O N F AST A DVERSARIAL R OBUSTNESS A DAPTATION IN M ODEL -A GNOSTIC M ETA -L EARNING Anonymous authors
Paper under double-blind review
A BSTRACT
Model-agnostic meta-learning (MAML) has emerged as one of the most successful meta-learning techniques in few-shot learning.
It enables us to learn a metainitialization of model parameters (that we call meta-model ) to rapidly adapt to new tasks using a small amount of labeled training data.
Despite the generalization power of the meta-model, it remains elusive that how adversarial robustness can be maintained by MAML in few-shot learning.
In addition to generalization, robustness is also desired for a meta-model to defend adversarial examples (attacks).
Toward promoting adversarial robustness in MAML, we ﬁrst study when a robustness-promoting regularization should be incorporated, given the fact that
MAML adopts a bi-level (ﬁne-tuning vs. meta-update) learning procedure.
We show that robustifying the meta-update stage is sufﬁcient to make robustness adapted to the task-speciﬁc ﬁne-tuning stage even if the latter uses a standard training protocol.
We also make additional justiﬁcation on the acquired robustness adaptation by peering into the interpretability of neurons’ activation maps.
Furthermore, we investigate how robust regularization can efﬁciently be designed in
MAML.
We propose a general but easily-optimized robustness-regularized metalearning framework, which allows the use of unlabeled data augmentation, fast adversarial attack generation, and computationally-light ﬁne-tuning.
In particular, we for the ﬁrst time show that the auxiliary contrastive learning task can enhance the adversarial robustness of MAML.
Finally, extensive experiments are conducted to demonstrate the effectiveness of our proposed methods in robust few-shot learning.
I NTRODUCTION
Meta-learning, which can offer fast generalization adaptation to unseen tasks (Thrun & Pratt, 2012;
Novak & Gowin, 1984), has widely been studied from model- and metric-based methods (Santoro et al., 2016; Munkhdalai & Yu, 2017;
Koch et al., 2015; Snell et al., 2017) to optimizationbased methods (Ravi & Larochelle, 2016; Finn et al., 2017; Nichol et al., 2018).
In particular, model-agnostic meta-learning (MAML) (Finn et al., 2017) is one of the most intriguing bi-level optimization-based meta-learning methods designed for fast-adapted few-shot learning.
That is, the learnt meta-model can rapidly be generalized to unforeseen tasks with only a small amount of data.
It has successfully been applied to use cases such as object detection (Wang et al., 2020), medical image analysis (Maicas et al., 2018), and language modeling (Huang et al., 2018).
In addition to generalization-ability, recent works (Yin et al., 2018; Goldblum et al., 2019; Xu et al., 2020) investigated MAML from another fundamental perspective, adversarial robustness , given by the capabilities of a model defending against adversarially perturbed inputs (known as adversarial examples/attacks) (Goodfellow et al., 2014).
The challenge of lacking robustness of deep learning (DL) models has gained increasing interest and attention.
And there exists a proactive arm race between adversarial attack and defense; see overview in (Carlini et al., 2019;
Hao-Chen et al., 2020).
There have existed many defensive methods in the context of standard model training, e.g., (Madry et al., 2017; Zhang et al., 2019b; Wong et al., 2020;
Carmon et al., 2019; Stanforth et al., 2019), however, few work studied robust MAML except (Yin et al., 2018; Goldblum et al., 2019) to the best of our knowledge.
And tackling such a problem is more challenging than robustifying the standard model training, since MAML contains a bi-leveled learning procedure in which the meta-update step (outer loop) optimizes a task-agnostic initialization of model parameters while the ﬁne-tuning step (inner loop) learns a task-speciﬁc model instantization updated from the common initialization.
Thus, it remains elusive when (namely, at which learning stage) and how robust regularization should be promoted to strike a graceful balance between generalization/robustness and computation efﬁciency.
Note that neither the standard MAML (Finn et al., 2017) nor the standard robust training (Madry et al., 2017; Zhang et al., 2019b) is as easy as normal training.
Besides the algorithmic design in robust MAML, it is also important to draw in-depth explanation and analysis on why adversarial robustness can efﬁciently be gained in MAML.
In this work, we aim to re-visit the problem of adversarial robustness in MAML (Yin et al., 2018;
Goldblum et al., 2019) and make afﬁrmative answers to the above questions on when , how and why .
Contributions Compared to the existing works (Yin et al., 2018; Goldblum et al., 2019), we make the following contributions:
• Given the fact that MAML is formed as a bi-level learning procedure, we show and explain why regularizing adversarial robustness at the meta-update level is sufﬁcient to offer fast and effective robustness adaptation on few-shot test tasks.
