajula, and Pengtao Xie. Autolora: Automatically tuning matrix ranks in low-rank adaptation based on meta learning. arXiv preprint arXiv:2403.09113 , 2024.

Sanchari Sen, Balaraman Ravindran, and Anand Raghunathan. Empir: Ensembles of mixed precision deep networks for increased robustness against adversarial attacks. arXiv preprint arXiv:2004.10162 , 2020.

Charles Herrmann, Kyle Sargent, Lu Jiang, Ramin Zabih, Huiwen Chang, Ce Liu, Dilip Krishnan, and Deqing Sun. Pyramid adversarial training improves vit performance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 13419-13429, 2022.

Kaijie Zhu, Xixu Hu, Jindong Wang, Xing Xie, and Ge Yang. Improving generalization of adversarial training via robust critical fine-tuning. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4424-4434, 2023.

Riccardo Volpi, Hongseok Namkoong, Ozan Sener, John C Duchi, Vittorio Murino, and Silvio Savarese. Generalizing to unseen domains via adversarial data augmentation. Advances in Neural Information Processing Systems , 31, 2018.

Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:3533-3545, 2020.

Zhun Deng, Linjun Zhang, Kailas Vodrahalli, Kenji Kawaguchi, and James Y Zou. Adversarial training helps transfer learning via better representations. Advances in Neural Information Processing Systems , 34:25179-25191, 2021.

Mingyang Yi, Lu Hou, Jiacheng Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhiming Ma. Improved ood generalization via adversarial training and pretraing. In International Conference on Machine Learning , pages 11987-11997, 2021.

Shiji Xin, Yifei Wang, Jingtong Su, and Yisen Wang. On the connection between invariant learning and adversarial training for out-of-distribution generalization. In Proceedings of the AAAI Conference on Artificial Intelligence , pages 10519-10527, 2023.

Qixun Wang, Yifei Wang, Hong Zhu, and Yisen Wang. Improving out-of-distribution generalization by adversarial training with structured priors. Advances in Neural Information Processing Systems , 35:27140-27152, 2022.

Chengxiang Yin, Jian Tang, Zhiyuan Xu, and Yanzhi Wang. Adversarial meta-learning. arXiv preprint arXiv:1806.03316 , 2018.

Junhao Dong, Yuan Wang, Jian-Huang Lai, and Xiaohua Xie. Improving adversarially robust few-shot image classification with generalizable representations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 9025-9034, 2022.

Haoqing Wang and Zhi-Hong Deng. Cross-domain few-shot classification via adversarial task augmentation. arXiv preprint , 2021.

Yanxu Hu and Andy J Ma. Adversarial feature augmentation for cross-domain few-shot classification. In European Conference on Computer Vision , 2022.

Yuqian Fu, Yu Xie, Yanwei Fu, and Yu-Gang Jiang. Styleadv: Meta style adversarial training for cross-domain few-shot learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 24575-24584, 2023.

Xun Huang and Serge Belongie. Arbitrary style transfer in real-time with adaptive instance normalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 1501-1510, 2017.

Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) , pages 4582-4597, 2021.

Menglin Jia, Luming Tang, Bor-Chun Chen, Claire Cardie, Serge Belongie, Bharath Hariharan, and Ser-Nam Lim. Visual prompt tuning. In European Conference on Computer Vision , pages 709-727, 2022.

Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for nlp. In International Conference on Machine Learning , pages 2790-2799, 2019.

Shoufa Chen, Chongjian Ge, Zhan Tong, Jiangliu Wang, Yibing Song, Jue Wang, and Ping Luo. Adaptformer: Adapting vision transformers for scalable visual recognition. Advances in Neural Information Processing Systems , 35:16664-16678, 2022.

Junxian He, Chunting Zhou, Xuezhe Ma, Taylor Berg-Kirkpatrick, and Graham Neubig. Towards a unified view of parameter-efficient transfer learning. In International Conference on Learning Representations , 2022.

Mojtaba Valipour, Mehdi Rezagholizadeh, Ivan Kobyzev, and Ali Ghodsi. Dylora: Parameter efficient tuning of pre-trained models using dynamic search-free low-rank adaptation. arXiv preprint arXiv:2210.07558 , 2022.

