Research map / Adversarial robustness and security / Attacks on text and graphs
Generate Universal Adversarial Perturbations for Few-Shot Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that traditional universal adversarial perturbations (GAP-style generators) transfer poorly to few-shot learning and proposes FSAFW, which uses proxy-task alignment and prototype-based fooling loss with smoothed labels to craft UAPs from pre-trained encoders alone.
Problem
Universal adversarial perturbations are typically generated in closed-set settings with a fixed classifier; their attack success drops substantially when transferred to few-shot learning tasks where the attacker has no access to base or novel data.
Approach
Identify two shifts (task shift between pre-training and few-shot test tasks, and semantic shift between proxy/base and novel classes) and address them by sampling proxy 5-way 1-shot tasks, and by training the generator with a prototype-based (cosine) fooling loss on proxy data with smoothed labels, so no proxy labels or fixed classifier are needed.
Key results
- Proposed FSAFW reaches 81.56% ASR on 5-way 1-shot against a ProtoNet-free Baseline victim (mini-ImageNet, ResNet12), versus 47.71% for GAP and 76.68% for AdvEncoder.
- Traditional GAP drops from a mean 89.43% ASR in closed-set to at most 66.47% (and cannot be applied to metric-based models) in FSL settings.
- FSAFW improves over the baseline base-classifier attack (65.07% 1-shot) and the best baseline by over 16% ASR as claimed in the abstract.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FSAFW instead of AdvEncoder | Mini-ImageNet Baseline victim · 5-way 1-shot | ASR: 76.68±0.31 -> 81.56±0.29 | Helped |
| Use FSAFW instead of GAP | Mini-ImageNet ANIL-1 victim · 5-way 1-shot | ASR: 66.47±0.32 -> 77.84±0.28 | Helped |
| Use FSAFW instead of AdvEncoder | Tiered-ImageNet ProtoNet victim · 5-way 1-shot | ASR: 60.23±0.33 -> 76.73±0.32 | Helped |
| Use FSAFW instead of GAP | Mini-ImageNet ANIL-1 victim · 5-way 5-shot | ASR: 64.23±0.29 -> 78.31±0.21 | Helped |
| Use FSAFW instead of AdvEncoder | Tiered-ImageNet ProtoNet victim · 5-way 5-shot | ASR: 60.40±0.30 -> 78.33±0.17 | Helped |
| Add proxy-task alignment with a proxy linear classifier (ablation) | FSAFW · 5-way 1-shot | ASR: 65.07±0.36 -> 70.87±0.36 | Helped |
| Use base-dataset tasks rather than proxy linear tasks (ablation) | FSAFW · 5-way 1-shot | ASR: 70.87±0.36 -> 76.75±0.32 | Helped |
| Replace the proxy linear classifier with proxy prototypes (ablation) | FSAFW · 5-way 1-shot | ASR: 70.87±0.36 -> 80.04±0.30 | Helped |
| Replace prototype loss Eq. 7 with log prototype loss Eq. 8 (ablation) | FSAFW · 5-way 1-shot | ASR: 80.04±0.30 -> 80.72±0.30 | Helped |
| Use smoothed labels in the prototype fooling loss (ablation) | FSAFW · 5-way 1-shot | ASR: 80.72±0.30 -> 81.56±0.29 | Helped |
| Replace FSAFW objective with InfoNCE loss (ablation) | FSAFW · 5-way 1-shot | ASR: 81.56±0.29 -> 77.67±0.31 | Hurt |
| Replace FSAFW objective with MSE loss (ablation) | FSAFW · 5-way 5-shot | ASR: 79.00±0.18 -> 60.38±0.29 | Hurt |
Surprising findings
- Traditional UAP methods such as GAP cannot be applied at all to metric-based FSL models because they lack a fixed classifier.
- Contrastive losses (InfoNCE, SimCLR, SupCon) for generator training are inferior to the proposed prototype-based fooling loss.
Limitations
- Experiments limited to image classification with ResNet12/ResNet18 victims pre-trained on mini-ImageNet and tieredImageNet.
- Perturbation generator relies on proxy datasets whose similarity to the base dataset affects transfer.
- Authors state code will be released but no release link is given.
Experimental setup
Datasets: CIFAR-FS mini-ImageNet tieredImageNet CUB Omniglot GTSRB
Benchmarks: mini-ImageNet FSL victim models tieredImageNet FSL victim models CUB cross-domain Omniglot cross-domain GTSRB cross-domain
Metrics: attack success rate (ASR)
Baselines: GAP UAN AdvEncoder PAP
Builds on: GAP AdvEncoder ProtoNet Libfewshot
Closest papers by meaning
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.90)
- Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · similarity 0.90)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.89)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.88)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.88)
- Few-Shot Adversarial Prompt Learning on Vision-Language Models (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.