• Given the fact that either MAML or robust training alone is computationally intensive, we propose a general but efﬁcient robustness-regularized meta-learning framework, which allows the use of unlabeled data augmentation, fast (one-step) adversarial example generation during meta-updating, and partial model training during ﬁne-tuning (only ﬁne-tuning the classiﬁer’s head).
• We for the ﬁrst time show that the use of unlabeled data augmentation, particularly introducing an auxiliary contrastive learning task, can provide additional beneﬁts on adversarial robustness of MAML in the low data regime, 2% robust accuracy improvement and 9% clean accuracy improve
- ment over the state-of-the-art robust MAML method (named as adversarial querying ) in (Goldblum et al., 2019).
Related work To train a standard model (instead of a meta-model), the most effective robust training methods include adversarial training (Madry et al., 2017), TRADES that places a theoreticallygrounded trade-off between accuracy and robustness (Zhang et al., 2019b), and their many variants such as fast adversarial training methods (Shafahi et al., 2019; Zhang et al., 2019a; Wong et al., 2020; Andriushchenko & Flammarion, 2020), semi-supervised robust training (Carmon et al., 2019;
Stanforth et al., 2019), adversarial transfer learning and certiﬁably robust training (Wong & Kolter, 2017; Dvijotham et al., 2018).
Moreover, recent works (Hendrycks et al., 2019; Chen et al., 2020a;
Shafahi et al., 2020; Chan et al., 2020; Utrera et al., 2020; Salman et al., 2020) studied the transferability of robustness in in the context of transfer learning and representation learning.
However, the aforementioned standard robust training methods are not directly applicable to MAML in few-shot learning considering MAML’s bi-leveled optimization nature.
A few recent works studied the problem of adversarial training in the context of MAML (Goldblum et al., 2019;
Yin et al., 2018).
Yin et al.
(2018) considered the robust training in both ﬁne-tuning and meta-update steps, which is unavoidably computationally expensive and difﬁcult in optimization.
The most relevant work to ours is (Goldblum et al., 2019), which proposed adversarial querying (AQ) by integrating adversarial training with MAML.
Similar to ours, AQ attempted to robustify meta-update only to gain sufﬁcient robustness.
However, it lacks explanation for the rationale behind that.
We will show that AQ can also be regarded as a special case of our proposed robustnesspromoting MAML framework.
Most important, we make a more in-depth study with novelties summarized in Contributions .
Another line of research relevant to ours is efﬁcient MAML, e.g., (Raghu et al., 2019; Song et al., 2019; Su et al., 2019), where the goal is to improve the computation efﬁciency and/or the generalization of MAML.
In (Song et al., 2019), gradient-free optimization was leveraged to alleviate the need of second-order derivative information during meta-update.
In (Raghu et al., 2019), MAML was simpliﬁed by removing the ﬁne-tuning step over the representation block of a meta-model.
It was shown that such a simpliﬁcation is surprisingly effective without losing generalization-ability.
In (Su et al., 2019), a self-supervised representation learning task was augmented to the meta-updating objective and resulted in a meta-model with improved generalization.
Although useful insights were gained from MAML in the aforementioned works, none of them took adversarial robustness into account.
P RELIMINARIES AND P ROBLEM S TATEMENT
In this section, we ﬁrst review model-agnostic meta learning (MAML) (Finn et al., 2017) and adversarial training (Madry et al., 2017), respectively.
We then motivate the setup of robustness-promoting
MAML and demonstrate its challenges in design when integrating MAML with robust regularization.
MAML MAML attempts to learn an initialization of model parameters (namely, a meta-model) so that a new few-shot task can quickly and easily be tackled by ﬁne-tuning this meta-model over a small amount of labeled data.
The characteristic signature of MAML is its bi-level learning procedure, where the ﬁne-tuning stage forms a task-speciﬁc inner loop while the meta-model is updated at the outer loop by minimizing the validation error of ﬁne-tuned models over cumulative tasks.
Formally, consider N few-shot learning tasks {T i } Ni =1 , each of which has a ﬁne-tuning data set D i and a validation set D (cid:48)
i , where D i is used in the ﬁne-tuning stage and D (cid:48)
i is used in the meta-update stage.
Here the superscript ( (cid:48) ) is preserved to indicate operations/parameters at the meta-upate stage.