Qingru Zhang, Minshuo Chen, Alexander Bukharin, Pengcheng He, Yu Cheng, Weizhu Chen, and Tuo Zhao. Adaptive budget allocation for parameter-efficient fine-tuning. In International Conference on Learning Representations , 2023.

Haokun Liu, Derek Tam, Mohammed Muqeeth, Jay Mohta, Tenghao Huang, Mohit Bansal, and Colin A Raffel. Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning. Advances in Neural Information Processing Systems , 35:1950-1965, 2022.

Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412 , 2020.

J Andrew Bagnell. Robust supervised learning. In Proceedings of the AAAI Conference on Artificial Intelligence , pages 714-719, 2005.

Weihua Hu, Gang Niu, Issei Sato, and Masashi Sugiyama. Does distributionally robust supervised learning give robust classifiers? In International Conference on Machine Learning , pages 2029-2037, 2018.

Prateek Yadav, Derek Tam, Leshem Choshen, Colin A Raffel, and Mohit Bansal. Ties-merging: Resolving interference when merging models. Advances in Neural Information Processing Systems , 36, 2024.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International Conference on Machine Learning , pages 2206-2216, 2020.

Zhenlin Xu, Deyi Liu, Junlin Yang, Colin Raffel, and Marc Niethammer. Robust and generalizable visual representation learning via random convolutions. International Conference on Learning Representations , 2021.

Tejas Gokhale, Rushil Anirudh, Jayaraman J Thiagarajan, Bhavya Kailkhura, Chitta Baral, and Yezhou Yang. Improving diversity with adversarially learned transformations for domain generalization. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2023.

Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael GontijoLopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International Conference on Machine Learning , pages 23965-23998, 2022.

Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International Conference on Machine Learning , pages 10347-10357, 2021.

Jaehoon Oh, Sungnyun Kim, Namgyu Ho, Jin-Hwa Kim, Hwanjun Song, and Se-Young Yun. Understanding cross-domain few-shot learning: An experimental study. arXiv preprint arXiv:2202.01339 , 2022.

Panagiotis Eustratiadis, Łukasz Dudziak, Da Li, and Timothy Hospedales. Neural fine-tuning search for few-shot learning. arXiv preprint arXiv:2306.09295 , 2023.

Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261 , 2019.

Mixture of Adversarial LoRAs: Boosting Robust Generalization in Meta-tuning

-Supplementary Material-

A Algorithm of Test-time merging

The complete algorithm of our test-time merging mechanism is presented in Algorithm 2.

Algorithm 2 Test-Time Merging

̸

B Setup for Cross-Domain Few-Shot Evaluation

B.1 Datasets Used for Benchmarks

Meta-Dataset [16] is a more challenging and realistic large-scale benchmark consisting of ten image datasets including ImageNet, Omniglot, Aircraft, CUB, DTD, QuickDraw, Fungi, VGG Flower, Traffic Signs, and MSCOCO, each with specified training, validation and test splits. In this paper, we utilize the ImageNet training split as the single source domain for meta-training while employing the test splits of all datasets for meta-testing. We refer to [16] for an in-depth exploration of Meta-Dataset.

BSCD-FSL [29] consists of four datasets from different domains: CropDisease, EuroSAT, ISIC, and ChestX, covering plant disease images, satellite pictures, human skin lesions, and X-Ray images. We follow [29] for the dataset split.

Fine-Grained Datasets [30] includes four additional commonly used datasets in CD-FSL: CUB, Car, Plantae, and Places, which contain birds, cars, plant and scene images and fine-grained classes. We follow the splitting procedure of previous methods [30, 86]. We refer to [30, 105] for a more detailed description of each dataset.

B.2 Implementation Details

We follow the pipeline delineated by PMF [12] and use the same DINO pre-training checkpoint [1] for our AMT and all baselines in main experiments. We perform adversarial meta-tuning on the ImageNet training split following the Meta-Dataset protocal [16]. The SGD optimizer with a momentum of 0 . 9 and a cosine-decayed learning rate η 2 starting at 5 × 10 -4 are adopted. Training is conducted for a maximum of 30 epochs, with a 5 -epoch warming-up stage. The loss trade-off coefficient λ adv is set to 6 . The input image size is 128 × 128 as per PMF [12]. The pre-trained model is kept frozen while each LoRA is meta-updated to construct the robust LoRAPool. We use a pool of size P = 4 and a LoRA rank of r = 8 , choosing the top 2 from the pool for merging at test time. Following the state-of-the-art method PMF [12], we sample five tasks from each domain as the validation set for hyperparameter selection. The adversarial query set is generated using untargeted weak and

