A S IMPLE A PPROACH TO A DVERSARIAL R OBUSTNESS IN F EW - SHOT I MAGE C LASSIFICATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Few-shot image classiﬁcation, where the goal is to generalize to tasks with limited labeled data, has seen great progress over the years.
However, the classiﬁers are vulnerable to adversarial examples, posing a question regarding their generalization capabilities.
Recent works have tried to combine meta-learning approaches with adversarial training to improve the robustness of few-shot classiﬁers.
We show that a simple transfer-learning based approach can be used to train adversarially robust few-shot classiﬁers.
We also present a method for novel classiﬁcation task based on calibrating the centroid of the few-shot category towards the base classes.
We show that standard adversarial training on base categories along with centroid-based classiﬁer in the novel categories, outperforms or is on-par with state-of-the-art advanced methods on standard benchmarks such as Mini-ImageNet, CIFAR-FS and CUB datasets.
Our method is simple and easy to scale, and with little effort can lead to robust few-shot classiﬁers.
I NTRODUCTION
Few-shot learning presents the challenge of generalizing to unseen tasks with limited data.
The problem is aimed at learning quickly from few examples of data, which is generally considered the hallmark of human intelligence.
This is an important practical problem due to the scarce availability of fully annotated data in the real world.
Researchers have shown that such a setting can be considered for various real world computer vision tasks such as image classiﬁcation (Finn et al., 2017; Chen et al., 2019), object detection (Wang et al., 2020), image segmentation (Rakelly et al., 2018), facerecognition (Guo et al., 2020) and medical analysis (Maicas et al., 2018).
As a result, it is of paramount importance that such safety-critical systems are reliable and robust to changes in input.
Speciﬁcally in this work, we consider robustness to adversarial examples - carefully crafted perturbations using gradients that when added to inputs, fool the classiﬁer.
The most common method of improving robustness is by adversarial training (Goodfellow et al., 2015) which involves training on adversarial examples using adversary of choice.
Traditional adversarially robust methods (Madry et al., 2018;
Goodfellow et al., 2015; Szegedy et al., 2013) consider a data-rich setting where many examples are available per category.
It has also been shown that adversarial generalization possibly requires signiﬁcantly more data (Schmidt et al., 2018).
This becomes challenging in a scenario where the end-user has access to limited amount of annotated data but is interested in building a robust few-shot classiﬁer.
Such a setting is more practical and it is important to develop methods which can work with minimal effort in the pre-deployment stage.
We show from our experiments that a simple approach of ﬁnetuning the network on clean data from an adversarially robust base model can lead to signiﬁcant improvement in robustness with minimal resources.
Previous works on improving robustness for few-shot classiﬁers focus mainly on meta-learning approaches.
Here the base model is trained on adversarial examples of episodic data.
We show that standard adversarial training on a large dataset is sufﬁcient for learning a robust classiﬁer.
This makes our method simple and scalable, making the process of training robust classiﬁers straightforward and also creating directions to explore methods from robustness literature for few-shot setting.
It is important to understand the problem of few-shot learning in order to develop their robust counterparts.
The goal in few-shot learning is to learn transferable knowledge for generalization to tasks with limited data.
These have generally been partitioned into metric learning (Snell et al., 2017;
Vinyals et al., 2016; Sung et al., 2018), optimization-based (Finn et al., 2017; Ravi & Larochelle,
and hallucination based methods (Hariharan & Girshick, 2017; Yang et al., 2021; Antoniou et al., 2017; Wang et al., 2018).
The most common work among optimization based methods is
MAML (Finn et al., 2017) which aims at learning a network initialization using a bi-level optimization procedure, that when ﬁnetuned on limited data is able to generalize to the new task.
Recent works have shown that meta-learning methods can be extended to include adversarial robustness as well.
(Goldblum et al., 2019; Wang et al., 2021) perform adversarial training on top of meta-learners to improve robustness signiﬁcantly.