MAML is then formulated as the following bi-level optimization problem (Finn et al., 2017): minimize w
[Equation]
subject
[Equation]
(1) where w denotes the meta-model to be designed, w (cid:48)
i is the T
i -speciﬁc ﬁne-tuned model, (cid:96) (cid:48)
i ( w (cid:48) i ; D (cid:48) i ) represents the validation error using the ﬁne-tuned model, (cid:96) i ( w i ; D i , w ) denotes the training error when ﬁne-tuning the task-speciﬁc model parameters w i using the task-agnostic initialization w , and for ease of notation, [ K ] represents the integer set { 1 , 2 , . .
. , K } .
In (1), the objective function and the constraint correspond to the meta-update stage and ﬁne-tuning stage, respectively.
The bilevel optimization problem is challenging because each constraint calls an inner optimization oracle, which is typically instantiated into a K -step gradient descent (GD) based solver:
[Equation]
We note that even with the above simpliﬁed ﬁne-tuning step, updating the meta-model w still requires the second-order derivatives of the objective function of (1) with respect to (w.r.t.)
w .
Adversarial training The min-max optimization based adversarial training (AT) is known as one of the most powerful defense methods to obtain a robust model against adversarial attacks (Madry et al., 2017).
We summarize AT and its variants through the following robustness-regularized optimization problem:
[Equation]
where (cid:96) ( w ; x , y ) denotes the prediction loss evaluated at the point x with label y , λ ≥ 0 is a regularization parameter, δ denotes the input perturbation variable within the (cid:96) ∞ -norm ball of radius (cid:15) , g represents the robust loss evaluated at the model w at the perturbed example x + δ given the true label y , and for ease of notation, let R ( w ; D ) denote the robust regularization function for model w under the data set D .
In the rest of the paper, we consider two speciﬁcations of R : (a)
AT regularization (Madry et al., 2017), where we set g = (cid:96) and λ = 0 ; (b) TRADES regularization
(Zhang et al., 2019b), where we deﬁne g as the cross-entropy between the distribution of prediction probabilities at the perturbed example ( x + δ ) and that at the original sample x .
Robustness-promoting MAML Integrating MAML with AT is a natural solution to enhance adversarial robustness of a meta-model in few-shot learning.
However, this seemingly simple scheme is in fact far from trivial, and there exist three critical roadblocks as elaborated below.
First , it remains elusive at which stage (ﬁne-tuning or meta-update) robustness can most effectively be gained for MAML.
Based on (1) and (2), we can cast this problem as a uniﬁed optimization problem that augments the MAML loss with the robust regularization under two degrees of freedom characterized by two hyper-parameters γ out ≥ 0 and γ in ≥ 0 : minimize w
[Equation]
+
[Equation]
)] subject to w (cid:48)
i =
arg min w i
[ (cid:96) i ( w i ; D i , w ) + γ in R i ( w i ; D i )] , ∀ i ∈ [ N ] .
Here R i denotes the task-speciﬁc robustness regularizer, and the choice of ( γ in , γ out ) determines the speciﬁc scenario of robustness-promoting MAML.
Clearly, the direct application is to set γ in >and γ out > 0 , that is, both ﬁne-tuning and meta-update steps would be carried out using robust training, which calls additional loops to generate adversarial examples.
Thus, this would make computation most intensive.
Spurred by that, we ask: Is it possible to achieve a robust meta-model by incorporating robust regularization into only either meta-update or ﬁne-tuning step (corresponding to γ in = 0 or γ out = 0 )?
Second , both MAML in (1) and AT in (2) are challenging bi-level optimization problems which need to call inner optimization routines for ﬁne-tuning and attack generation, respectively.
Thus, we ask whether or not the computationally-light alternatives of inner solvers, e.g., partial ﬁne-tuning (Raghu et al., 2019) and fast attack generation (Wong et al., 2020), can promise adversarial robustness in few-shot learning.
Third , it has been shown that adversarial robustness can beneﬁt from semi-supervised learning by leveraging (unlabeled) data augmentation (Carmon et al., 2019; Stanforth et al., 2019).
Spurred by that, we further ask: Is it possible to generalize robustness-promoting MAML to the setup of semi-supervised learning for improved accuracy-robustness tradeoff?
W HEN TO I NCORPORATE R OBUST R EGULARIZATION IN MAML?
In this section, we evaluate at which stage adversarial robustness can be gained during meta-training.
We will provide insights and step-by-step investigations to show when to incorporate robust training in MAML and why it works.
Based on (3), we focus on two robustness-promoting meta-training protocols.
(a) R-MAML both , where robustness regularization applied to both ﬁne-tuning and metaupdate steps with γ in , γ out > 0 ; (b) R-MAML out , where robust regularization applied to metaupdate only , i.e., γ in = 0 and γ out > 0 .
Compared to R-MAML both , R-MAML out is more userfriendly since it allows the use of standard ﬁne-tuning over the learnt robust meta-model when tackling unseen few-shot test tasks (known as meta-testing).