,

strong patch perturbations [74] with l ∞ -bounded budgets ϵ ∈ { 0 . 01 / 255 , 0 . 1 / 255 , 6 / 255 , 8 / 255 } in 2 steps, and a step size of α ∈ { ϵ 2 , ϵ 10 } . The size of the neighborhood η 1 is set to 1 e -4 for adversarial perturbation on singular values and vectors. We search domain-wise hyperparameters on the validation set, including λ in the range of [0 , 1] , β in the range of [1 , 12] , and ρ in the range of [0 , 1] . The experiments were conducted on one NVIDIA A6000 GPU.

B.3 Evaluation Metric

Clean Few-shot Classification Accuracy . We compute the average accuracy on the query set across 600 randomly sampled few-shot classification tasks from the test set of each dataset on three benchmarks.

Adversarial Few-shot Classification Accuracy . To evaluate adversarial robustness, we calculate the adversarial accuracy of the query set over 600 few-shot classification tasks. For each task, we generate adversarial examples by employing the PGD-10 attack with l ∞ -bounded budgets ϵ = 4 . 5 / 255 and a step size α = ϵ 10 on clean images.

C Mathimatical Symbols

D More Analysis on Changes in Singular Values

Figure 3 shows the change in top singular values of the projection weight matrix across multi-head self-attention layers. It can be observed that our adversarial double-perturbation strategy can help the model learn to strengthen its principal components to defend against the strongest attacks during meta-tuning and thus improve generalization and robustness.

0

1

2

3

4

5

6

7

8

9

10

11

Layer

0.0

0.2

0.4

0.6

0.8

1.0

1.2

1.4

Top Singular Value

Multi-Head Self-Attention

w/o Singular Value Perturbation

w/ Singular Value Perturbation

E Results of Alternative Test-time Merging Strategies

We compare alternative test-time merging strategies using the robust LoRAPool in Table 6. We find that our method outperforms other alternative approaches.

F Results With Other Pre-traing Methods

We evaluate the effectiveness of our AMT for other pre-training regimes on Meta-Dataset in Table 7. The results show that AMT achieves consistent performance improvements for various supervised, self-supervised and robust pre-training methods.

G More Ablation Studies of AMT

Our AMT equips a pre-trained model with a pool of adversarially meta-tuned LoRAs at varying levels of adversarial perturbation to boost the robust generalization of pre-trained models in out-of-domain

few-shot learning. Thus, we perform more ablation studies on LoRAPool design and adversarial singular value and vector perturbations.

Different designs of robust LoRAPool . We first adopt the uniform strategy to use the average attack strength ( ϵ = 3 . 5 ) of AMT's candidate configurations. Also, we develop a variant, coined random strategy, to randomly sample one attack budget ϵ for each training task from the same attack pool of candidate configurations. For a fair comparison with AMT, we meta-tune 4 LoRAs with different seeds for both the uniform and random strategies. The results are given in Table 8. We notice that the proposed robust LoRAPool with perturbation-specific parameters effectively avoids interference between different attacks and significantly enhances the out-of-domain generalization without in-domain compromise.

Different perturbation strategies . Unlike SAM [96], which employs clean examples and perturbs the weight matrices, our method applies adversarial perturbation in the spectral space, specifically targeting singular values and vectors. The results, reported in Table 9, show that AMT outperforms SAM by an average of 1.56%, substantiating the effectiveness of our adversarial perturbation strategy. We additionally compare AMT initialization against the original LoRA initialization, for which we introduce adversarial perturbations in the weight space. The superior performance, as shown in Table 10, further validates that the efficacy of our adversarial singular value and vector perturbations in boosting the model's generalization capability.

(a) Clean Few-shot Accuracy

(b) Adversarial Few-shot Accuracy

H Hyper-parameter Studies of AMT

The robust LoRAPool in AMT provides the flexibility to adjust the trade-offs between adversarial robustness and clean accuracy by modifying the pool components. In Table 11, we conduct additional experiments to highlight this benefit, using different values of λ adv . The results reveal that λ adv can be used to tune LoRAPool's preference towards either clean or adversarial environments.

