query: The query consists of users’ needs, leading to several research questions that span a paragraph. Each candidate passage is an abstract from a scientific paper. The objective of this information retrieval task is to identify the abstract that most effectively meets the user’s needs in the query : I am seeking to comprehend the performance of the MAML algorithm in meta-learning when confronted with adversarial attacks aimed at contaminating its learned parameters. Initially, I require a method to swiftly generate examples of adversarial attacks. Subsequently, I am interested in investigating defense strategies that enable MAML to either identify adversarial examples or prevent learning from them. My current approach involves implementing some form of regularization to ensure that MAML is not disproportionately influenced by a handful of malicious data examples. Given that MAML can perform parameter updates in either its inner or outer loop, it is crucial for me to determine the optimal location to deploy these defense strategies, such as regularization. Ultimately, I aim to develop an end-to-end framework capable of automatically assessing the stability of MAML and other meta-learning algorithms when subjected to adversarial attacks.

positive:
As we seek to deploy machine learning models beyond virtual and controlled
domains, it is critical to analyze not only the accuracy or the fact that it
works most of the time, but if such a model is truly robust and reliable. This
paper studies strategies to implement adversary robustly trained algorithms
towards guaranteeing safety in machine learning algorithms. We provide a
taxonomy to classify adversarial attacks and defenses, formulate the Robust
Optimization problem in a min-max setting and divide it into 3 subcategories,
namely: Adversarial (re)Training, Regularization Approach, and Certified
Defenses. We survey the most recent and important results in adversarial
example generation, defense mechanisms with adversarial (re)Training as their
main defense against perturbations. We also survey mothods that add
regularization terms that change the behavior of the gradient, making it harder
for attackers to achieve their objective. Alternatively, we've surveyed methods
which formally derive certificates of robustness by exactly solving the
optimization problem or by approximations using upper or lower bounds. In
addition, we discuss the challenges faced by most of the recent algorithms
presenting future research perspectives.

positive:
Background: Machine learning-based security detection models have become
prevalent in modern malware and intrusion detection systems. However, previous
studies show that such models are susceptible to adversarial evasion attacks.
In this type of attack, inputs (i.e., adversarial examples) are specially
crafted by intelligent malicious adversaries, with the aim of being
misclassified by existing state-of-the-art models (e.g., deep neural networks).
Once the attackers can fool a classifier to think that a malicious input is
actually benign, they can render a machine learning-based malware or intrusion
detection system ineffective. Goal: To help security practitioners and
researchers build a more robust model against non-adaptive, white-box, and
non-targeted adversarial evasion attacks through the idea of an ensemble model.
Method: We propose an approach called Omni, the main idea of which is to
explore methods that create an ensemble of "unexpected models"; i.e., models
whose control hyperparameters have a large distance to the hyperparameters of
an adversary's target model, with which we then make an optimized weighted
ensemble prediction. Result: In studies with five types of adversarial evasion
attacks (FGSM, BIM, JSMA, DeepFooland Carlini-Wagner) on five security datasets
(NSL-KDD, CIC-IDS-2017, CSE-CIC-IDS2018, CICAnd-Mal2017, and the Contagio PDF
dataset), we show Omni is a promising approach as a defense strategy against
adversarial attacks when compared with other baseline treatments. Conclusion:
When employing ensemble defense against adversarial evasion attacks, we suggest
creating an ensemble with unexpected models that are distant from the
attacker's expected model (i.e., target model) through methods such as
hyperparameter optimization.

positive:
Deep neural networks (DNNs) are known to be prone to adversarial attacks, for
which many remedies are proposed. While adversarial training (AT) is regarded
as the most robust defense, it suffers from poor performance both on clean
examples and under other types of attacks, e.g. attacks with larger
perturbations. Meanwhile, regularizers that encourage uncertain outputs, such
as entropy maximization (EntM) and label smoothing (LS) can maintain accuracy
on clean examples and improve performance under weak attacks, yet their ability
to defend against strong attacks is still in doubt. In this paper, we revisit
uncertainty promotion regularizers, including EntM and LS, in the field of
adversarial learning. We show that EntM and LS alone provide robustness only
under small perturbations. Contrarily, we show that uncertainty promotion
regularizers complement AT in a principled manner, consistently improving
performance on both clean examples and under various attacks, especially
attacks with large perturbations. We further analyze how uncertainty promotion
regularizers enhance the performance of AT from the perspective of Jacobian
matrices $\nabla_X f(X;\theta)$, and find out that EntM effectively shrinks the
norm of Jacobian matrices and hence promotes robustness.

positive:
The security of Deep Reinforcement Learning (Deep RL) algorithms deployed in
real life applications are of a primary concern. In particular, the robustness
of RL agents in cyber-physical systems against adversarial attacks are
especially vital since the cost of a malevolent intrusions can be extremely
high. Studies have shown Deep Neural Networks (DNN), which forms the core
decision-making unit in most modern RL algorithms, are easily subjected to
adversarial attacks. Hence, it is imperative that RL agents deployed in
real-life applications have the capability to detect and mitigate adversarial
attacks in an online fashion. An example of such a framework is the
Meta-Learned Advantage Hierarchy (MLAH) agent that utilizes a meta-learning
framework to learn policies robustly online. Since the mechanism of this
framework are still not fully explored, we conducted multiple experiments to
better understand the framework's capabilities and limitations. Our results
shows that the MLAH agent exhibits interesting coping behaviors when subjected
to different adversarial attacks to maintain a nominal reward. Additionally,
the framework exhibits a hierarchical coping capability, based on the
adaptability of the Master policy and sub-policies themselves. From empirical
results, we also observed that as the interval of adversarial attacks increase,
the MLAH agent can maintain a higher distribution of rewards, though at the
cost of higher instabilities.

positive:
In this paper, we study the problem of how to defend classifiers against
adversarial attacks that fool the classifiers using subtly modified input data.
In contrast to previous works, here we focus on the white-box adversarial
defense where the attackers are granted full access to not only the classifiers
but also defenders to produce as strong attacks as possible. In such a context
we propose viewing a defender as a functional, a higher-order function that
takes functions as its argument to represent a function space, rather than
fixed functions conventionally. From this perspective, a defender should be
realized and optimized individually for each adversarial input. To this end, we
propose RIDE, an efficient and provably convergent self-supervised learning
algorithm for individual data estimation to protect the predictions from
adversarial attacks. We demonstrate the significant improvement of adversarial
defense performance on image recognition, eg, 98%, 76%, 43% test accuracy on
MNIST, CIFAR-10, and ImageNet datasets respectively under the state-of-the-art
BPDA attacker.

positive:
Recent works have shown that the input domain of any machine learning
classifier is bound to contain adversarial examples. Thus we can no longer hope
to immune classifiers against adversarial examples and instead can only aim to
achieve the following two defense goals: 1) making adversarial examples harder
to find, or 2) weakening their adversarial nature by pushing them further away
from correctly classified data points. Most if not all the previously suggested
defense mechanisms attend to just one of those two goals, and as such, could be
bypassed by adaptive attacks that take the defense mechanism into
consideration. In this work we suggest a novel defense mechanism that
simultaneously addresses both defense goals: We flatten the gradients of the
loss surface, making adversarial examples harder to find, using a novel
stochastic regularization term that explicitly decreases the sensitivity of
individual neurons to small input perturbations. In addition, we push the
decision boundary away from correctly classified inputs by leveraging Jacobian
regularization. We present a solid theoretical basis and an empirical testing
of our suggested approach, demonstrate its superiority over previously
suggested defense mechanisms, and show that it is effective against a wide
range of adaptive attacks.

positive:
While great progress has been made at making neural networks effective across
a wide range of visual tasks, most models are surprisingly vulnerable. This
frailness takes the form of small, carefully chosen perturbations of their
input, known as adversarial examples, which represent a security threat for
learned vision models in the wild -- a threat which should be responsibly
defended against in safety-critical applications of computer vision. In this
paper, we advocate for and experimentally investigate the use of a family of
logit regularization techniques as an adversarial defense, which can be used in
conjunction with other methods for creating adversarial robustness at little to
no marginal cost. We also demonstrate that much of the effectiveness of one
recent adversarial defense mechanism can in fact be attributed to logit
regularization, and show how to improve its defense against both white-box and
black-box attacks, in the process creating a stronger black-box attack against
PGD-based models. We validate our methods on three datasets and include results
on both gradient-free attacks and strong gradient-based iterative attacks with
as many as 1,000 steps.