In what follows, we will show that even if R-MAML out does not use robust regularization in ﬁne-tuning, it is sufﬁcient to warrant the transferability of meta-model’s robustness to downstream ﬁne-tuning tasks.
[Figure]
All you need is robust meta-update during metatraining To study this claim, we solve problem (3) using R-MAML both and R-MAML out respectively in the 5 -way 1 -shot learning setup, where 1 data sample at each of 5 randomly selected MiniImagenet classes (Ravi & Larochelle, 2016) constructs a learning task.
Throughout this section, we specify R i in (3) as the
AT regularization, which calls a 10 -step projected gradient descent (PGD) attack generation method with (cid:15) = 2 / 255 in its inner maximization subroutine given by (2).
We refer readers to Section 6 for more implementation details.
We ﬁnd that the meta-model acquired by R-MAML out yields nearly the same robust accuracy (RA) as
R-MAML both against various PGD attacks generated at the testing phase using different perturbation sizes (cid:15) = { 0 , 2 , . .
, 10 } / 255 as shown in Figure 1.
Unless speciﬁed otherwise, we evaluate the performance of the meta-learning schemes over 2400 random unseen 5 -way 1 -shot test tasks.
We also note that RA under (cid:15) = 0 becomes the standard accuracy (SA) evaluated using benign (unperturbed) test examples.
It is clear from Figure 1 that both R-MAML out and R-MAML both can yield signiﬁcantly better RA than MAML with slightly worse SA.
It is also expected that RA decreases as the attack power (cid:15) increases.
Spurred by experiment results in Figure 1, we hypothesize that the promotion of robustness in metaupdate alone (i.e. R-MAML out ) is already sufﬁcient to offer robust representation , over which ﬁne-tuned models can preserve robustness to downstream tasks.
In what follows, we justify the above hypothesis from two perspectives: (i) explanation of learned neuron’s representation and (ii) resilience of learnt robust meta-model to different ﬁne-tuning schemes at the meta-testing phase.
(i) Learned signature of neuron’s representation It is recently shown in (Engstrom et al., 2019) that a robust model exhibits perceptually-aligned neuron activation maps, which are not present if the model lacks adversarial robustness.
To uncover such a signature of robustness, a feature inversion technique (Engstrom et al., 2019) is applied to ﬁnding an inverted input attribution map (IAM) that maximizes neuron’s activation.
Based on that, we examine if R-MAML both and R-MAML out can similarly generate explainable inverted images from the learned neuron’s representation.
We refer readers to Appendix 2 for more details on feature inversion from neuron’s activation.
[Figure]
[Figure] [Figure]
h )
[Figure] [Figure] A M
[Figure]
o u t )
In our experiment, we indeed ﬁnd that both R-MAML both and R-MAML out yield similar IAMs inverted from neuron’s activation at different input examples, as plotted in Figure 2.
More intriguingly, the learnt IAMs characterize the contour of objects existed in input images, and accompanied by the learnt high-level features, e.g., colors.
In contrast, the IAMs of MAML lack such an interpretability.
The observations from the interpretability of neurons’ representation justify why R-MAML out is as effective as R-MAML both and why
MAML does not preserve robustness.
(ii) Robust meta-update provides robustness adaptation without additional adversarial ﬁne-tuning at meta-testing
Meta-testing includes only the ﬁne-tuning stage.
Therefore, we need to explore if standard ﬁne-tuning is enough to maintain the robustness.
Suppose that R-MAML out is adopted as the meta-training method to solve problem (3), we then ask if robustness-regularized meta-testing strategy can improve the robustness of ﬁne-tuned model at downstream tasks.
Surprisingly, we ﬁnd that making an additional effort to adversarially ﬁne-tune the meta-model (trained by R-MAML out ) during testing does not provide an obvious robustness improvement over the standard ﬁne-tuning scheme during testing (Table 1).
This consistently implies that robust metaupdate (R-MAML out ) is sufﬁcient to render intrinsic robustness in its learnt meta-model regardless of ﬁne-tuning strategies used at meta-testing.
Figure S1 in Appendix 3 provides evidence that the visualization difference is small between before standard ﬁne-tuning and after standard ﬁne-tuning.
[Table]
Adversarial querying (AQ) (Goldblum et al., 2019):
A special case of R-MAML out
The recent work (Goldblum et al., 2019) developed AQ to improve adversarial robustness in few-shot learning.
AQ can be regarded as a special case of R-MAML out with γ in = 0 but setting γ out = ∞ in (3).
That is, the meta-update is overridden by the AT regularization.