To analyze the impact of key hyper-parameters, we conduct experiments with various hyper-parameter values, yielding several noteworthy observations. The results in Table 12 and 13 suggest that our model is relatively insensitive to the rank of LoRA and the number of attack steps. Also, the results in Table 15 justify our choice of top-2. Furthermore, as shown in Table 14, varying the pool size P and the mean and variance statistics of perturbation budget candidates ϵ demonstrates that a sufficiently diverse but large pool improves performance.

I Comparison with Other Data Augmentation Techniques

Our AMT constructs the robust LoRAPool with adaptive test-time merging to boost the robust generalization of pre-trained vision transformers in out-of-domain few-shot learning. In this context,

we use adversarial attacks, characterized by the size of the perturbation budget, to mimic different distributional shifts and meta-tune diverse LoRAs. The experiments in the main paper demonstrate the effectiveness of using adversarial training. In this section, we compare AMT with other data augmentation methods using a single LoRA ( P = 1 ) for meta-tuning. Specifically, for ALT [102], we employ a learnable adversarial transformation network consisting of 5 convolutional layers with a kernel size of 3 and LeakyReLU activation. The adversarial learning rate was set to 5 × 10 -5 , with 10 adversarial steps. For the method leveraging an attack candidate pool, we randomly select the attack budget from candidates for each training task, with ϵ values of 8/255, 6/255, 0.1/255, 0.01/255 for AMT, and step number of 1, 3, 5, 10 for ALT. As shown in Table 16, static data augmentation [101] cannot effectively simulate the large domain shifts required for robust generalization across diverse datasets (e.g., Omniglot). Compared to ALT, our AMT, utilizing only 2 steps of standard pixel-level adversarial attacks, achieves comparable or superior improvements in generalization for pre-trained vision transformers on OOD tasks.

J Comparison with Other Parameter-Efficient Fine-Tuning Methods

In this section, we compare AMT with other parameter-efficient fine-tuning methods. For FiLM [49], we implement it after LN layers since there are no BN layers in ViT. We also compare Adapter [91], using the default bottleneck size of 64. The attack budget ϵ is randomly sampled from the same candidate pool as AMT for each training task. As shown in Table 17, single Adapter-based and LoRA-based methods achieve comparable performance in adversarial meta-tuning and outperform full and FiLM-based meta-tuning. Regarding the FiLM pool [49] and Adapter pool [91], we conduct additional experiments by setting the pool size to 4 and adopting the same attack pool strategy used in AMTduring adversarial meta-tuning. To estimate the combination coefficients, we follow the method outlined in FLUTE [32]. Specifically, a classifier is trained in a separate stage to predict which FiLM or Adapter the input belongs to, taking as input a batch of adversarial examples generated by attacking different FiLMs or Adapters in the pool. Results show that: 1) The superiority of the FiLM/Adapter Pool over FiLM/Adapter signifies that our adversarial pool design contributes to the out-of-distribution performance without compromising in-domain accuracy. 2) Our approach, which incorporates additional perturbation in singular values/vectors and non-parametric test-time merging mechanism utilizing the criteria (i.e., Algorithm 2) that adaptively integrates the LoRAPool into pre-trained weights, enjoys significant performance improvement over FiLM/Adapter Pool. 3) Unlike the FLUTE-style test-time fine-tuning strategy that requires further tuning of pool components (either a FiLM or an adapter), our framework shows better compatibility with different test-time fine-tuning approaches, including LoRA tuning, full fine-tuning [12], and attention scaling [59].

K Comparison with the SOTAs in Other Settings on Meta-Dataset

In this section, we demonstrate the effectiveness of the proposed AMT under the variable-wayvariable-shot setting on Meta-Dataset [16]. Table 18 presents the results of in-domain and out-ofdomain few-shot classification. AMT achieves state-of-the-art overall performance in both tuning-free and test-time fine-tuning settings. Notably, it obtains 17.94% accuracy gain (56.91 → 74.85) on Omniglot tasks, which exhibit a large domain gap from the training distribution. Furthermore, with a better starting point for the test-time fine-tuning, our method shows it is promising that a plain fine-tuning approach can achieve competitive performance, even when compared to complex neural architecture search (NAS) methods, such as NFTS [106].