positive:
The arms race between attacks and defenses for machine learning models has
come to a forefront in recent years, in both the security community and the
privacy community. However, one big limitation of previous research is that the
security domain and the privacy domain have typically been considered
separately. It is thus unclear whether the defense methods in one domain will
have any unexpected impact on the other domain.
  In this paper, we take a step towards resolving this limitation by combining
the two domains. In particular, we measure the success of membership inference
attacks against six state-of-the-art defense methods that mitigate the risk of
adversarial examples (i.e., evasion attacks). Membership inference attacks
determine whether or not an individual data record has been part of a model's
training set. The accuracy of such attacks reflects the information leakage of
training algorithms about individual members of the training set. Adversarial
defense methods against adversarial examples influence the model's decision
boundaries such that model predictions remain unchanged for a small area around
each input. However, this objective is optimized on training data. Thus,
individual data records in the training set have a significant influence on
robust models. This makes the models more vulnerable to inference attacks.
  To perform the membership inference attacks, we leverage the existing
inference methods that exploit model predictions. We also propose two new
inference methods that exploit structural properties of robust models on
adversarially perturbed data. Our experimental evaluation demonstrates that
compared with the natural training (undefended) approach, adversarial defense
methods can indeed increase the target model's risk against membership
inference attacks.

positive:
Adversarial attacks on deep learning models have compromised their
performance considerably. As remedies, a lot of defense methods were proposed,
which however, have been circumvented by newer attacking strategies. In the
midst of this ensuing arms race, the problem of robustness against adversarial
attacks still remains unsolved. This paper proposes a novel, simple yet
effective defense strategy where adversarial samples are relaxed onto the
underlying manifold of the (unknown) target class distribution. Specifically,
our algorithm drives off-manifold adversarial samples towards high density
regions of the data generating distribution of the target class by the
Metroplis-adjusted Langevin algorithm (MALA) with perceptual boundary taken
into account. Although the motivation is similar to projection methods, e.g.,
Defense-GAN, our algorithm, called MALA for DEfense (MALADE), is equipped with
significant dispersion - projection is distributed broadly, and therefore any
whitebox attack cannot accurately align the input so that the MALADE moves it
to a targeted untrained spot where the model predicts a wrong label. In our
experiments, MALADE exhibited state-of-the-art performance against various
elaborate attacking strategies.

positive:
The growing prospect of deep reinforcement learning (DRL) being used in
cyber-physical systems has raised concerns around safety and robustness of
autonomous agents. Recent work on generating adversarial attacks have shown
that it is computationally feasible for a bad actor to fool a DRL policy into
behaving sub optimally. Although certain adversarial attacks with specific
attack models have been addressed, most studies are only interested in off-line
optimization in the data space (e.g., example fitting, distillation). This
paper introduces a Meta-Learned Advantage Hierarchy (MLAH) framework that is
attack model-agnostic and more suited to reinforcement learning, via handling
the attacks in the decision space (as opposed to data space) and directly
mitigating learned bias introduced by the adversary. In MLAH, we learn separate
sub-policies (nominal and adversarial) in an online manner, as guided by a
supervisory master agent that detects the presence of the adversary by
leveraging the advantage function for the sub-policies. We demonstrate that the
proposed algorithm enables policy learning with significantly lower bias as
compared to the state-of-the-art policy learning approaches even in the
presence of heavy state information attacks. We present algorithm analysis and
simulation results using popular OpenAI Gym environments.

positive:
Adversarial examples are augmented data points generated by imperceptible
perturbation of input samples. They have recently drawn much attention with the
machine learning and data mining community. Being difficult to distinguish from
real examples, such adversarial examples could change the prediction of many of
the best learning models including the state-of-the-art deep learning models.
Recent attempts have been made to build robust models that take into account
adversarial examples. However, these methods can either lead to performance
drops or lack mathematical motivations. In this paper, we propose a unified
framework to build robust machine learning models against adversarial examples.
More specifically, using the unified framework, we develop a family of gradient
regularization methods that effectively penalize the gradient of loss function
w.r.t. inputs. Our proposed framework is appealing in that it offers a unified
view to deal with adversarial examples. It incorporates another
recently-proposed perturbation based approach as a special case. In addition,
we present some visual effects that reveals semantic meaning in those
perturbations, and thus support our regularization method and provide another
explanation for generalizability of adversarial examples. By applying this
technique to Maxout networks, we conduct a series of experiments and achieve
encouraging results on two benchmark datasets. In particular,we attain the best
accuracy on MNIST data (without data augmentation) and competitive performance
on CIFAR-10 data.

positive:
In this paper, we develop improved techniques for defending against
adversarial examples at scale. First, we implement the state of the art version
of adversarial training at unprecedented scale on ImageNet and investigate
whether it remains effective in this setting - an important open scientific
question (Athalye et al., 2018). Next, we introduce enhanced defenses using a
technique we call logit pairing, a method that encourages logits for pairs of
examples to be similar. When applied to clean examples and their adversarial
counterparts, logit pairing improves accuracy on adversarial examples over
vanilla adversarial training; we also find that logit pairing on clean examples
only is competitive with adversarial training in terms of accuracy on two
datasets. Finally, we show that adversarial logit pairing achieves the state of
the art defense on ImageNet against PGD white box attacks, with an accuracy
improvement from 1.5% to 27.9%. Adversarial logit pairing also successfully
damages the current state of the art defense against black box attacks on
ImageNet (Tramer et al., 2018), dropping its accuracy from 66.6% to 47.1%. With
this new accuracy drop, adversarial logit pairing ties with Tramer et al.(2018)
for the state of the art on black box attacks on ImageNet.

positive:
Though deep neural networks have achieved the state of the art performance in
visual classification, recent studies have shown that they are all vulnerable
to the attack of adversarial examples. In this paper, we develop improved
techniques for defending against adversarial examples. First, we propose an
enhanced defense technique denoted Attention and Adversarial Logit
Pairing(AT+ALP), which encourages both attention map and logit for the pairs of
examples to be similar. When being applied to clean examples and their
adversarial counterparts, AT+ALP improves accuracy on adversarial examples over
adversarial training. We show that AT+ALP can effectively increase the average
activations of adversarial examples in the key area and demonstrate that it
focuses on discriminate features to improve the robustness of the model.
Finally, we conduct extensive experiments using a wide range of datasets and
the experiment results show that our AT+ALP achieves the state of the art
defense performance. For example, on 17 Flower Category Database, under strong
200-iteration PGD gray-box and black-box attacks where prior art has 34% and
39% accuracy, our method achieves 50% and 51%. Compared with previous work, our
work is evaluated under highly challenging PGD attack: the maximum perturbation
$\epsilon \in \{0.25,0.5\}$ i.e. $L_\infty \in \{0.25,0.5\}$ with 10 to 200
attack iterations. To the best of our knowledge, such a strong attack has not
been previously explored on a wide range of datasets.

positive:
Deep neural networks are vulnerable to adversarial attacks. Recent studies
about adversarial robustness focus on the loss landscape in the parameter space
since it is related to optimization and generalization performance. These
studies conclude that the difficulty of adversarial training is caused by the
non-smoothness of the loss function: i.e., its gradient is not Lipschitz
continuous. However, this analysis ignores the dependence of adversarial
attacks on model parameters. Since adversarial attacks are optimized for
models, they should depend on the parameters. Considering this dependence, we
analyze the smoothness of the loss function of adversarial training using the
optimal attacks for the model parameter in more detail. We reveal that the
constraint of adversarial attacks is one cause of the non-smoothness and that
the smoothness depends on the types of the constraints. Specifically, the
$L_\infty$ constraint can cause non-smoothness more than the $L_2$ constraint.
Moreover, our analysis implies that if we flatten the loss function with
respect to input data, the Lipschitz constant of the gradient of adversarial
loss tends to increase. To address the non-smoothness, we show that EntropySGD
smoothens the non-smooth loss and improves the performance of adversarial
training.

positive:
Various forefront countermeasure methods for automatic speaker verification
(ASV) with considerable performance in anti-spoofing are proposed in the
ASVspoof 2019 challenge. However, previous work has shown that countermeasure
models are vulnerable to adversarial examples indistinguishable from natural
data. A good countermeasure model should not only be robust against spoofing
audio, including synthetic, converted, and replayed audios; but counteract
deliberately generated examples by malicious adversaries. In this work, we
introduce a passive defense method, spatial smoothing, and a proactive defense
method, adversarial training, to mitigate the vulnerability of ASV spoofing
countermeasure models against adversarial examples. This paper is among the
first to use defense methods to improve the robustness of ASV spoofing
countermeasure models under adversarial attacks. The experimental results show
that these two defense methods positively help spoofing countermeasure models
counter adversarial examples.