However, adversarial training on its own is expensive and combining with meta-learning makes the problem computationally intensive.
(Wang et al., 2021) showed that there exists a compromise between training robust meta-learners and performance, both in terms of standard and robust accuracy, motivating the need for a simpler approach.
Another interesting line of work, focused on improving few-shot learning, shows that a simple method which involves training on large scale data and ﬁnetuning the model on the few-shot dataset can match or even outperform meta-learning methods (Chen et al., 2019; Dhillon et al., 2019).
The intuition is that the model sees examples from all categories and can get a general sense of semantics rather than seeing only episodic data.
Such a setting also makes it easier to train on large scale data that can lead to further improvements as shown in (Dhillon et al., 2019).
Our results show considering a simple setting can be beneﬁcial for adversarial robustness as well.
We consider the few-shot setting and show that adversarial training along with simple nearest centroid based classiﬁer can outperform previous methods in terms of robustness.
Such a setting is practically relevant, since the adversarial training on large data needs to be done just once and robustness for few-shot classes can be achieved without creating adversarial examples for the speciﬁc task.
We believe it also becomes easier to incorporate new approaches to robustness, such as veriﬁably robust classiﬁers (Gowal et al., 2018; Cohen et al., 2019) and can bring together robust methods for both large and limited dataset settings.
In the following sections, we describe our method and discuss relevant related work.
We present experimental ﬁndings and implementation details in the subsequent sections followed by conclusion and directions for future work.
M ETHOD
Here we introduce notation and provide a description of our method.
Our ﬁrst objective is to learn a feature extractor
f θ b and linear classiﬁer C ω b using the abundantly-labeled base dataset X b .
At the next stage, when a N -way K -shot few-shot task is sampled from the novel dataset X n , we use only the feature extractor f θ b and learn a new linear classiﬁer C ω n such that it can generalize to unseen examples from the novel categories.
We show that a simple approach of training a robust base model and then adapting it to novel categories can outperform previous approaches.
We divide our approach into two stages: (1) Robust Base training and (2) Novel training.
2. R OBUST B ASE T RAINING
Given a base dataset X b with large number of annotated examples per category, we perform adversarial training using an iterative adversary such as PGD (Madry et al., 2018).
Speciﬁcally, we solve the min-max objective
[Equation] [Equation]
Here, L ( θ, x, y ) represents the training objective, which is commonly cross-entropy and θ = ( θ b , ω b ) represents the combination of the feature extractor and base classiﬁer parameters.
There are different methods for optimizing the inner maximization in Equation 1.
For all our experiments we use the
Projected Gradient Descent (PGD) algorithm, an iterative algorithm presented in (Madry et al., 2018) with p = ∞ which corresponds to ﬁnding a perturbation δ around an (cid:15) -bounded hypercube around x that maximizes the objective.
Once we ﬁnd the perturbation, the perturbed input is added to the training set and parameters are tuned.
This method is called adversarial training and is the most widely used method to improve robustness to adversarial examples.
Note that adversarial training, which is a computationally expensive procedure, needs to be performed just once using base dataset.
In the next stage, we use only clean examples which makes it practical and easy to train robust few-shot classiﬁers for novel tasks.
Weight averaging: Weight averaging (WA) has been shown as a simple way to improve generalization (Izmailov et al., 2018;
Garipov et al., 2018) in deep networks as it approximates ensembling in temporal fashion and can ﬁnd ﬂatter optima in loss surface.
This method has been used in adversarial training (Gowal et al., 2020; Chen et al.) for improving robustness in standard classiﬁcation task.
Since we are interested in using base parameters at the next stage, we perform weight averaging for only the feature extractor parameters θ b and show this can be used for few-shot setting.
Similar to (Gowal et al., 2020), we keep a separate copy of the weights and for every iteration perform exponential moving average method θ b (cid:48) ← τθ b (cid:48)
+ (1 − τ ) ∗ θ b and use θ b (cid:48) during the evaluation.