L Few-shot Robustness against Natural Corruptions Under Distribution Shifts

We take a step further and investigate few-shot robustness against various types of natural visual corruptions on out-of-domain datasets, reflecting real-world conditions. We adapt ImageNet-C's methodology [107] to the Meta-Dataset benchmark by applying each category of corruption to 10 datasets. To be specific, we evaluate robustness against 15 common distortions across 4 categories (noise, blur, weather, and digital-based corruptions) with 5 severity levels. Figure 4 shows that our method AMT consistently outperforms previous counterparts across various common corruptions, demonstrating superior robustness. The ability of AMT to handle natural corruptions underscores its potential in practical applications, particularly in environments where robustness to visual corruption is critical, such as autonomous driving and medical image analysis.

Impulse Noise

30

35

40

45

50

55

60

Accuracy (%)

Noise

Defocus Blur Glass Blur Motion Blur Zoom Blur

30

35

40

45

50

55

60

Accuracy (%)

Blur

Snow

Frost

Fog

Brightness

30

40

50

60

70

Accuracy (%)

Weather

Contrast

Elastic Transf.

Pixelate

JPEG

30

35

40

45

50

55

60

Accuracy (%)

Digital

PM

StyleAdv

AMT

PMF

AMT-FT

M More Adversarial Robustness Evaluations Under Distribution Shifts

To show the effectiveness of our method for boosting adversarial robustness generalization, we conduct more robustness evaluations against unseen threat models and the stronger AutoAttack [100].

M.1 Adversarial Robustness against AutoAttack

To measure adversarial robustness against AutoAttack [100] under distribution shifts, we ground our method and the baseline on the adversarially pre-trained ViT-Small [28]. The APGD with crossentropy and targeted DLR loss, FAB-attack and the Square Attack are used to generate adversarial examples on 100 sampled 5 -way 1 -shot tasks for each dataset. We adopt ℓ ∞ -bounded perturbations with a radius of ϵ ∞ = 4 / 255 . The results, shown in Table 19, indicate that our method AMT consistently boosts adversarial generalization across domains, even under the stronger AutoAttack, improving both in-domain and out-of-domain robust accuracy.

M.2 Adversarial Robustness against Unseen Attacks

The robust LoRAPool is constructed by adversarial meta-tuning with ℓ ∞ -bounded perturbations on the source domain ImageNet. To evaluate the adversarial generalization against unseen attacks under distribution shifts, we use the same meta-tuned LoRAPool and employ PGD-10 attacks constrained by both ℓ ∞ and ℓ 2 norms with varying perturbation budgets ϵ . Specifically, we sample 600 5 -way 1 -shot tasks for each dataset and generate adversarial examples using 10 steps of PGD with the step size ϵ/ 10 for ℓ ∞ and ϵ/ 8 . 5 for ℓ 2 attacks, respectively. The results, shown in Table 20, demonstrate that our method, AMT, significantly enhances adversarial robustness against unseen attacks under

various domains for pre-trained vision transformers. Also, compared with the previous style-based adversarial few-shoe learning method, StyleAdv [86], our AMT achieves an ℓ ∞ and ℓ 2 -robustness improvement of 14.76% and 13.36% in average without compromising in-domain performance.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We evaluate the effectiveness of our method on three benchmarks.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: See the Section 6 for details.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification:

[TODO]

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We elaborate our implementation details and evaluation metrics in Ap- pendix B.2.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We use public datasets, and we provide the dataset details in Appendix B.1. We have released the code.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not

including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We include the training details and evaluation metrics in Appendix B.2.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: The variance of experimental results is smaller than the gap between different methods.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We include details in Appendix B.2. Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We conform with the NeurIPS Code of Ethics. Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [NA]

Justification: There is no societal impact of the work performed.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We cite the original paper for datasets used and include dataset details in Appendix B.1.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
The paper introduces Adversarial Meta-Tuning (AMT) to enhance the robust generalization of pre-trained models for out-of-domain few-shot learning by constructing a robust LoRAPool through meta-tuning Low-rank Adapters (LoRAs). The approach significantly outperforms previous methods in both clean and adversarial generalization across various benchmarks.

STRENGTHS:
- this study is novel and significant. 