positive:
Meta-learning model can quickly adapt to new tasks using few-shot labeled
data. However, despite achieving good generalization on few-shot classification
tasks, it is still challenging to improve the adversarial robustness of the
meta-learning model in few-shot learning. Although adversarial training (AT)
methods such as Adversarial Query (AQ) can improve the adversarially robust
performance of meta-learning models, AT is still computationally expensive
training. On the other hand, meta-learning models trained with AT will drop
significant accuracy on the original clean images. This paper proposed a
meta-learning method on the adversarially robust neural network called
Long-term Cross Adversarial Training (LCAT). LCAT will update meta-learning
model parameters cross along the natural and adversarial sample distribution
direction with long-term to improve both adversarial and clean few-shot
classification accuracy. Due to cross-adversarial training, LCAT only needs
half of the adversarial training epoch than AQ, resulting in a low adversarial
training computation. Experiment results show that LCAT achieves superior
performance both on the clean and adversarial few-shot classification accuracy
than SOTA adversarial training methods for meta-learning models.

positive:
Meta-learning enables a model to learn from very limited data to undertake a
new task. In this paper, we study the general meta-learning with adversarial
samples. We present a meta-learning algorithm, ADML (ADversarial Meta-Learner),
which leverages clean and adversarial samples to optimize the initialization of
a learning model in an adversarial manner. ADML leads to the following
desirable properties: 1) it turns out to be very effective even in the cases
with only clean samples; 2) it is robust to adversarial samples, i.e., unlike
other meta-learning algorithms, it only leads to a minor performance
degradation when there are adversarial samples; 3) it sheds light on tackling
the cases with limited and even contaminated samples. It has been shown by
extensive experimental results that ADML consistently outperforms three
representative meta-learning algorithms in the cases involving adversarial
samples, on two widely-used image datasets, MiniImageNet and CIFAR100, in terms
of both accuracy and robustness.

positive:
This paper proposes a classification framework with a rejection option to
mitigate the performance deterioration caused by adversarial examples. While
recent machine learning algorithms achieve high prediction performance, they
are empirically vulnerable to adversarial examples, which are slightly
perturbed data samples that are wrongly classified. In real-world applications,
adversarial attacks using such adversarial examples could cause serious
problems. To this end, various methods are proposed to obtain a classifier that
is robust against adversarial examples. Adversarial training is one of them,
which trains a classifier to minimize the worst-case loss under adversarial
attacks. In this paper, in order to acquire a more reliable classifier against
adversarial attacks, we propose the method of Adversarial Training with a
Rejection Option (ATRO). Applying the adversarial training objective to both a
classifier and a rejection function simultaneously, classifiers trained by ATRO
can choose to abstain from classification when it has insufficient confidence
to classify a test data point. We examine the feasibility of the framework
using the surrogate maximum hinge loss and establish a generalization bound for
linear models. Furthermore, we empirically confirmed the effectiveness of ATRO
using various models and real-world datasets.

positive:
Ideally, what confuses neural network should be confusing to humans. However,
recent experiments have shown that small, imperceptible perturbations can
change the network prediction. To address this gap in perception, we propose a
novel approach for learning robust classifier. Our main idea is: adversarial
examples for the robust classifier should be indistinguishable from the regular
data of the adversarial target. We formulate a problem of learning robust
classifier in the framework of Generative Adversarial Networks (GAN), where the
adversarial attack on classifier acts as a generator, and the critic network
learns to distinguish between regular and adversarial images. The classifier
cost is augmented with the objective that its adversarial examples should
confuse the adversary critic. To improve the stability of the adversarial
mapping, we introduce adversarial cycle-consistency constraint which ensures
that the adversarial mapping of the adversarial examples is close to the
original. In the experiments, we show the effectiveness of our defense. Our
method surpasses in terms of robustness networks trained with adversarial
training. Additionally, we verify in the experiments with human annotators on
MTurk that adversarial examples are indeed visually confusing. Codes for the
project are available at https://github.com/aam-at/adversary_critic.

positive:
Machine Learning (ML) algorithms are vulnerable to poisoning attacks, where a
fraction of the training data is manipulated to deliberately degrade the
algorithms' performance. Optimal poisoning attacks, which can be formulated as
bilevel optimisation problems, help to assess the robustness of learning
algorithms in worst-case scenarios. However, current attacks against algorithms
with hyperparameters typically assume that these hyperparameters remain
constant ignoring the effect the attack has on them. We show that this approach
leads to an overly pessimistic view of the robustness of the algorithms. We
propose a novel optimal attack formulation that considers the effect of the
attack on the hyperparameters by modelling the attack as a multiobjective
bilevel optimisation problem. We apply this novel attack formulation to ML
classifiers using $L_2$ regularisation and show that, in contrast to results
previously reported, $L_2$ regularisation enhances the stability of the
learning algorithms and helps to mitigate the attacks. Our empirical evaluation
on different datasets confirms the limitations of previous strategies,
evidences the benefits of using $L_2$ regularisation to dampen the effect of
poisoning attacks and shows how the regularisation hyperparameter increases
with the fraction of poisoning points.

positive:
Convolutional Neural Networks and Deep Learning classification systems in
general have been shown to be vulnerable to attack by specially crafted data
samples that appear to belong to one class but are instead classified as
another, commonly known as adversarial examples. A variety of attack strategies
have been proposed to craft these samples; however, there is no standard model
that is used to compare the success of each type of attack. Furthermore, there
is no literature currently available that evaluates how common hyperparameters
and optimization strategies may impact a model's ability to resist these
samples. This research bridges that lack of awareness and provides a means for
the selection of training and model parameters in future research on evasion
attacks against convolutional neural networks. The findings of this work
indicate that the selection of model hyperparameters does impact the ability of
a model to resist attack, although they alone cannot prevent the existence of
adversarial examples.

positive:
A range of defense methods have been proposed to improve the robustness of
neural networks on adversarial examples, among which provable defense methods
have been demonstrated to be effective to train neural networks that are
certifiably robust to the attacker. However, most of these provable defense
methods treat all examples equally during training process, which ignore the
inconsistent constraint of certified robustness between correctly classified
(natural) and misclassified examples. In this paper, we explore this
inconsistency caused by misclassified examples and add a novel consistency
regularization term to make better use of the misclassified examples.
Specifically, we identified that the certified robustness of network can be
significantly improved if the constraint of certified robustness on
misclassified examples and correctly classified examples is consistent.
Motivated by this discovery, we design a new defense regularization term called
Misclassification Aware Adversarial Regularization (MAAR), which constrains the
output probability distributions of all examples in the certified region of the
misclassified example. Experimental results show that our proposed MAAR
achieves the best certified robustness and comparable accuracy on CIFAR-10 and
MNIST datasets in comparison with several state-of-the-art methods.

negative:
Machine learning classifiers are known to be vulnerable to inputs maliciously
constructed by adversaries to force misclassification. Such adversarial
examples have been extensively studied in the context of computer vision
applications. In this work, we show adversarial attacks are also effective when
targeting neural network policies in reinforcement learning. Specifically, we
show existing adversarial example crafting techniques can be used to
significantly degrade test-time performance of trained policies. Our threat
model considers adversaries capable of introducing small perturbations to the
raw input of the policy. We characterize the degree of vulnerability across
tasks and training algorithms, for a subclass of adversarial-example attacks in
white-box and black-box settings. Regardless of the learned task or training
algorithm, we observe a significant drop in performance, even with small
adversarial perturbations that do not interfere with human perception. Videos
are available at http://rll.berkeley.edu/adversarial.

negative:
High-performance anti-spoofing models for automatic speaker verification
(ASV), have been widely used to protect ASV by identifying and filtering
spoofing audio that is deliberately generated by text-to-speech, voice
conversion, audio replay, etc. However, it has been shown that high-performance
anti-spoofing models are vulnerable to adversarial attacks. Adversarial
attacks, that are indistinguishable from original data but result in the
incorrect predictions, are dangerous for anti-spoofing models and not in
dispute we should detect them at any cost. To explore this issue, we proposed
to employ Mockingjay, a self-supervised learning based model, to protect
anti-spoofing models against adversarial attacks in the black-box scenario.
Self-supervised learning models are effective in improving downstream task
performance like phone classification or ASR. However, their effect in defense
for adversarial attacks has not been explored yet. In this work, we explore the
robustness of self-supervised learned high-level representations by using them
in the defense against adversarial attacks. A layerwise noise to signal ratio
(LNSR) is proposed to quantize and measure the effectiveness of deep models in
countering adversarial noise. Experimental results on the ASVspoof 2019 dataset
demonstrate that high-level representations extracted by Mockingjay can prevent
the transferability of adversarial examples, and successfully counter black-box
attacks.

