Attacking Few-Shot Classifiers with Adversarial Support Sets
Few-shot learning systems, especially those based on meta-learning, have recently made significant advances, and are now being considered for real world problems in healthcare, personalization, and science. In this paper, we examine the robustness of such deployed few-shot learning systems when they are fed an imperceptibly perturbed few-shot dataset, showing that the resulting predictions on test inputs can become worse than chance. This is achieved by developing a novel Adversarial Support Set Attack which crafts an adversarial set of examples. When even a small subset of adversarial data points is inserted into the support set of a meta-learner, accuracy is significantly reduced. For example, the average classification accuracy of CNAPs on the Aircraft dataset in the META-DATASET benchmark drops from 69.2% to 9.1% when only 20% of the support set is poisoned by imperceptible perturbations. We evaluate the new attack on a variety of few-shot classification algorithms including MAML, prototypical networks, and CNAPs, on both small scale (miniImageNet) and large scale (META-DATASET) few-shot classification problems. Interestingly, adversarial support sets produced by attacking a meta-learning based few-shot classifier can also reduce the accuracy of a fine-tuning based few-shot classifier when both models use similar feature extractors.
Code (0)
등록된 구현이 없습니다.
Tasks
Few-Shot LearningGeneral ClassificationMeta-LearningMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Attacking Few-Shot Classifiers with Adversarial Support Poisoning
This paper examines the robustness of deployed few-shot meta-learning systems when they are fed an imperceptibly perturbed few-shot dataset, showing that the resulting predictions on test inputs can become worse than cha…
Meta-LearningDetection of Adversarial Supports in Few-shot Classifiers Using Self-Similarity and Filtering
Few-shot classifiers excel under limited training samples, making them useful in applications with sparsely user-provided labels. Their unique relative prediction setup offers opportunities for novel attacks, such as tar…
Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples
Few-shot classifiers have been shown to exhibit promising results in use cases where user-provided labels are scarce. These models are able to learn to predict novel classes simply by training on a non-overlapping set of…
Adversarially Robust Prototypical Few-shot Segmentation with Neural-ODEs
Few-shot Learning (FSL) methods are being adopted in settings where data is not abundantly available. This is especially seen in medical domains where the annotations are expensive to obtain. Deep Neural Networks have be…
Adversarial DefenseFew-Shot LearningOrgan SegmentationSegmentationMeta-Attack: Class-Agnostic and Model-Agnostic Physical Adversarial Attack
Modern deep neural networks are often vulnerable to adversarial examples. Most exist attack methods focus on crafting adversarial examples in the digital domain, while only limited works study physical adversarial at…
Adversarial AttackFew-Shot LearningMeta-Learning