We ﬁnd that AQ yields about 2% RA improvement over R-MAML out , which uses γ out = 0 .
2 in (3).
However, AQ leads to 11% degradation in SA, and thus makes a much poorer robustness-accuracy tradeoff than our proposed R-MAML out .
We refer readers to Table 2 for comparison of the proposed R-MAML out with other training baselines.
Most importantly, different from (Goldblum et al., 2019), we provide insights on why
R-MAML out is effective in promoting adversarial robustness from meta-update to ﬁne-tuning.
C OMPUTATIONALLY -E FFICIENT R OBUSTNESS -R EGULARIZED MAML
In this section, we study if the proposed R-MAML out can further be improved to ease of optimization given the two computation difﬁculties in (3): (a) bi-leveled meta-learning, and (b) the need of inner maximization to ﬁnd the worst-case robust regularization.
To tackle either problem alone, there have been efﬁcient solution methods proposed recently.
In (Raghu et al., 2019), an almostno-inner-loop (ANIL) ﬁne-tuning strategy was proposed, where ﬁne-tuning is only applied to the task-speciﬁc classiﬁcation head following a frozen representation network inherited from the metamodel.
Moreover, in (Wong et al., 2020), a fast gradient sign method (FGSM) based attack generator was leveraged to improve the efﬁciency of AT without losing its adversarial robustness.
Motivated by (Raghu et al., 2019; Wong et al., 2020), we ask if integrating R-MAML out with ANIL and/or
FGSM can improve the training efﬁciency but preserves the robustness and generalization-ability of a meta-model learnt from R-MAML out .
R-MAML out meets ANIL and FGSM
We decompose the meta-model w =
[ w r , w c ] into two parts: representation encoding network w r and classiﬁcation head w c .
In R-MAML out , namely, (3) with γ in = 0 , ANIL suggests to only ﬁne-tune w c over a speciﬁc task T i .
This leads to
[Equation]
with
[Equation]
(ANIL)
In ANIL, the initialized representation network w r keeps intact during task-speciﬁc ﬁne-tuning, which thus saves the computation cost.
Furthermore, if FGSM is used in R-MAML out , then the robustness regularizer R deﬁned in (2) reduces to
[Equation]
where δ 0 is an initial point randomly drawn from a uniform distribution over the interval [ − (cid:15), (cid:15) ] .
Note that in the original implementation of robust regularization R , a multi-step projected gradient ascent (PGA) is typically used to optimize the sample-wise adversarial perturbation δ ( w ) .
By contrast, FGSM only uses one-step PGA in attack generation and thus improves the computation efﬁciency.
[Table]
In
Table 2, we study two computationally-light alternatives of
R-MAML out , R-MAML out with ANIL (R-MAML out -ANIL) and R-MAML out with
FGSM (R-MAML out -FGSM).
Compared to R-MAML out , we ﬁnd that although
R-MAML out -FGSM takes less computation time, it yields even better RA with slightly worse SA.
By contrast, R-MAML out -ANIL yields the least computation cost but the worst SA and RA.
For comparison, we also present the performance of the adversarial meta-learning baseline
AQ (Goldblum et al., 2019).
As we can see, AQ promotes the adversarial robustness at the cost of a signiﬁcant SA drop, e.g., 7 . 56% worse than R-MAML out -ANIL.
Overall, the application of FGSM to R-MAML out provides the most graceful tradeoff between the computation cost and the standard and robust accuracies.
In the rest of the paper, unless speciﬁed otherwise we will use FGSM in
R-MAML out .
S EMI -S UPERVISED R OBUSTNESS -P ROMOTING MAML
Given our previous solutions to when (Sec. 3) and how (Sec. 4) a robust regularization could effectively be promoted in few-shot learning, we next ask: Is it possible to further improve our proposal R-MAML out by leveraging unlabeled data ?
Such a question is motivated from two aspects.
First, the use of unlabeled data augmentation could be a key momentum to improve the robustnessaccuracy tradeoff (Carmon et al., 2019; Stanforth et al., 2019).
Second, the recent success in selfsupervised contrastive representation learning (Chen et al., 2020b; He et al., 2020) demonstrates the power of multi-view (unlabeled) data augmentation to acquire discriminative and generalizable visual representations, which can guide down-stream supervised learning.
In what follows, we propose an extension of R-MAML out applicable to semi-supervised learning with unlabeled data augmentation.
R-MAML out with TRADES regularization.
We recall from (2) that the robust regularization
R can also be speciﬁed by TRADES (Zhang et al., 2019b), which relies only on the prediction logits of benign and adversarial examples (rather than the training label), and thus lends itself to the application of unlabeled data.