negative:
Recent analysis of deep neural networks has revealed their vulnerability to
carefully structured adversarial examples. Many effective algorithms exist to
craft these adversarial examples, but performant defenses seem to be far away.
In this work, we explore the use of edge-aware bilateral filtering as a
projection back to the space of natural images. We show that bilateral
filtering is an effective defense in multiple attack settings, where the
strength of the adversary gradually increases. In the case of an adversary who
has no knowledge of the defense, bilateral filtering can remove more than 90%
of adversarial examples from a variety of different attacks. To evaluate
against an adversary with complete knowledge of our defense, we adapt the
bilateral filter as a trainable layer in a neural network and show that adding
this layer makes ImageNet images significantly more robust to attacks. When
trained under a framework of adversarial training, we show that the resulting
model is hard to fool with even the best attack methods.

negative:
We explore adversarial robustness in the setting in which it is acceptable
for a classifier to abstain---that is, output no class---on adversarial
examples. Adversarial examples are small perturbations of normal inputs to a
classifier that cause the classifier to give incorrect output; they present
security and safety challenges for machine learning systems. In many
safety-critical applications, it is less costly for a classifier to abstain on
adversarial examples than to give incorrect output for them. We first introduce
a novel objective function for adversarial robustness with an abstain option
which characterizes an explicit tradeoff between robustness and accuracy. We
then present a simple baseline in which an adversarially-trained classifier
abstains on all inputs within a certain distance of the decision boundary,
which we theoretically and experimentally evaluate. Finally, we propose
Combined Abstention Robustness Learning (CARL), a method for jointly learning a
classifier and the region of the input space on which it should abstain. We
explore different variations of the PGD and DeepFool adversarial attacks on
CARL in the abstain setting. Evaluating against these attacks, we demonstrate
that training with CARL results in a more accurate, robust, and efficient
classifier than the baseline.

negative:
Recently, the field of adversarial machine learning has been garnering
attention by showing that state-of-the-art deep neural networks are vulnerable
to adversarial examples, stemming from small perturbations being added to the
input image. Adversarial examples are generated by a malicious adversary by
obtaining access to the model parameters, such as gradient information, to
alter the input or by attacking a substitute model and transferring those
malicious examples over to attack the victim model. Specifically, one of these
attack algorithms, Robust Physical Perturbations ($RP_2$), generates
adversarial images of stop signs with black and white stickers to achieve high
targeted misclassification rates against standard-architecture traffic sign
classifiers. In this paper, we propose BlurNet, a defense against the $RP_2$
attack. First, we motivate the defense with a frequency analysis of the first
layer feature maps of the network on the LISA dataset, which shows that high
frequency noise is introduced into the input image by the $RP_2$ algorithm. To
remove the high frequency noise, we introduce a depthwise convolution layer of
standard blur kernels after the first layer. We perform a blackbox transfer
attack to show that low-pass filtering the feature maps is more beneficial than
filtering the input. We then present various regularization schemes to
incorporate this low-pass filtering behavior into the training regime of the
network and perform white-box attacks. We conclude with an adaptive attack
evaluation to show that the success rate of the attack drops from 90\% to 20\%
with total variation regularization, one of the proposed defenses.

negative:
Deep Neural Networks (DNNs) have recently achieved great success in many
tasks, which encourages DNNs to be widely used as a machine learning service in
model sharing scenarios. However, attackers can easily generate adversarial
examples with a small perturbation to fool the DNN models to predict wrong
labels. To improve the robustness of shared DNN models against adversarial
attacks, we propose a novel method called Latent Adversarial Defence (LAD). The
proposed LAD method improves the robustness of a DNN model through adversarial
training on generated adversarial examples. Different from popular attack
methods which are carried in the input space and only generate adversarial
examples of repeating patterns, LAD generates myriad of adversarial examples
through adding perturbations to latent features along the normal of the
decision boundary which is constructed by an SVM with an attention mechanism.
Once adversarial examples are generated, we adversarially train the model
through augmenting the training data with generated adversarial examples.
Extensive experiments on the MNIST, SVHN, and CelebA dataset demonstrate the
effectiveness of our model in defending against different types of adversarial
attacks.

negative:
In image classification of deep learning, adversarial examples where inputs
intended to add small magnitude perturbations may mislead deep neural networks
(DNNs) to incorrect results, which means DNNs are vulnerable to them. Different
attack and defense strategies have been proposed to better research the
mechanism of deep learning. However, those research in these networks are only
for one aspect, either an attack or a defense, not considering that attacks and
defenses should be interdependent and mutually reinforcing, just like the
relationship between spears and shields. In this paper, we propose
Cycle-Consistent Adversarial GAN (CycleAdvGAN) to generate adversarial
examples, which can learn and approximate the distribution of original
instances and adversarial examples. For CycleAdvGAN, once the Generator and are
trained, can generate adversarial perturbations efficiently for any instance,
so as to make DNNs predict wrong, and recovery adversarial examples to clean
instances, so as to make DNNs predict correct. We apply CycleAdvGAN under
semi-white box and black-box settings on two public datasets MNIST and CIFAR10.
Using the extensive experiments, we show that our method has achieved the
state-of-the-art adversarial attack method and also efficiently improve the
defense ability, which make the integration of adversarial attack and defense
come true. In additional, it has improved attack effect only trained on the
adversarial dataset generated by any kind of adversarial attack.

negative:
Learning-based pattern classifiers, including deep networks, have shown
impressive performance in several application domains, ranging from computer
vision to cybersecurity. However, it has also been shown that adversarial input
perturbations carefully crafted either at training or at test time can easily
subvert their predictions. The vulnerability of machine learning to such wild
patterns (also referred to as adversarial examples), along with the design of
suitable countermeasures, have been investigated in the research field of
adversarial machine learning. In this work, we provide a thorough overview of
the evolution of this research area over the last ten years and beyond,
starting from pioneering, earlier work on the security of non-deep learning
algorithms up to more recent work aimed to understand the security properties
of deep learning algorithms, in the context of computer vision and
cybersecurity tasks. We report interesting connections between these
apparently-different lines of work, highlighting common misconceptions related
to the security evaluation of machine-learning algorithms. We review the main
threat models and attacks defined to this end, and discuss the main limitations
of current work, along with the corresponding future challenges towards the
design of more secure learning algorithms.

negative:
Meta-learning leverages related source tasks to learn an initialization that
can be quickly fine-tuned to a target task with limited labeled examples.
However, many popular meta-learning algorithms, such as model-agnostic
meta-learning (MAML), only assume access to the target samples for fine-tuning.
In this work, we provide a general framework for meta-learning based on
weighting the loss of different source tasks, where the weights are allowed to
depend on the target samples. In this general setting, we provide upper bounds
on the distance of the weighted empirical risk of the source tasks and expected
target risk in terms of an integral probability metric (IPM) and Rademacher
complexity, which apply to a number of meta-learning settings including MAML
and a weighted MAML variant. We then develop a learning algorithm based on
minimizing the error bound with respect to an empirical IPM, including a
weighted MAML algorithm, $\alpha$-MAML. Finally, we demonstrate empirically on
several regression problems that our weighted meta-learning algorithm is able
to find better initializations than uniformly-weighted meta-learning
algorithms, such as MAML.

negative:
Adversarial examples are maliciously tweaked images that can easily fool
machine learning techniques, such as neural networks, but they are normally not
visually distinguishable for human beings. One of the main approaches to solve
this problem is to retrain the networks using those adversarial examples,
namely adversarial training. However, standard adversarial training might not
actually change the decision boundaries but cause the problem of gradient
masking, resulting in a weaker ability to generate adversarial examples.
Therefore, it cannot alleviate the problem of black-box attacks, where
adversarial examples generated from other networks can transfer to the targeted
one. In order to reduce the problem of black-box attacks, we propose a novel
method that allows two networks to learn from each others' adversarial examples
and become resilient to black-box attacks. We also combine this method with a
simple domain adaptation to further improve the performance.

negative:
Adversarial training (AT) has been demonstrated as one of the most promising
defense methods against various adversarial attacks. To our knowledge, existing
AT-based methods usually train with the locally most adversarial perturbed
points and treat all the perturbed points equally, which may lead to
considerably weaker adversarial robust generalization on test data. In this
work, we introduce a new adversarial training framework that considers the
diversity as well as characteristics of the perturbed points in the vicinity of
benign samples. To realize the framework, we propose a Regional Adversarial
Training (RAT) defense method that first utilizes the attack path generated by
the typical iterative attack method of projected gradient descent (PGD), and
constructs an adversarial region based on the attack path. Then, RAT samples
diverse perturbed training points efficiently inside this region, and utilizes
a distance-aware label smoothing mechanism to capture our intuition that
perturbed points at different locations should have different impact on the
model performance. Extensive experiments on several benchmark datasets show
that RAT consistently makes significant improvement on standard adversarial
training (SAT), and exhibits better robust generalization.

