[Paper Review] A Simple Approach to Adversarial Robustness in Few-shot Image Classification

Akshayvarun Subramanya, Hamed Pirsiavash|arXiv (Cornell University)|Apr 11, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a simple, scalable method for improving adversarial robustness in few-shot image classification by first adversarially training a base model on a large dataset and then using a calibrated nearest centroid classifier on novel few-shot classes. The approach outperforms state-of-the-art meta-learning-based methods on standard benchmarks with minimal computational overhead and enables integration with verifiably robust techniques.

ABSTRACT

Few-shot image classification, where the goal is to generalize to tasks with limited labeled data, has seen great progress over the years. However, the classifiers are vulnerable to adversarial examples, posing a question regarding their generalization capabilities. Recent works have tried to combine meta-learning approaches with adversarial training to improve the robustness of few-shot classifiers. We show that a simple transfer-learning based approach can be used to train adversarially robust few-shot classifiers. We also present a method for novel classification task based on calibrating the centroid of the few-shot category towards the base classes. We show that standard adversarial training on base categories along with calibrated centroid-based classifier in the novel categories, outperforms or is on-par with state-of-the-art advanced methods on standard benchmarks for few-shot learning. Our method is simple, easy to scale, and with little effort can lead to robust few-shot classifiers. Code is available here: \url{https://github.com/UCDvision/Simple_few_shot.git}

Motivation & Objective

• To address the vulnerability of few-shot classifiers to adversarial examples in low-data regimes.
• To develop a method that achieves robust generalization with minimal computational cost and no complex meta-learning.
• To enable the use of advanced robustness techniques—like certified robustness—in few-shot learning by aligning with standard training paradigms.
• To demonstrate that standard mini-batch adversarial training suffices for robust few-shot generalization, challenging the need for complex episodic meta-learning.

Proposed method

• Train a feature extractor and linear classifier on a large, clean base dataset using standard mini-batch adversarial training.
• Freeze the feature extractor after base training and use it to embed novel few-shot support sets.
• Apply a Calibrated Nearest Centroid (CNC) classifier that uses centroids from m base categories to refine the prediction for novel classes.
• Calibrate the novel class centroid by averaging it with the nearest m centroids from base categories, improving generalization and robustness.
• Use the same backbone and training setup as standard models, enabling straightforward integration with existing robustness techniques.
• Perform inference using the frozen feature extractor and the calibrated linear classifier, avoiding retraining or adversarial generation during inference.

Experimental results

Research questions

• RQ1 Can standard adversarial training on a large base dataset improve robustness in few-shot image classification without requiring meta-learning or episodic training?
• RQ2 Does a calibrated nearest centroid classifier improve robustness in few-shot settings compared to standard linear classifiers?
• RQ3 Can the proposed method be extended to verifiably robust classification, such as using interval bound propagation (IBP)?
• RQ4 Does including adversarial examples from few-shot data during linear classifier training improve robustness or degrade performance?
• RQ5 How does the number of base category centroids used in calibration (m) affect the robustness and accuracy of the final model?

Key findings

• The proposed method achieves state-of-the-art or competitive robust accuracy on standard few-shot benchmarks like Mini-ImageNet and CIFAR-FS, outperforming complex meta-learning-based approaches.
• Using a calibrated nearest centroid (CNC) classifier with m=2 base category centroids yields the best performance, indicating that a small number of base class prototypes is sufficient for effective calibration.
• The method achieves 21.38% robust accuracy under 20-step PGD attack on Mini-ImageNet (1-shot) with ResNet18, surpassing baseline linear classifiers trained on clean data (19.56%) or adversarial examples (18.83%).
• The approach enables the use of verifiably robust methods: when combined with IBP, the CNC method achieves 23.25% verified accuracy on CIFAR-FS, demonstrating compatibility with certified robustness.
• Including adversarial examples from few-shot data during linear classifier training leads to performance degradation, indicating that such data is less effective for robust generalization than base data.
• The calibration step is a one-time preprocessing operation that does not affect inference speed, making the method practical for real-world deployment.