Spurred by that, we propose R-MAML out -TRADES, which is a variant of R-MAML out using the unlabeled data augmented TRADES regularization.
To perform data augmentation in experiments, we follow (Carmon et al., 2019) to mine additional (unlabeled) data with the same amount of MiniImagenet data from the original ImageNet data set.
For clarity, we call R-MAML out using TRADES or AT regularization (but without unlabeled data augmentation)
R-MAML out (TRADES) or R-MAML out (AT).
[Figure]
We ﬁnd that with the help of unlabeled data,
R-MAML out -TRADES improves the accuracyrobustness tradeoff over its supervised counterpart
R-MAML out using either AT or TRADES regularization (Figure 3).
Compared to R-MAML out ,
R-MAML out -TRADES yields consistently better RA against different attack strength (cid:15) ∈ { 2 , . .
. , 10 } /during testing.
Interestingly, the improvement becomes more signiﬁcant as (cid:15) increases.
As (cid:15) = 0 ,
RA is equivalent to SA, and we observe that the superior performance of R-MAML out -TRADES in RA bears a slight degradation in SA compared to R-MAML out (TRADES) and R-MAML out (AT), which indicates the robustness-accuracy tradeoff.
Figure S2 in Appendix 5 provides an additional evidence that R-MAML out -TRADES has the ability to defend stronger attacks than R-MAML out , and proper unlabeled data augmentation can further improve the accuracy-robustness tradeoff in MAML.
R-MAML out with contrastive learning (CL).
To improve adversarial robustness, many works, e.g., (Pang et al., 2019; Sankaranarayanan et al., 2017), also suggest that it is important to encourage robust semantic features that locally cluster according to class, namely, ensuring that features of samples in the same class will lie close to each other and away from those of different classes.
The above suggestion aligns with the goals of contrastive learning (CL)
(Chen et al., 2020b; Wang & Isola, 2020), which promotes (a) alignment (closeness) of features from positive data pairs, and (b) uniformity of feature distribution.
Thus, we develop R-MAML out -CL by integrating R-MAML out with CL.
Prior to deﬁning R-MAML out -CL, we ﬁrst introduce CL and refer readers to (Chen et al., 2020b) for details.
Given a data sample x , CL utilizes its positive counterpart x + given by a certain data transformation t , e.g., cropping and resizing, cut-out, and rotation, x + = t ( x ) .
The data pair ( x , t ( x (cid:48) )) is then positive if x = x (cid:48) , and negative otherwise.
The contrastive loss is deﬁned by
[Equation]
CL
[Equation]
w
[Equation]
; p
[Equation]
=
E
[Equation]
where x ∼ p denotes the data distribution, p + ( · , · ) is the distribution of positive pairs, r ( x ; w c ) is the encoded representation of x extracted from the representation network w c , and τ > 0 is a temperature parameter.
The contrastive loss minimizes the distance of a positive pair among many negative pairs, namely, learns network representation with instance-wise discriminative power.
According to CL, we then augment the data used to train R-MAML out with their transformed counterparts.
In addition, the adversarial examples generated during robust regularization can also be used as additional views of the original data, which in turn advance CL.
Formally, we modify
R-MAML out , given by (3) with γ in = 0 , as minimize
w
[Equation]
subject to w (cid:48)
[Equation]
= arg
[Equation] w
[Equation] (4) where γ CL > 0 is a regularization parameter associated with the contrastive loss, p + i ∪ p adv i represents the distribution of positive data pairs constructed by the standard and adversarial views of D (cid:48) , and w (cid:48) c ,i denotes the representation block of the model w (cid:48) i .
[Table]
In Table 3, we compare the SA/RA performance of
R-MAML out -CL with that of previously-suggestedvariants of
R-MAML out including the versions
R-MAML out (AT) and
R-MAML out (TRADES) without using unlabeled data, and the version with unlabeled data R-MAML out -TRADES, as well as 2 baseline methods including standard MAML and adversarial querying (AQ) in few-shot learning (Goldblum et al., 2019).
Note that we specify R i in (4) as TRADES regularization for R-MAML out -CL.
We ﬁnd that R-MAML out -CL yields the best
RA among all meta-learning methods, and improves SA over R-MAML out -TRADES.
In particular, the comparison with AQ shows that R-MAML out -CL leads to 9% improvement in SA and 1 . 9% improvement in RA.
A DDITIONAL E XPERIMENTS
[Table]
Key facts of our implementation.
In the main text, we consider 1-shot 5-way image classiﬁcation tasks over MiniImageNet (Vinyals et al., 2016). And we use a four-layer convolutional neural network for fewshot learning (FSL).