negative:
Machine learning (ML) models, e.g., deep neural networks (DNNs), are
vulnerable to adversarial examples: malicious inputs modified to yield
erroneous model outputs, while appearing unmodified to human observers.
Potential attacks include having malicious content like malware identified as
legitimate or controlling vehicle behavior. Yet, all existing adversarial
example attacks require knowledge of either the model internals or its training
data. We introduce the first practical demonstration of an attacker controlling
a remotely hosted DNN with no such knowledge. Indeed, the only capability of
our black-box adversary is to observe labels given by the DNN to chosen inputs.
Our attack strategy consists in training a local model to substitute for the
target DNN, using inputs synthetically generated by an adversary and labeled by
the target DNN. We use the local substitute to craft adversarial examples, and
find that they are misclassified by the targeted DNN. To perform a real-world
and properly-blinded evaluation, we attack a DNN hosted by MetaMind, an online
deep learning API. We find that their DNN misclassifies 84.24% of the
adversarial examples crafted with our substitute. We demonstrate the general
applicability of our strategy to many ML techniques by conducting the same
attack against models hosted by Amazon and Google, using logistic regression
substitutes. They yield adversarial examples misclassified by Amazon and Google
at rates of 96.19% and 88.94%. We also find that this black-box attack strategy
is capable of evading defense strategies previously found to make adversarial
example crafting harder.

negative:
Model-agnostic meta-learning (MAML) is a popular method for few-shot learning
but assumes that we have access to the meta-training set. In practice, training
on the meta-training set may not always be an option due to data privacy
concerns, intellectual property issues, or merely lack of computing resources.
In this paper, we consider the novel problem of repurposing pretrained MAML
checkpoints to solve new few-shot classification tasks. Because of the
potential distribution mismatch, the original MAML steps may no longer be
optimal. Therefore we propose an alternative meta-testing procedure and combine
MAML gradient steps with adversarial training and uncertainty-based stepsize
adaptation. Our method outperforms "vanilla" MAML on same-domain and
cross-domains benchmarks using both SGD and Adam optimizers and shows improved
robustness to the choice of base stepsize.

negative:
Model Agnostic Meta-Learning (MAML) has emerged as a standard framework for
meta-learning, where a meta-model is learned with the ability of fast adapting
to new tasks. However, as a double-looped optimization problem, MAML needs to
differentiate through the whole inner-loop optimization path for every
outer-loop training step, which may lead to both computational inefficiency and
sub-optimal solutions. In this paper, we generalize MAML to allow meta-learning
to be defined in function spaces, and propose the first meta-learning paradigm
in the Reproducing Kernel Hilbert Space (RKHS) induced by the meta-model's
Neural Tangent Kernel (NTK). Within this paradigm, we introduce two
meta-learning algorithms in the RKHS, which no longer need a sub-optimal
iterative inner-loop adaptation as in the MAML framework. We achieve this goal
by 1) replacing the adaptation with a fast-adaptive regularizer in the RKHS;
and 2) solving the adaptation analytically based on the NTK theory. Extensive
experimental studies demonstrate advantages of our paradigm in both efficiency
and quality of solutions compared to related meta-learning algorithms. Another
interesting feature of our proposed methods is that they are demonstrated to be
more robust to adversarial attacks and out-of-distribution adaptation than
popular baselines, as demonstrated in our experiments.

negative:
Adversarial examples are intentionally crafted data with the purpose of
deceiving neural networks into misclassification. When we talk about strategies
to create such examples, we usually refer to perturbation-based methods that
fabricate adversarial examples by applying invisible perturbations onto normal
data. The resulting data reserve their visual appearance to human observers,
yet can be totally unrecognizable to DNN models, which in turn leads to
completely misleading predictions. In this paper, however, we consider crafting
adversarial examples from existing data as a limitation to example diversity.
We propose a non-perturbation-based framework that generates native adversarial
examples from class-conditional generative adversarial networks.As such, the
generated data will not resemble any existing data and thus expand example
diversity, raising the difficulty in adversarial defense. We then extend this
framework to pre-trained conditional GANs, in which we turn an existing
generator into an "adversarial-example generator". We conduct experiments on
our approach for MNIST and CIFAR10 datasets and have satisfactory results,
showing that this approach can be a potential alternative to previous attack
strategies.

negative:
In this paper, we study the generalization properties of Model-Agnostic
Meta-Learning (MAML) algorithms for supervised learning problems. We focus on
the setting in which we train the MAML model over $m$ tasks, each with $n$ data
points, and characterize its generalization error from two points of view:
First, we assume the new task at test time is one of the training tasks, and we
show that, for strongly convex objective functions, the expected excess
population loss is bounded by ${\mathcal{O}}(1/mn)$. Second, we consider the
MAML algorithm's generalization to an unseen task and show that the resulting
generalization error depends on the total variation distance between the
underlying distributions of the new task and the tasks observed during the
training process. Our proof techniques rely on the connections between
algorithmic stability and generalization bounds of algorithms. In particular,
we propose a new definition of stability for meta-learning algorithms, which
allows us to capture the role of both the number of tasks $m$ and number of
samples per task $n$ on the generalization error of MAML.

negative:
The vulnerability of deep neural networks to adversarial examples has
motivated an increasing number of defense strategies for promoting model
robustness. However, the progress is usually hampered by insufficient
robustness evaluations. As the de facto standard to evaluate adversarial
robustness, adversarial attacks typically solve an optimization problem of
crafting adversarial examples with an iterative process. In this work, we
propose a Model-Agnostic Meta-Attack (MAMA) approach to discover stronger
attack algorithms automatically. Our method learns the optimizer in adversarial
attacks parameterized by a recurrent neural network, which is trained over a
class of data samples and defenses to produce effective update directions
during adversarial example generation. Furthermore, we develop a model-agnostic
training algorithm to improve the generalization ability of the learned
optimizer when attacking unseen defenses. Our approach can be flexibly
incorporated with various attacks and consistently improves the performance
with little extra computational cost. Extensive experiments demonstrate the
effectiveness of the learned attacks by MAMA compared to the state-of-the-art
attacks on different defenses, leading to a more reliable evaluation of
adversarial robustness.

negative:
Deep Learning algorithms have achieved the state-of-the-art performance for
Image Classification and have been used even in security-critical applications,
such as biometric recognition systems and self-driving cars. However, recent
works have shown those algorithms, which can even surpass the human
capabilities, are vulnerable to adversarial examples. In Computer Vision,
adversarial examples are images containing subtle perturbations generated by
malicious optimization algorithms in order to fool classifiers. As an attempt
to mitigate these vulnerabilities, numerous countermeasures have been
constantly proposed in literature. Nevertheless, devising an efficient defense
mechanism has proven to be a difficult task, since many approaches have already
shown to be ineffective to adaptive attackers. Thus, this self-containing paper
aims to provide all readerships with a review of the latest research progress
on Adversarial Machine Learning in Image Classification, however with a
defender's perspective. Here, novel taxonomies for categorizing adversarial
attacks and defenses are introduced and discussions about the existence of
adversarial examples are provided. Further, in contrast to exisiting surveys,
it is also given relevant guidance that should be taken into consideration by
researchers when devising and evaluating defenses. Finally, based on the
reviewed literature, it is discussed some promising paths for future research.

negative:
The fact that deep neural networks are susceptible to crafted perturbations
severely impacts the use of deep learning in certain domains of application.
Among many developed defense models against such attacks, adversarial training
emerges as the most successful method that consistently resists a wide range of
attacks. In this work, based on an observation from a previous study that the
representations of a clean data example and its adversarial examples become
more divergent in higher layers of a deep neural net, we propose the Adversary
Divergence Reduction Network which enforces local/global compactness and the
clustering assumption over an intermediate layer of a deep neural network. We
conduct comprehensive experiments to understand the isolating behavior of each
component (i.e., local/global compactness and the clustering assumption) and
compare our proposed model with state-of-the-art adversarial training methods.
The experimental results demonstrate that augmenting adversarial training with
our proposed components can further improve the robustness of the network,
leading to higher unperturbed and adversarial predictive performances.

negative:
Nowadays, Deep Neural Networks (DNNs) report state-of-the-art results in many
machine learning areas, including intrusion detection. Nevertheless, recent
studies in computer vision have shown that DNNs can be vulnerable to
adversarial attacks that are capable of deceiving them into misclassification
by injecting specially crafted data. In security-critical areas, such attacks
can cause serious damage; therefore, in this paper, we examine the effect of
adversarial attacks on deep learning-based intrusion detection. In addition, we
investigate the effectiveness of adversarial training as a defense against such
attacks. Experimental results show that with sufficient distortion, adversarial
examples are able to mislead the detector and that the use of adversarial
training can improve the robustness of intrusion detection.