We set τ = 0 .
999 in all our experiments.
2. N OVEL T RAINING
During this stage, we consider the N -way, K -shot method as the novel task and adapt our learnt feature extractor
f θ b using classiﬁer C ω n .
For all our experiments, we found best results when the weights of feature extractor f θ b are frozen and not optimized during novel training.
Intuitively, this can be understood not wanting the parameters of the feature extractor to be biased towards the fewshot examples.
And since we are interested in learning only from clean data during the novel training, there can also be an effect of forgetting the robustness learnt at the base stage.
This was observed in (Goldblum et al., 2019) where only the ﬁnal layer was trained and rest of the parameters were frozen.
During the novel training stage, we use only clean examples and not adversarial examples, making the process straightforward.
Linear classiﬁer: The simplest possible baseline is to learn a linear model on top of the frozen feature extractor using the few shot examples of novel categories.
As shown in our experiments, this simple baseline on its own achieves reasonable performance compared to previous approaches.
This baseline also suggests that a robust base classiﬁer corresponds to a robust novel classiﬁer and a simple approach such as ours is enough to achieve robustness for few-shot classiﬁers.
However, as observed in previous works (Wang et al., 2021; Goldblum et al., 2019) and in our experiments, this approach alone is not sufﬁcient to achieve improved robustness.
Interestingly, we achieve much closer results to state of the art compared to previous works using this simple baseline.
One challenge associated with using few-shot data is that the model can become biased towards the speciﬁc samples and may not capture the true class distribution.
Hence there is a need for more calibrated classiﬁers.
Background on Distribution Calibation (DC)
(Yang et al., 2021):
Recent work (Yang et al., 2021) has shown that standard accuracy of few-shot classiﬁers can be improved by using Distribution
Calibration.
They present a free-lunch hallucination-based method where the feature distributions of the novel categories are calibrated using the base dataset, due to the similarity between the base and novel datasets.
The mean and covariance of each novel category is calibrated using the statistic of base data.
They use these statistics to hallucinate or sample many points from a Gaussian distribution, and learn a logistic regression classiﬁer.
This simple method was shown to improve standard accuracy signiﬁcantly under various settings.
Mean Calibration and Nearest Centroid (NC):
DC method can be computationally expensive due to the calculation of covariance matrix which can be of O ( N ∗ D 2 ) complexity where D is the dimensionality of the feature space and N is the number of data points in the base dataset.
The covariance matrix is also expensive to store in memory.
Moreover, sampling from a multivariate Gaussian with non-diagonal covariance is also expensive and can be of the order of at least O ( D 2 . 3 )
(Bishop, 2006).
These can reduce the applicability of the approach for certain architectures.
Another aspect of using the hallucinated features is that the model can become biased to the clean features and learn a non-robust ﬁnal classiﬁer.
Note that since these additional data points are generated in the feature space and not the image space, it is not possible to create adversarial versions of these features and perform adversarial training using the large set of features.
This poses a problem of improving the performance during novel training without sacriﬁcing robustness.
To overcome these problems, we present a simple method where we rely only on the calibrated mean and classify query sample using a non-parametric Nearest Centroid based algorithm.
We ﬁnd the nearest base-category centers to each novel training sample and then average them along with the novel training sample to obtain the new mean or centroid for the novel category, similar to (Yang et al., 2021).
We do not consider the covariance matrix in our method and we ﬁnd this approximation works equally well in our experiments.
More formally:
[Equation]
where µ j is the center for the novel category j and S j is the set of m base category centers that are closest to z j , µ bi is the mean of base category i in the feature space.
In the case of k -shot setting, we calculate a centroid for each sample and average them to get one centroid for each category.