By default, we set the training attack strength (cid:15) = 2 , γ CL = 0 .
1 , and set γ out =(TRADES), γ out = 0 .
2 (AT) via a grid search.
During meta-testing, a 10 -step PGD attack with attack strength (cid:15) = 2 is used to evaluate RA of the learnt meta-model over 2400 few-shot test tasks.
We provide experiment details in Appendix 4. Summary of baselines. We remark that in addition to MAML and AQ baselines, we also consider the other two baseline methods, supervised standard training over the entire dataset (non-FSL setting), and supervised AT over the entire dataset (non-FSL setting); see a summary in Table 4.
The additional baselines demonstrate that robust adaptation in FSL is non-trivial as neither the supervised full AT or the full standard training can achieve satisfactory SA and RA. Experiments on Additional model architecture, datasets and FSL setups. In Table S1 of Appendix 5, we provide additional experiments using ResNet18. In particular, R-MAML out -CL leads to 13 .
94% SA improvement and 1 .
42% RA improvement over AQ.
We also test our methods on
CIFAR-FS (Bertinetto et al., 2018) and Omniglot (Lake et al., 2015), and provide the results in
Appendix 6 and Appendix 7, respectively.
The results show that our methods perform well on various datasets and outperform the baseline methods.
As shown in Table S2 and Table S3, the use of unlabeled data augmentation (R-MAML out -CL) on CIFAR-FS can provide 10% (or 5 . 6% )
SA improvement and 3% (or 1 . 3% )
RA improvement over AQ under the 1-Shot 5-Way (or 5-Shot 5-Way) setting.
Furthermore, we conduct experiments in other FSL setups.
On CIFAR-FS, we study 1-Shot 5-Way and 5-Shot 5-Way settings (Tables S2 and S3).
On Omniglot, we compare
R-MAML out (TRADES) to AQ (Goldblum et al., 2019) in the 1-shot (5, 10, 15, 20)-Way settings.
Figure.
S3 shows that R-MAML out (TRADES) can always obtain better performance than AQ when the number of classes in each task varies.
C ONCLUSION
In this paper we study the problem of adversarial robustness in MAML.
Beyond directly integrating
MAML with robust training, we show and explain when a robust regularization should be promoted in MAML.
We ﬁnd that robustifying the meta-update stage via fast attack generation method is sufﬁcient to achieve fast robustness adaptation without losing generalization and computation efﬁciency in general.
To further improve our proposal, we for the ﬁrst time study how unlabeled data help robust MAML.
In particular, we propose using contrastive representation learning to acquire improved generalization and robustness simultaneously.
Extensive experiments are provided to demonstrate the effectiveness of our approach and justify our insights on the adversarial robustness of MAML.
In the future we plan to establish the convergence rate analysis of robustness-aware MAML by leveraging bi-level and min-max optimization theories
S UPPLEMENTARY M ATERIAL F RAMEWORK OF R-MAML out
Algorithm S1 shows the framework of R-MAML out .
The initial inputs include model weights w , distribution of the training tasks p ( T ) , and the step sizes α, β 1 , β 2 , which correspond to ﬁne-tuning, clean meta-update, adversarial meta-update.
Each batch contains multiple tasks that are sampled from the p ( T ) .
K is the number of gradient updates in ﬁne-tuning.
The adapted parameter w ( K ) i is used to generate adversarial validation data ˆ D (cid:48)
i from the clean validation data D (cid:48)
i and to compute the loss value
R i ( w ( K ) i ; ˆ D (cid:48) i ) .
The attack generator can be selected from Projected Gradient Descent (Madry et al., 2017), Fast Gradient Sign Method (Goodfellow et al., 2014), etc.
Here (cid:15) is used to control the attack strength in the training.
Algorithm S1 R-MAML out
i w
w (
[Equation] [Equation]
w (
[Equation] [Equation]
; D i w
end for
Using attack generator to generate adversarial validation data ˆ D (cid:48)
i by maximizing adversarial loss
R i ( w ( K ) i ; ˆ D (cid:48) i ) with the constraint (cid:107) ˆ D (cid:48)
i − D (cid:48)
i (cid:107) ∞ ≤ (cid:15) end for
= w − β 1 ∇ w (cid:80) T i ∼ p ( T ) (cid:96)
i ( w ( K ) i ; D (cid:48)
i , w ) − β 2 γ out ∇ w (cid:80) T i ∼ p ( T ) R i ( w ( K ) i ; ˆ D (cid:48) i ) 11 end while 12 Return: w
D ETAILS OF L EARNED S IGNATURE OF N EURON ’ S A CTIVATION
By maximizing a single coordinate of the neuron activation vector r (the output before the fullyconnected layer) with a perturbation in the input, the perturbation will show different behaviors between a robust model and a standard model (Engstrom et al., 2019).