-  the proposed method AMT achieves superior performance.

- The writing and presentation are good and easy to follow.

WEAKNESSES:
- Lack of evaluation on unseen adversarial attacks. The authors claimed that they boosted the adversarial generalization. Test the generalization of robustness on unseen attacks would be necessary.

- Evaluation of adversarial robustness based on PGD-10 is insufficient. [2] points out that the PGD-10 attack is a weak attack and may suffer from a 'gradient mask' problem. It is necessary to present robustness based on AA attack[1].

[1] Croce, Francesco, and Matthias Hein. "Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks." International conference on machine learning. PMLR, 2020.

[2] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

QUESTIONS:
- Could you show whether the robustness achieved by AMT can be generalized to unseen attacks?

-Could you show the robustness under AA attack?

- How does the performance change with varying the rank R in each Lora adaptor? and with varying the number of Lora adaptors?

LIMITATIONS:
The authors adequately addressed the limitations.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-10

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes to tackle the problem of improving the generalization of pre-trained models to data drawn from a different distribution than the training data. To achieve this, the authors propose using meta-learning to train the models. Since they consider a single source domain, they adversarially generate query samples while the support samples directly come from the source domain data. The inner gradient is computed on the source, while the meta-gradients are computed on adversarial examples.\n\nThey ground their approach by citing references that suggest an adversarially robust model also generalizes better on OOD data. Unlike conventional meta-learning approaches, which update the entire model parameters, the authors propose updating models through multiple LoRA steps, similar to FLUTE, which only updates the batch norm parameters. Each LoRA is computed using a query set of adversarial examples generated through a fixed attack budget. At test time, they identify the right combination of LoRAs based on simple cosine similarity measures between features of prototypes for each class (computed during training) and the OOD sample and its corresponding labels. They propose to look at intra-class similarity and inter-class diversity to this end.\n\nFurthermore, instead of perturbing only the images, they also perturb the singular values/vectors of the model weights (gradients) to strengthen the principal components (based on the observation that singular vectors undergo significant change during training). They evaluated their method on multiple datasets and demonstrated good performance gains compared to other methods such as StyleAdv, which alters the style of query samples using AdaIn instead of adversarial attacks.\n\nThey also conducted ablation studies and demonstrated the benefits of various design choices.\n\nSTRENGTHS:\nThe paper is very well motivated, and the authors ground their approach appropriately, citing a large collection of work. Each piece is well-motivated and clearly written. Perturbing singular vectors when performing LoRA is a novel idea, and the results indicate the benefits of this approach.\n\nWEAKNESSES:\nA primary weakness of the approach is its lack of comparison to another popular method for fine-tuning adaptation of foundation models—adapters. Adapters introduce new learnable parameters in each transformer block and update only them using the new data while freezing everything else. Some references include [MiMi](https://openaccess.thecvf.com/content/WACV2024/papers/Marouf_Mini_but_Mighty_Finetuning_ViTs_With_Mini_Adapters_WACV_2024_paper.pdf) and [AdaptFormer](https://openaccess.thecvf.com/content/WACV2024/papers/Marouf_Mini_but_Mighty_Finetuning_ViTs_With_Mini_Adapters_WACV_2024_paper.pdf). There are many more references within these papers and in the [scholar link](https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=ViT+adapter&btnG=). The current paper does not consider this PEFT technique at all. It would be beneficial to see a comparison or discussion section with adapters. Importantly, adapters are closely related to the approach in FLUTE too and instead of a LoRA pool, one could have an adapter pool.\n\nSecondly, the adversarial attack for images is the standard attack model. If all that is needed is better and harder augmentations, papers like [Improving Diversity with Adversarially Learned Transformations for Domain Generalization](https://arxiv.org/abs/2206.07736) offer a better alternative and they also work with a single source domain. Other options to consider include augmentation techniques such as PixMix and Rand Conv, where the tradeoff between ID and OOD accuracies is well established, and they don’t require additional steps such as adversarial attacks.\n\nAdditionally, as an improvement, from the OOD detection literature this paper could use virtual outlier synthesis (VOS). VOS uses a per-class GMM in the latent space to synthesize feature space outliers. These outliers can then be used in training instead of relying solely on adversarial attacks.