At inference time, we simply ﬁnd the nearest center to the query point and assign its label:
[Equation]
where ˜ a = a || a || 2 is the (cid:96) 2 normalized version of the vector a
and ˆ y is the predicted category.
Note that (cid:96) 2 normalization is performed for both query point and centroids.
Since we consider the normalized version of the vectors, euclidean distance reduces to the form in Equation 3, similar to recent works (Grill et al., 2020).
Our inference can be considered similar to the Linear Classiﬁer method exceptthat our centres ( µ j ) are estimated with simple averaging rather than learnt using SGD.
Note that similar to (Yang et al., 2021), as a preprocessing step, we transform the embeddings by taking the square root of each dimension so that their distribution gets closer to Gaussian form.
It can be seen as “Tukey’s
Ladders of Power Transformation” (Tukey et al., 1977) with λ = 0 .
At the inference time, the Nearest Centroid (NC) method requires less memory and computation compared to a Nearest Neighbor classiﬁer since we only have to store and compare with one prototype per class rather than the entire training set.
R ELATED W ORK
Few shot Image Classiﬁcation: Few-shot learning is a challenging problem in computer vision where the goal is rapid generalization to unseen tasks.
Metric learning approaches such as (Snell et al., 2017; Vinyals et al., 2016; Sung et al., 2018) were some of the earliest approaches towards tacking this problem.
(Snell et al., 2017) learn a metric space where prototypical representation of each category is utilized for classifying novel data.
The prototypes are calculated to be the euclidean average over the support examples.
(Ravichandran et al., 2019) showed that rather than taking the average, learning the prototypes along with the model can lead to better performance.
More recently, a family of algorithms based on learning to learn (Andrychowicz et al., 2016) or meta-learning have gained considerable attention.
(Ravi & Larochelle, 2016) develop an LSTM based meta-learner which learns the optimization algorithm required to train another neural network.
(Finn et al., 2017; Nichol et al., 2018) create a model agnostic algorithm which aims to learn a good initialization that can be ﬁnetuned easily within a few gradient steps to adapt to new tasks.
Hallucination based methods such as (Hariharan & Girshick, 2017; Wang et al., 2018;
Antoniou et al., 2017) also present promising directions towards improved generalization.
(Gidaris & Komodakis, 2018; Qi et al., 2018) try to directly predict the weights of the classiﬁer for novel categories.
(Yang et al., 2021) calibrate the distributions of few shot examples using the statistics of categories with larger number of examples. .
However a recent line of work have questioned the need for metalearning or metric learning approaches and showed that simple baselines which are non-episodic in nature can provide competitive performance for few-shot image classiﬁcation task (Chen et al., 2019;
Dhillon et al., 2019).
Such line of work provide for non-sophisticated baselines and pose a question to the community to rethink the approach towards few shot learning.
Adversarial examples: Adversarial examples are carefully crafted perturbations designed to fool the model (Szegedy et al., 2013; Goodfellow et al., 2015; Kurakin et al., 2016).
(Goodfellow et al., 2015) showed that adversarial examples can be created rather easily using the sign of single gradient step, which they called as Fast Gradient Sign Method (FGSM).
The existence of such examples raises a question regarding the generalization capabilities of Deep Neural networks while also posing a threat to practical deployment.
Many defenses have been proposed to overcome this problem (Papernot et al., 2016; Xie et al., 2017; Feinman et al., 2017; Li & Li, 2016), but they have been bypassed with slight modiﬁcations to the adversary (Athalye et al., 2018; Carlini & Wagner; 2017).
One of the most common approaches called adversarial training involves incorporating the adversarial examples into the training set.
(Madry et al., 2018) showed that the ﬁrst order adversary, based on the Projected
Gradient Descent (PGD) algorithm can be used to train robust neural networks.
Provable methods have developed which can provide certiﬁcation on the susceptibility of an input towards adversaries (Wong & Kolter, 2018;
Wong et al., 2018; Raghunathan et al., 2018; Gowal et al., 2018).