To be more speciﬁc, the feature pattern is revealed in the input under a robust model, while a standard model does not have such behavior.
The optimization problem can be mathematically written in the following form maximize
[Equation]
where r i denotes the i -th coordinate of neuron activation vector.
δ is the perturbation in the input.
x j is the j -th pixel of the image vector x .
V ISUALIZATION OF IAM S B EFORE AND A FTER F INE -T UNING IN M ETA -T ESTING
Once obtain a model using R-MAML out , we can test the impact of the standard ﬁne-tuning on its robustness.
Figure S1 shows a randomly selected neuron’s inverted input attribution maps (IAMs) before standard ﬁne-tuning and after standard ﬁne-tuning in the meta-testing phase.
The second row shows IAMs of the model before ﬁne-tuning.
The third row shows IAMs of the model after ﬁne-tuning.
One can ﬁnd that the difference is small between the IAMs before ﬁne-tuning and after ﬁne-tuning, suggests that robust meta-update itself can provide the robustness adaptation without additional adversarial training.
[Figure]
I
[Figure]
( B e f o re - F T )
I A M s ( A ft erF T )
D ETAILS OF E XPERIMENTS
To test the effectiveness of our methods, we employ the MiniImageNet dataset Vinyals et al.
(2016), which is the benchmark for few-shot learning.
MiniImageNet contains 100 classes with 600 samples in each class.
We use the training set with 64 classes and test set with 20 classes.
In our experiments, we downsize each image to 84 × 84 × 3 .
we consider the 1-shot 5-way image classiﬁcation task, i.e., the inner-gradient update (ﬁne-tuning) is implemented using ﬁve classes and one ﬁne-tuning image for each class in one single task.
In meta-training, Each batch contains four tasks.
We set the number of gradient update steps K =in meta-training.
For the meta-update, we use 15 validation images for each class.
We set the gradient step size in the ﬁne-tuning as α = 0 . 01 , and the gradient step sizes in the meta-update as β 1 = 0 .
001 , β 2 = 0 .
001 for clean validation data and adversarial validation data, respectively.
[Figure]
A DDITIONAL C OMPARISONS ON M INI I MAGE N ET
Figure S2 shows robust accuracy (RA) performance of models trained using our methods.
One can see that R-MAML out -TRADES has the ability to defend stronger attacks than R-MAML out .
In Table S1, we compare the SA/RA performance of variants of R-MAML out including
R-MAML out (AT), the TRADES regularization with unlabeled data R-MAML out -TRADES, the version with contrastive learning R-MAML out -CL.
One can see that R-MAML out -CL yields the best SA and RA among all meta-learning methods.
[Table]
E XPERIMENTS ON CIFAR-FS
We also test our proposed methods on CIFAR-FS (Bertinetto et al., 2018), which is an image classiﬁcation dataset containing 64 classes of training data and 20 classes of evaluation data.
The compared methods are the same as in Table 3.
We keep the settings to be the same as in the test on MiniImagenet except we set (cid:15) = 8 .
To perform data augmentation in experiments, we mine 500 additional unlabeled data for each training class from the STL-10 dataset (Coates et al., 2011).
Table S2 and Table S3 show the comparisons in 1-Shot 5-Way and 5-Shot 5-Way learning scenarios, respectively.
One can see that our methods outperform the baseline methods MAML and AQ (Goldblum et al., 2019).
The results also indicate that semi-supervised learning (in terms of TRADES and contrastive learning) can further boost the performance.
In particular, as shown by Table S2 and
Table S3, R-MAML out -CL leads to 10% SA improvement and 3% RA improvement compared to
AQ under the MAML 1-Shot 5-Way setting, and 5 .
6% SA improvement and 1 .
3% RA improvement under the 5-Shot 5-Way setting.
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
E XPERIMENTS ON O MNIGLOT
We then conduct experiments on Omniglot (Lake et al., 2015), which includes handwritten characters from 50 different alphabets.
There are 1028 classes of training data and 423 classes of evaluation
[Table]
data. Due to the hardness of ﬁnding the unlabeled data with similar patterns, we only test our supervised learning methods on Omniglot.
We compare R-MAML out (TRADES) to AQ (Goldblum et al., 2019) in the 1-shot (5, 10, 15, 20)-Way settings.
Figure.
S3 shows the results of RA/SA under (cid:15) =
The results show that R-MAML out (TRADES) can obtain better performance than AQ.
[Figure]