negative:
Adversarial attacks by generating examples which are almost indistinguishable
from natural examples, pose a serious threat to learning models. Defending
against adversarial attacks is a critical element for a reliable learning
system. Support vector machine (SVM) is a classical yet still important
learning algorithm even in the current deep learning era. Although a wide range
of researches have been done in recent years to improve the adversarial
robustness of learning models, but most of them are limited to deep neural
networks (DNNs) and the work for kernel SVM is still vacant. In this paper, we
aim at kernel SVM and propose adv-SVM to improve its adversarial robustness via
adversarial training, which has been demonstrated to be the most promising
defense techniques. To the best of our knowledge, this is the first work that
devotes to the fast and scalable adversarial training of kernel SVM.
Specifically, we first build connection of perturbations of samples between
original and kernel spaces, and then give a reduced and equivalent formulation
of adversarial training of kernel SVM based on the connection. Next, doubly
stochastic gradients (DSG) based on two unbiased stochastic approximations
(i.e., one is on training points and another is on random features) are applied
to update the solution of our objective function. Finally, we prove that our
algorithm optimized by DSG converges to the optimal solution at the rate of
O(1/t) under the constant and diminishing stepsizes. Comprehensive experimental
results show that our adversarial training algorithm enjoys robustness against
various attacks and meanwhile has the similar efficiency and scalability with
classical DSG algorithm.

negative:
Delusive attacks aim to substantially deteriorate the test accuracy of the
learning model by slightly perturbing the features of correctly labeled
training examples. By formalizing this malicious attack as finding the
worst-case training data within a specific $\infty$-Wasserstein ball, we show
that minimizing adversarial risk on the perturbed data is equivalent to
optimizing an upper bound of natural risk on the original data. This implies
that adversarial training can serve as a principled defense against delusive
attacks. Thus, the test accuracy decreased by delusive attacks can be largely
recovered by adversarial training. To further understand the internal mechanism
of the defense, we disclose that adversarial training can resist the delusive
perturbations by preventing the learner from overly relying on non-robust
features in a natural setting. Finally, we complement our theoretical findings
with a set of experiments on popular benchmark datasets, which show that the
defense withstands six different practical attacks. Both theoretical and
empirical results vote for adversarial training when confronted with delusive
adversaries.

negative:
Robustness to adversarial examples of machine learning models remains an open
topic of research. Attacks often succeed by repeatedly probing a fixed target
model with adversarial examples purposely crafted to fool it. In this paper, we
introduce Morphence, an approach that shifts the defense landscape by making a
model a moving target against adversarial examples. By regularly moving the
decision function of a model, Morphence makes it significantly challenging for
repeated or correlated attacks to succeed. Morphence deploys a pool of models
generated from a base model in a manner that introduces sufficient randomness
when it responds to prediction queries. To ensure repeated or correlated
attacks fail, the deployed pool of models automatically expires after a query
budget is reached and the model pool is seamlessly replaced by a new model pool
generated in advance. We evaluate Morphence on two benchmark image
classification datasets (MNIST and CIFAR10) against five reference attacks (2
white-box and 3 black-box). In all cases, Morphence consistently outperforms
the thus-far effective defense, adversarial training, even in the face of
strong white-box attacks, while preserving accuracy on clean data.

negative:
Data sets for fairness relevant tasks can lack examples or be biased
according to a specific label in a sensitive attribute. We demonstrate the
usefulness of weight based meta-learning approaches in such situations. For
models that can be trained through gradient descent, we demonstrate that there
are some parameter configurations that allow models to be optimized from a few
number of gradient steps and with minimal data which are both fair and
accurate. To learn such weight sets, we adapt the popular MAML algorithm to
Fair-MAML by the inclusion of a fairness regularization term. In practice,
Fair-MAML allows practitioners to train fair machine learning models from only
a few examples when data from related tasks is available. We empirically
exhibit the value of this technique by comparing to relevant baselines.

negative:
The burgeoning success of deep learning has raised the security and privacy
concerns as more and more tasks are accompanied with sensitive data.
Adversarial attacks in deep learning have emerged as one of the dominating
security threat to a range of mission-critical deep learning systems and
applications. This paper takes a holistic and principled approach to perform
statistical characterization of adversarial examples in deep learning. We
provide a general formulation of adversarial examples and elaborate on the
basic principle for adversarial attack algorithm design. We introduce easy and
hard categorization of adversarial attacks to analyze the effectiveness of
adversarial examples in terms of attack success rate, degree of change in
adversarial perturbation, average entropy of prediction qualities, and fraction
of adversarial examples that lead to successful attacks. We conduct extensive
experimental study on adversarial behavior in easy and hard attacks under deep
learning models with different hyperparameters and different deep learning
frameworks. We show that the same adversarial attack behaves differently under
different hyperparameters and across different frameworks due to the different
features learned under different deep learning model training process. Our
statistical characterization with strong empirical evidence provides a
transformative enlightenment on mitigation strategies towards effective
countermeasures against present and future adversarial attacks.

negative:
Deep neural networks (DNN) have achieved unprecedented success in numerous
machine learning tasks in various domains. However, the existence of
adversarial examples has raised concerns about applying deep learning to
safety-critical applications. As a result, we have witnessed increasing
interests in studying attack and defense mechanisms for DNN models on different
data types, such as images, graphs and text. Thus, it is necessary to provide a
systematic and comprehensive overview of the main threats of attacks and the
success of corresponding countermeasures. In this survey, we review the state
of the art algorithms for generating adversarial examples and the
countermeasures against adversarial examples, for the three popular data types,
i.e., images, graphs and text.

negative:
Meta learning algorithms have been widely applied in many tasks for efficient
learning, such as few-shot image classification and fast reinforcement
learning. During meta training, the meta learner develops a common learning
strategy, or experience, from a variety of learning tasks. Therefore, during
meta test, the meta learner can use the learned strategy to quickly adapt to
new tasks even with a few training samples. However, there is still a dark side
about meta learning in terms of reliability and robustness. In particular, is
meta learning vulnerable to adversarial attacks? In other words, would a
well-trained meta learner utilize its learned experience to build wrong or
likely useless knowledge, if an adversary unnoticeably manipulates the given
training set? Without the understanding of this problem, it is extremely risky
to apply meta learning in safety-critical applications. Thus, in this paper, we
perform the initial study about adversarial attacks on meta learning under the
few-shot classification problem. In particular, we formally define key elements
of adversarial attacks unique to meta learning and propose the first attacking
algorithm against meta learning under various settings. We evaluate the
effectiveness of the proposed attacking strategy as well as the robustness of
several representative meta learning algorithms. Experimental results
demonstrate that the proposed attacking strategy can easily break the meta
learner and meta learning is vulnerable to adversarial attacks. The
implementation of the proposed framework will be released upon the acceptance
of this paper.

negative:
Model-Agnostic Meta-Learning (MAML) and its variants have achieved success in
meta-learning tasks on many datasets and settings. On the other hand, we have
just started to understand and analyze how they are able to adapt fast to new
tasks. For example, one popular hypothesis is that the algorithms learn good
representations for transfer, as in multi-task learning. In this work, we
contribute by providing a series of empirical and theoretical studies, and
discover several interesting yet previously unknown properties of the
algorithm. We find MAML adapts better with a deep architecture even if the
tasks need only a shallow one (and thus, no representation learning is needed).
While echoing previous findings by others that the bottom layers in deep
architectures enable representation learning, we also find that upper layers
enable fast adaptation by being meta-learned to perform adaptive gradient
update when generalizing to new tasks. Motivated by these findings, we study
several meta-optimization approaches and propose a new one for learning to
optimize adaptively. Those approaches attain stronger performance in
meta-learning both shallower and deeper architectures than MAML.

negative:
In few-shot learning scenarios, the challenge is to generalize and perform
well on new unseen examples when only very few labeled examples are available
for each task. Model-agnostic meta-learning (MAML) has gained the popularity as
one of the representative few-shot learning methods for its flexibility and
applicability to diverse problems. However, MAML and its variants often resort
to a simple loss function without any auxiliary loss function or regularization
terms that can help achieve better generalization. The problem lies in that
each application and task may require different auxiliary loss function,
especially when tasks are diverse and distinct. Instead of attempting to
hand-design an auxiliary loss function for each application and task, we
introduce a new meta-learning framework with a loss function that adapts to
each task. Our proposed framework, named Meta-Learning with Task-Adaptive Loss
Function (MeTAL), demonstrates the effectiveness and the flexibility across
various domains, such as few-shot classification and few-shot regression.