A class of algorithms based on randomized smoothing (Cohen et al., 2019; Yang et al., 2020) have shown promising results in training large scale neural networks.
(Zhang et al., 2019a) provide a theoretical analysis on the robustness vs accuracy trade-off, which had been studied empirically (Tsipras et al., 2018), and show that their algorithm named TRADES improves robustness compared to previous approaches.
(Shafahi et al., 2019) use the gradients from the backpropagation algorithm to improve robustness with minimal cost.
Adversarial Robustness for Few-shot classiﬁers: Recent works have tried to address the problem of adversarial examples in the context of few-shot learning.
(Yin et al., 2018) was one of the ﬁrst works to discuss this problem.
They used the FGSM adversary to create adversarial examples and optimized a meta-learner to be robust to adversarial examples.
(Goldblum et al., 2019) showed that meta-learning algorithms can be supplemented with adversarial examples in the query set to learn robustness.
Their method called Adversarial Querying was shown to be robust to strong attacks such as PGD.
Many meta-learning approaches were extended to their robust counterparts by including adversarial query examples.
Recently, (Wang et al., 2021) also proposed a similar approach where
MAML was used as the base meta learning algorithm.
(Wang et al., 2021) also showed that including a contrastive learning objective similar to (Chen et al., 2020) can provide a way to use unlabelled data when learning the model and thus improve both standard and robust accuracy.
E XPERIMENTS
In this section, we describe our experiments and provide implementation details.
We consider three benchmark datasets - Mini-ImageNet , CIFAR-FS and CUB for our experiments.
Mini-ImageNet consists of 100 classes derived from ImageNet dataset (Russakovsky et al., 2015) where each category consists of 600 images.
This was ﬁrst proposed in (Vinyals et al., 2016) and recent works follow the split provided by (Ravi & Larochelle, 2016) consisting of 64 base, 16 validation and 20 novel classes.
We use 84x84x3 images for all experiments with Mini-ImageNet.
CIFAR-FS was proposed in (Bertinetto et al., 2016) as a benchmark for few-shot classiﬁcation.
It splits CIFAR-100 dataset similar to Mini-ImageNet and we use 32x32x3 images for all our experiments.
CUB (Wah et al., 2011) is a ﬁne-grained dataset which has been used as a benchmark for few-shot classiﬁcation.
It consists of 11788 images split across 200 categories.
We use the split provided by (Hilliard et al., 2018) consisting of 100 base , 50 validation and 50 novel classes.
We use 84x84x3 images for experiments with CUB and as per our knowledge are the ﬁrst to show adversarial robustness for a ﬁne-grained dataset under few-shot setting.
We use Pytorch (Paszke et al., 2017) framework and all our experiments use NVIDIA 2080Ti and Titan RTX GPUs.
Implementation details:
In the base training stage, as described in Section 2.1, we follow the attack parameters of (Goldblum et al., 2019) and use iterative PGD attack with 7 iterations during training with (cid:15) = 8 / 255 and α = 2 / 255 for all experiments unless otherwise mentioned.
We mainly use the standard network architecture ResNet (He et al., 2016) and also provide results for other architectures.
For weight averaging, we set the parameter τ = 0 .
We use SGD optimizer with a learning rate of 0.1 and weight decay of 1 e − 5 for the feature extractor parameters θ b and 1 e − 4 for the classiﬁer parameters ω b .
We train the model for 250 epochs with a batch size of 64.
For novel training and learning the Linear Classiﬁer, we follow the setting described in (Chen et al., 2019) and learn the parameters using SGD with momentum 0 .
9 and learning rate η = 0 .
We set the dampening as 0 .and
weight decay of 1 e − 3 .
For our Mean Calibration, we use m = 2 number of base categories.
For calculating Robust Accuracy, we use 20 iterations of PGD to create an adversarial example and measure accuracy w.r.t ground truth.