\n\nQUESTIONS:\nPlease see weaknesses section\n\nLIMITATIONS:\nProvided limitations are appropriate.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper deals with how to effective adapt a pretrained model to cross-domain few-shot learning task. It focus on both adversarial robustness and clean accuracy of trained model. To realize the goal, it utilizes adversarially trained LoRA to adapt the pretrained model. Specifically,  it utilizes SAM to determine the worst-case perturbations to update the matrices A and B of LoRA which are initialized to approximate the modification of principle singular value and vectors of original weight matrix in pretrained model. Further, it designs LoRAPool. LoRAPool consists a series of LoRA modules, each corresponding to a different robustness level controlled by the size of the adversarial budget. Based on that, the authors design a test-time merging strategy to adaptively combine all the LoRAs for optimizing test-time task performance. Extensive experiments verify the effectiveness of proposed method.\n\nSTRENGTHS:\n- This paper is generally easy to follow and understand.\n\n- The idea is reasonable.\n\n- The experiment results is good.\n\nWEAKNESSES:\n- It is unclear that what key factors make the proposed framework outperforms previous works. From technical level, the operations or strategies used in the paper is not that new, e.g., using LoRA to finetune the pretrained model, using SAM to improve the generalization ability of the model, test-time ensemble, etc. I just wonder what makes the proposed framework most distinct from previous works.The authors should more clearly discuss this to give the readers some insights. \n\n- Some technical details are not clear. For example, in Eq. (7), what does the top_k means? Or to say, what is the operation detail of top_k?\nIn experiment part, the authors compare their method with previous works under two settings, i.e., tuning-free setting and test-time fine-tuning setting. What are the difference between those two settings? In Line 259-260, what is the exact form of the variant which removes the adversarial perturbations on singular values and vectors? Does it mean not using SAM to update A and B of LoRA? \n\n- The authors compare the adversarial robustness and the clean accuracy separately in two tables. I just wonder if those two numbers are achieved simultaneously by the same model, or they are evaluated with two model where one tends to be robust and the other one tends to be more accurate (it can be so by employing different $\\lambda_{adv}$). I would like to see how the proposed method balances those two evaluations. \n\n- Missing key ablations. The authors design a special initialization to make the update of A and B approximately represents the modifications of singular values and vectors of original weight matrix. I just wonder how the performance is if we don't employ such an initialization, i.e., we just simply add LoRA to the pretrained model which is initialized as zero matrix. I would like to see the comparison between plain LoRA initialization and the proposed initialization. Otherwise, the effectiveness of proposed initialization cannot be proved. \n\n- Lack hyper-parameter study.\n\nQUESTIONS:\nSee the weakness part.\n\nLIMITATIONS:\nThe authors adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a method for training loras for vision transformer models such that the model easily adapts to an unseen few shot classification task. The goal is to have these loras robust to adversarial noise.\n\nSTRENGTHS:\nThe experiments seem comprehensive and show impressive performance. The idea of perturbing eigenvectors of weights instead of weights seems interesting to me. Further, the idea of training and merging multiple loras that are robust to different levels of adversarial noise is interesting.\n\nWEAKNESSES:\n- What are the instances in medical and self-driving domain \"where encountering novel and adversarial environments is common\" (line 26)? \n- The writing can be improved a lot.\na. I struggling to understand how the start of the second sentence of the introduction (line 15) is connected to the previous sentence.\nb. Same with the starting two sentences of the next paragraph (line 21). I don't see why \"However\" is necessary on line 23.\nc. Third, fourth, and fifth sentences of the third paragraph (lines 29, 31, and 33) are not connected at all.\nd. What is \"double strongest perturbation\"? (line 45)\ne. This is a prime example of a sentence that needs to be simplified: \"To robustify the learned meta-knowledge, adversarial meta-tuning adopts the worst-case optimization by injecting the adversarial perturbation δ to the input x through the minimax strategy\" (lines 130-132) I consider myself a decently well educated researcher and the sentence doesn't tell me anything.\n\nThe paper seemed promising to me, but I had to parse out a lot of stuff to get to the interesting part. Hence, I couldn't spend time properly understanding the method and results. For now, I am keeping accept as the result seem promising.\n\nQUESTIONS:\nSee above.\n\nLIMITATIONS:\nThe limitations section in the paper seems adequate.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-07-15"}