negative:
Adversarial examples are perturbed inputs designed to fool machine learning
models. Most recent works on adversarial examples for image classification
focus on directly modifying pixels with minor perturbations. A common
requirement in all these works is that the malicious perturbations should be
small enough (measured by an L_p norm for some p) so that they are
imperceptible to humans. However, small perturbations can be unnecessarily
restrictive and limit the diversity of adversarial examples generated. Further,
an L_p norm based distance metric ignores important structure patterns hidden
in images that are important to human perception. Consequently, even the minor
perturbation introduced in recent works often makes the adversarial examples
less natural to humans. More importantly, they often do not transfer well and
are therefore less effective when attacking black-box models especially for
those protected by a defense mechanism. In this paper, we propose a
structure-preserving transformation (SPT) for generating natural and diverse
adversarial examples with extremely high transferability. The key idea of our
approach is to allow perceptible deviation in adversarial examples while
keeping structure patterns that are central to a human classifier. Empirical
results on the MNIST and the fashion-MNIST datasets show that adversarial
examples generated by our approach can easily bypass strong adversarial
training. Further, they transfer well to other target models with no loss or
little loss of successful attack rate.

negative:
Recent years have witnessed the deployment of adversarial attacks to evaluate
the robustness of Neural Networks. Past work in this field has relied on
traditional optimization algorithms that ignore the inherent structure of the
problem and data, or generative methods that rely purely on learning and often
fail to generate adversarial examples where they are hard to find. To alleviate
these deficiencies, we propose a novel attack based on a graph neural network
(GNN) that takes advantage of the strengths of both approaches; we call it
AdvGNN. Our GNN architecture closely resembles the network we wish to attack.
During inference, we perform forward-backward passes through the GNN layers to
guide an iterative procedure towards adversarial examples. During training, its
parameters are estimated via a loss function that encourages the efficient
computation of adversarial examples over a time horizon. We show that our
method beats state-of-the-art adversarial attacks, including PGD-attack,
MI-FGSM, and Carlini and Wagner attack, reducing the time required to generate
adversarial examples with small perturbation norms by over 65\%. Moreover,
AdvGNN achieves good generalization performance on unseen networks. Finally, we
provide a new challenging dataset specifically designed to allow for a more
illustrative comparison of adversarial attacks.

negative:
There is a growing interest in the learning-to-learn paradigm, also known as
meta-learning, where models infer on new tasks using a few training examples.
Recently, meta-learning based methods have been widely used in few-shot
classification, regression, reinforcement learning, and domain adaptation. The
model-agnostic meta-learning (MAML) algorithm is a well-known algorithm that
obtains model parameter initialization at meta-training phase. In the meta-test
phase, this initialization is rapidly adapted to new tasks by using gradient
descent. However, meta-learning models are prone to overfitting since there are
insufficient training tasks resulting in over-parameterized models with poor
generalization performance for unseen tasks. In this paper, we propose a
Bayesian neural network based MAML algorithm, which we refer to as the B-SMALL
algorithm. The proposed framework incorporates a sparse variational loss term
alongside the loss function of MAML, which uses a sparsifying approximated KL
divergence as a regularizer. We demonstrate the performance of B-MAML using
classification and regression tasks, and highlight that training a sparsifying
BNN using MAML indeed improves the parameter footprint of the model while
performing at par or even outperforming the MAML approach. We also illustrate
applicability of our approach in distributed sensor networks, where sparsity
and meta-learning can be beneficial.

negative:
Deep neural networks are vulnerable to adversarial examples that are crafted
by imposing imperceptible changes to the inputs. However, these adversarial
examples are most successful in white-box settings where the model and its
parameters are available. Finding adversarial examples that are transferable to
other models or developed in a black-box setting is significantly more
difficult. In this paper, we propose the Direction-Aggregated adversarial
attacks that deliver transferable adversarial examples. Our method utilizes
aggregated direction during the attack process for avoiding the generated
adversarial examples overfitting to the white-box model. Extensive experiments
on ImageNet show that our proposed method improves the transferability of
adversarial examples significantly and outperforms state-of-the-art attacks,
especially against adversarial robust models. The best averaged attack success
rates of our proposed method reaches 94.6\% against three adversarial trained
models and 94.8\% against five defense methods. It also reveals that current
defense approaches do not prevent transferable adversarial attacks.

negative:
We present a novel Balanced Incremental Model Agnostic Meta Learning system
(BI-MAML) for learning multiple tasks. Our method implements a meta-update rule
to incrementally adapt its model to new tasks without forgetting old tasks.
Such a capability is not possible in current state-of-the-art MAML approaches.
These methods effectively adapt to new tasks, however, suffer from
'catastrophic forgetting' phenomena, in which new tasks that are streamed into
the model degrade the performance of the model on previously learned tasks. Our
system performs the meta-updates with only a few-shots and can successfully
accomplish them. Our key idea for achieving this is the design of balanced
learning strategy for the baseline model. The strategy sets the baseline model
to perform equally well on various tasks and incorporates time efficiency. The
balanced learning strategy enables BI-MAML to both outperform other
state-of-the-art models in terms of classification accuracy for existing tasks
and also accomplish efficient adaption to similar new tasks with less required
shots. We evaluate BI-MAML by conducting comparisons on two common benchmark
datasets with multiple number of image classification tasks. BI-MAML
performance demonstrates advantages in both accuracy and efficiency.

negative:
Deep neural networks (DNNs) are vulnerable to adversarial examples with small
perturbations. Adversarial defense thus has been an important means which
improves the robustness of DNNs by defending against adversarial examples.
Existing defense methods focus on some specific types of adversarial examples
and may fail to defend well in real-world applications. In practice, we may
face many types of attacks where the exact type of adversarial examples in
real-world applications can be even unknown. In this paper, motivated by that
adversarial examples are more likely to appear near the classification
boundary, we study adversarial examples from a new perspective that whether we
can defend against adversarial examples by pulling them back to the original
clean distribution. We theoretically and empirically verify the existence of
defense affine transformations that restore adversarial examples. Relying on
this, we learn a defense transformer to counterattack the adversarial examples
by parameterizing the affine transformations and exploiting the boundary
information of DNNs. Extensive experiments on both toy and real-world datasets
demonstrate the effectiveness and generalization of our defense transformer.

negative:
Model-agnostic meta-learning (MAML) formulates meta-learning as a bilevel
optimization problem, where the inner level solves each subtask based on a
shared prior, while the outer level searches for the optimal shared prior by
optimizing its aggregated performance over all the subtasks. Despite its
empirical success, MAML remains less understood in theory, especially in terms
of its global optimality, due to the nonconvexity of the meta-objective (the
outer-level objective). To bridge such a gap between theory and practice, we
characterize the optimality gap of the stationary points attained by MAML for
both reinforcement learning and supervised learning, where the inner-level and
outer-level problems are solved via first-order optimization methods. In
particular, our characterization connects the optimality gap of such stationary
points with (i) the functional geometry of inner-level objectives and (ii) the
representation power of function approximators, including linear models and
neural networks. To the best of our knowledge, our analysis establishes the
global optimality of MAML with nonconvex meta-objectives for the first time.

negative:
Deep neural networks (DNNs) are vulnerable to adversarial noise. Their
adversarial robustness can be improved by exploiting adversarial examples.
However, given the continuously evolving attacks, models trained on seen types
of adversarial examples generally cannot generalize well to unseen types of
adversarial examples. To solve this problem, in this paper, we propose to
remove adversarial noise by learning generalizable invariant features across
attacks which maintain semantic classification information. Specifically, we
introduce an adversarial feature learning mechanism to disentangle invariant
features from adversarial noise. A normalization term has been proposed in the
encoded space of the attack-invariant features to address the bias issue
between the seen and unseen types of attacks. Empirical evaluations demonstrate
that our method could provide better protection in comparison to previous
state-of-the-art approaches, especially against unseen types of attacks and
adaptive attacks.

negative:
In recent years, deep neural networks have demonstrated outstanding
performance in many machine learning tasks. However, researchers have
discovered that these state-of-the-art models are vulnerable to adversarial
examples: legitimate examples added by small perturbations which are
unnoticeable to human eyes. Adversarial training, which augments the training
data with adversarial examples during the training process, is a well known
defense to improve the robustness of the model against adversarial attacks.
However, this robustness is only effective to the same attack method used for
adversarial training. Madry et al.(2017) suggest that effectiveness of
iterative multi-step adversarial attacks and particularly that projected
gradient descent (PGD) may be considered the universal first order adversary
and applying the adversarial training with PGD implies resistance against many
other first order attacks. However, the computational cost of the adversarial
training with PGD and other multi-step adversarial examples is much higher than
that of the adversarial training with other simpler attack techniques. In this
paper, we show how strong adversarial examples can be generated only at a cost
similar to that of two runs of the fast gradient sign method (FGSM), allowing
defense against adversarial attacks with a robustness level comparable to that
of the adversarial training with multi-step adversarial examples. We
empirically demonstrate the effectiveness of the proposed two-step defense
approach against different attack methods and its improvements over existing
defense strategies.