We report both Standard Accuracy and Robust Accuracy for 5-way, 1-shot and 5-way, 5-shot settings averaged over 1000 different trials on the test set.
We report the mean of the different trials as well as the 95% conﬁdence intervals for all our experiments.
Since our goal is to build robust models, we mainly focus on improving Robust Accuracy.
We compare our results with (Goldblum et al., 2019) ,which we refer to as Adversarial Querying (AQ) where adversarial examples are created for query data and (Wang et al., 2021) which we refer as
OFA where MAML (Finn et al., 2017) is used to adversarially train the model.
We refer to training a linear classiﬁer during the novel training stage as Linear and the Nearest Centroid classiﬁer as NC .
4. M INI -I MAGE N ET
We present our results on Mini-ImageNet in Table 1.
We observe that NC method outperforms other approaches in robust accuracy under most settings.
We also show results on large-scale architectures such as WideResNets (Zagoruyko & Komodakis, 2016) and DenseNets (Huang et al., 2017).
We see that our NC method outperforms on Robust Accuracy in most settings and boosts standard accuracy as well.
The difference becomes clear as we move to larger architectures.
Our Linear classiﬁer also serves as a strong baseline for robust few-shot settings.
Our method is straightforward to scale for large architectures since they are equivalent to training standard architectures.
However, we observed that scaling meta-learning algorithms combined with
PGD adversarial training is a difﬁcult task.
To provide a comparison, we trained both AQ and our model on 4 NVIDIA TITAN RTX GPUs using WideResNet-28-10 backbones.
AQ method took 1.
hour/epoch
and required 60 epochs while our method took 0.36 hour/epoch for 250 epochs.
The total training time for AQ was around 100 hours whereas our method took around 90 hours.
This shows that our approach is more easily scalable compared to previous methods.
[Table]
Ours (Linear)
[Table] [Table] [Table] [Table]
[Table] [Table] [Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table] [Table] [Table]
[Table] [Table]
[Table]
[Table]
[Table]
[Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
Comparison with OFA: We compare with another recent work OFA (Wang et al., 2021) where
MAML was combined with adversarial training to improve robustness.
We present them separately compared to previous results as the attack parameters and testing conﬁguration followed are different.
For a fair comparison, we use the same setting and we refer the readers to (Wang et al., 2021).
Base training column indicates the type of adversary used during base dataset training where AT indicates
PGD adversarial training, TRADES is the algorithm presented in (Zhang et al., 2019a) and CL corresponds to using the Contrastive Learning objective (Chen et al., 2020).
Both TRADES and CL use additional unlabelled data in a semi-supervised manner.
We observe from Table 2 that our method has clear gains in terms of robust accuracy and surpasses standard accuracy in some cases as well.
4. CIFAR-FS
Here we present results on CIFAR-FS dataset.
The organization is similar to Mini-ImageNet dataset where we presented two tables for fair comparison with previous approaches.
To compare with
[Table] [Table]
Adversarial Querying (AQ) (Goldblum et al., 2019), we use a ResNet18 backbone and use parameters (cid:15)
= 8 / 255 and α = 2 / 255 with 20-iteration PGD for testing.
Our results for this setting is presented in Table 10.
Our Nearest Centroid classiﬁer outperforms previous approaches on Robust
Accuracy, which is the main focus of our work.
We also observe that we match or outperform on
Standard Accuracy under both 1-shot and 5-shot settings.
For fair comparison with (Wang et al., 2021), we train a model with Conv4 backbone and use their attack parameters.
The results for this conﬁguration is presented in Table 4.
As explained earlier,
Base training column indicates the type of adversary used during base dataset training where AT indicates PGD adversarial training, TRADES uses the algorithm presented in (Zhang et al., 2019a) and CL corresponds to using the Contrastive Learning objective (Chen et al., 2020).
We see a similar trend as before where our NC outperforms previous approaches.
We also conduct an experiment using TRADES during Base Training, allowing us to compare methods that use similar adversary.
This experiment shows that our method can generalize to other adversarial training methods and we believe that as more advanced methods are developed in the community, they can be incorporated in a straightforward manner to improve robustness in few-shot settings.
[Table]
Comparison with (Wang et al., 2021) for Conv4 backbone on CIFAR-FS dataset.
Comparing methods that use same base training procedure ( AT or TRADES ) , we can see that our NC method outperforms on Robust Accuracy under both 1-shot and 5-shot settings.
This experiment shows that our method can generalize to other adversarial training methods as well.
4. CUB
For results on CUB dataset, we use the same attack parameters described for Mini-ImageNet i.e, (cid:15)
= 8 / 255 , α = 2 / 255 , 7 iterations of PGD during training and 20 during testing.
We use ResNet  backbone and implement AQ as per the guidelines given in (Goldblum et al., 2019) and our best implementation with hyperparameters is presented in Table 5.
Since CUB is a ﬁne-grained classiﬁcation dataset, the base and novel categories share greater similarity compared to previous datasets.
Hence it serves as an opportunity to understand how the robustness transfers from base to novel dataset, i.e whether the similarity in classes acts as a boon or bane under ﬁne-grained dataset settings.
As can be seen from our experiments, the linear classiﬁer baseline performs reasonably well compared to previous approach indicating that a robust base classiﬁer transfers to a robust novel classiﬁer.
The NC method also beneﬁts under such settings and outperforms all other methods on both Standard and Robust Accuracy.
[Table]
D ISCUSSION
In this section, we provide additional intuition into our method and also showcase some beneﬁts of our simple framework.
We also refer the readers to appendix for more experiments and analysis.
Understanding the effect of each component : Our proposed approach consists of multiple components and we would like to study the effect of each of those.
We perform an experiment on
Mini-ImageNet dataset on ResNet18 backbone similar to Table 1 and the results are presented in
Table 6.
We observe that the simple baseline of robust base training and training a linear classiﬁer during novel training works reasonably well which can be a considered a strong baseline (Exp Id 1,4).
We also observe that DC algorithm proposed in (Yang et al., 2021) improves standard accuracy but introduces a drop in robustness (Exp Id 2,5).
In most conﬁgurations we observe that our method matches or even outperforms the DC method and more importantly improves robustness (Exp Id 5,6).
This shows that the robustness of the base dataset is transferred to the novel setting and the mean calibration along with Nearest Centroid classiﬁer can improve robustness in few-shot setting.
The impact of weight averaging (WA) method can be observed when considering Exp Ids 3 and 6.
The temporal ensembling nature of the method helps in ﬁnding ﬂatter minima, thereby boosting performance.
Previous works (Gowal et al., 2020) have shown that this can be used for standard robust classiﬁers.
Here, we observe this holds true under a transfer-learning type setting.
We ﬁnd that the combination of these methods can lead to improved performance.
[Table]
Extension to veriﬁably robust models: An advantage of our simple framework is that we can incorporate methods from the adversarial examples literature for few-shot learning.
Speciﬁcally, we consider veriﬁably robust procedures where the goal is to provide a guarantee on adversarial robustness of the model.
Standard adversarial training methods do not lead to provably robust models leading to low veriﬁed accuracy, we observe a similar trend in our experiments as well.
Many methods have been proposed in this area (Mirman et al., 2018;
Zhang et al., 2019b;
Cohen et al., 2019)
and we consider one of them - Interval Bound Propagation (IBP)
(Gowal et al., 2018).
Here we show that replacing PGD-training with IBP during the robust base training stage described in section 2.1 can lead to veriﬁable robustness for few-shot classiﬁers.
We show results for 1-shot setting in
Table 7 where we use a ResNet18 backbone on CIFAR-FS dataset.
We use the training procedure as described in (Xu et al., 2020) with (cid:15) = 8 / 255 for 1000 epochs.
Here Robust Accuracy refers to 20-iteration PGD testing and Veriﬁed Accuracy is calculated similar to (Gowal et al., 2018).
We believe this experiment can encourage researchers to incorporate more advanced veriﬁcation methods in the future and also develop algorithms speciﬁc to few-shot settings.
[Table]
the learning more complex due to the adversarial training procedure, we perform this baseline experiment and learn the linear layer.
As seen in Table 8 we observe a drop in performance which suggests that the network might be biased towards adversary of the few-shot data.
We use a 7step PGD and 20-step PGD when learning the classiﬁer, similar to adversarial training.
This suggests that creating adversarial examples increases computation but does not lead to performance gains.
Our NC method does not include adversarial examples and outperforms previous methods without increasing computational burden.
This experiment uses ResNet18 backbone on Mini-ImageNet dataset.
[Table]
C ONCLUSION AND F UTURE WORK
We present a simple and scalable approach for improving robustness in few-shot image classiﬁers.
Our method outperforms previous approaches when compared with standard few-shot learning benchmarks on both standard and robust accuracy.
Note that our method is similar to traditional adversarial machine learning approaches rather than meta-learning methods, hence it becomes easier to introduce concepts such as certiﬁed robustness which is unexplored for few-shot classiﬁers.
We show preliminary results in this direction and plan to explore this direction in future works.
We believe that the simplicity of our approach would be beneﬁcial to the community and upon which researchers can develop robust few-shot classiﬁers.
E THICS STATEMENT AND R EPRODUCIBILITY
We believe most AI algorithms including ours can be exploited by adversaries for unethical applications.
On the positive side, we are developing algorithms that make deep networks robust to adversarial attacks, eliminating some of such undesired applications.
Moreover, while publishing such defense algorithms may enable a larger community to access and beneﬁt from them, leading to democratized AI, it can also enable adversaries to develop better attacks.
To ensure that our results are reproducible, we include all implementation details of our work and also provide code.
We believe that readers will have sufﬁcient knowledge of the hyperparameters associated with our method to reproduce the results.
A A PPENDIX
Variation of Robust Accuracy with number of attack iterations:
We vary the number of attack iterations of PGD and observe a fairly stable performance for both 1-shot and 5-shot settings, as seen in Table 9.
This shows that defense performs well and is not sensitive to the number of attack iterations.
We perform this experiment on Mini-Imagenet dataset with ResNet-12 backbone.
[Table]
Variation of Robust Accuracy with perturbation budget (cid:15) :
To check for the absence of gradient masking, we increase (cid:15) from 8/255 to 128/255 in Figure 1.
As expected, we observe that both 1-shot and 5-shot accuracy drop to zero with increased (cid:15) .
Note that we plot only the the mean accuracy over 1000 different tasks.
[Figure]
Variation of Robust Accuracy with number of base neighbors m : We plot the variation of Robust
Accuracy with number of base neighbors m in Figure 2.
We ﬁnd best results with m = 2 which we use for all our experiments.
Note that we plot only the mean accuracy over 1000 different tasks.
[Figure]
Number of base categories chosen:
We plot the variation of standard accuracy with m in Figurefor 1-shot and 5-shot settings.
It is to be noted that we plot only the mean accuracy averaged over
[Figure]
1000 test episodes.
We ﬁnd best results with m = 2 which we use for all our experiments.
Results on TieredImageNet: We also consider TieredImageNet(Ren et al., 2018), which is larger subset of ILSVRC12, sampled from hierarchically.
We use the standard split of 351 base classes and 160 novel classes.
We see once again that the linear classiﬁer acts as a strong baseline and our NC method outperforms previous method.
This is an interesting experiment compared to the one using
Mini-ImageNet which is also sampled from ILCVRC12 and shows that our method works even when the similarity between base and novel classes is varied.
[Table]