negative:
The existence of adversarial data examples has drawn significant attention in
the deep-learning community; such data are seemingly minimally perturbed
relative to the original data, but lead to very different outputs from a
deep-learning algorithm. Although a significant body of work on developing
defensive models has been considered, most such models are heuristic and are
often vulnerable to adaptive attacks. Defensive methods that provide
theoretical robustness guarantees have been studied intensively, yet most fail
to obtain non-trivial robustness when a large-scale model and data are present.
To address these limitations, we introduce a framework that is scalable and
provides certified bounds on the norm of the input manipulation for
constructing adversarial examples. We establish a connection between robustness
against adversarial perturbation and additive random noise, and propose a
training strategy that can significantly improve the certified bounds. Our
evaluation on MNIST, CIFAR-10 and ImageNet suggests that the proposed method is
scalable to complicated models and large data sets, while providing competitive
robustness to state-of-the-art provable defense methods.

negative:
Transferability of adversarial examples is a key issue to apply this kind of
attacks against multimedia forensics (MMF) techniques based on Deep Learning
(DL) in a real-life setting. Adversarial example transferability, in fact,
would open the way to the deployment of successful counter forensics attacks
also in cases where the attacker does not have a full knowledge of the
to-be-attacked system. Some preliminary works have shown that adversarial
examples against CNN-based image forensics detectors are in general
non-transferrable, at least when the basic versions of the attacks implemented
in the most popular libraries are adopted. In this paper, we introduce a
general strategy to increase the strength of the attacks and evaluate their
transferability when such a strength varies. We experimentally show that, in
this way, attack transferability can be largely increased, at the expense of a
larger distortion. Our research confirms the security threats posed by the
existence of adversarial examples even in multimedia forensics scenarios, thus
calling for new defense strategies to improve the security of DL-based MMF
techniques.

negative:
Model-agnostic meta-learning (MAML) is a well-known optimization-based
meta-learning algorithm that works well in various computer vision tasks, e.g.,
few-shot classification. MAML is to learn an initialization so that a model can
adapt to a new task in a few steps. However, since the gradient norm of a
classifier (head) is much bigger than those of backbone layers, the model
focuses on learning the decision boundary of the classifier with similar
representations. Furthermore, gradient norms of high-level layers are small
than those of the other layers. So, the backbone of MAML usually learns
task-generic features, which results in deteriorated adaptation performance in
the inner-loop. To resolve or mitigate this problem, we propose contextual
gradient scaling (CxGrad), which scales gradient norms of the backbone to
facilitate learning task-specific knowledge in the inner-loop. Since the
scaling factors are generated from task-conditioned parameters, gradient norms
of the backbone can be scaled in a task-wise fashion. Experimental results show
that CxGrad effectively encourages the backbone to learn task-specific
knowledge in the inner-loop and improves the performance of MAML up to a
significant margin in both same- and cross-domain few-shot classification.

negative:
Model-Agnostic Meta-Learning (MAML) has become increasingly popular for
training models that can quickly adapt to new tasks via one or few stochastic
gradient descent steps. However, the MAML objective is significantly more
difficult to optimize compared to standard non-adaptive learning (NAL), and
little is understood about how much MAML improves over NAL in terms of the fast
adaptability of their solutions in various scenarios. We analytically address
this issue in a linear regression setting consisting of a mixture of easy and
hard tasks, where hardness is related to the rate that gradient descent
converges on the task. Specifically, we prove that in order for MAML to achieve
substantial gain over NAL, (i) there must be some discrepancy in hardness among
the tasks, and (ii) the optimal solutions of the hard tasks must be closely
packed with the center far from the center of the easy tasks optimal solutions.
We also give numerical and analytical results suggesting that these insights
apply to two-layer neural networks. Finally, we provide few-shot image
classification experiments that support our insights for when MAML should be
used and emphasize the importance of training MAML on hard tasks in practice.

negative:
Model-agnostic meta-learning (MAML) is a meta-learning technique to train a
model on a multitude of learning tasks in a way that primes the model for
few-shot learning of new tasks. The MAML algorithm performs well on few-shot
learning problems in classification, regression, and fine-tuning of policy
gradients in reinforcement learning, but comes with the need for costly
hyperparameter tuning for training stability. We address this shortcoming by
introducing an extension to MAML, called Alpha MAML, to incorporate an online
hyperparameter adaptation scheme that eliminates the need to tune meta-learning
and learning rates. Our results with the Omniglot database demonstrate a
substantial reduction in the need to tune MAML training hyperparameters and
improvement to training stability with less sensitivity to hyperparameter
choice.

negative:
Deep neural network based medical image systems are vulnerable to adversarial
examples. Many defense mechanisms have been proposed in the literature,
however, the existing defenses assume a passive attacker who knows little about
the defense system and does not change the attack strategy according to the
defense. Recent works have shown that a strong adaptive attack, where an
attacker is assumed to have full knowledge about the defense system, can easily
bypass the existing defenses. In this paper, we propose a novel adversarial
example defense system called Medical Aegis. To the best of our knowledge,
Medical Aegis is the first defense in the literature that successfully
addresses the strong adaptive adversarial example attacks to medical images.
Medical Aegis boasts two-tier protectors: The first tier of Cushion weakens the
adversarial manipulation capability of an attack by removing its high-frequency
components, yet posing a minimal effect on classification performance of the
original image; the second tier of Shield learns a set of per-class DNN models
to predict the logits of the protected model. Deviation from the Shield's
prediction indicates adversarial examples. Shield is inspired by the
observations in our stress tests that there exist robust trails in the shallow
layers of a DNN model, which the adaptive attacks can hardly destruct.
Experimental results show that the proposed defense accurately detects adaptive
attacks, with negligible overhead for model inference.

negative:
We identify a trade-off between robustness and accuracy that serves as a
guiding principle in the design of defenses against adversarial examples.
Although this problem has been widely studied empirically, much remains unknown
concerning the theory underlying this trade-off. In this work, we decompose the
prediction error for adversarial examples (robust error) as the sum of the
natural (classification) error and boundary error, and provide a differentiable
upper bound using the theory of classification-calibrated loss, which is shown
to be the tightest possible upper bound uniform over all probability
distributions and measurable predictors. Inspired by our theoretical analysis,
we also design a new defense method, TRADES, to trade adversarial robustness
off against accuracy. Our proposed algorithm performs well experimentally in
real-world datasets. The methodology is the foundation of our entry to the
NeurIPS 2018 Adversarial Vision Challenge in which we won the 1st place out of
~2,000 submissions, surpassing the runner-up approach by $11.41\%$ in terms of
mean $\ell_2$ perturbation distance.

negative:
Adversarial training, in which a network is trained on adversarial examples,
is one of the few defenses against adversarial attacks that withstands strong
attacks. Unfortunately, the high cost of generating strong adversarial examples
makes standard adversarial training impractical on large-scale problems like
ImageNet. We present an algorithm that eliminates the overhead cost of
generating adversarial examples by recycling the gradient information computed
when updating model parameters. Our "free" adversarial training algorithm
achieves comparable robustness to PGD adversarial training on the CIFAR-10 and
CIFAR-100 datasets at negligible additional cost compared to natural training,
and can be 7 to 30 times faster than other strong adversarial training methods.
Using a single workstation with 4 P100 GPUs and 2 days of runtime, we can train
a robust model for the large-scale ImageNet classification task that maintains
40% accuracy against PGD attacks. The code is available at
https://github.com/ashafahi/free_adv_train.

negative:
We address the problem of adversarial examples in machine learning where an
adversary tries to misguide a classifier by making functionality-preserving
modifications to original samples. We assume a black-box scenario where the
adversary has access to only the feature set, and the final hard-decision
output of the classifier. We propose a method to generate adversarial examples
using the minimum description length (MDL) principle. Our final aim is to
improve the robustness of the classifier by considering generated examples in
rebuilding the classifier. We evaluate our method for the application of static
malware detection in portable executable (PE) files. We consider API calls of
PE files as their distinguishing features where the feature vector is a binary
vector representing the presence-absence of API calls. In our method, we first
create a dataset of benign samples by querying the target classifier. We next
construct a code table of frequent patterns for the compression of this dataset
using the MDL principle. We finally generate an adversarial example
corresponding to a malware sample by selecting and adding a pattern from the
benign code table to the malware sample. The selected pattern is the one that
minimizes the length of the compressed adversarial example given the code
table. This modification preserves the functionalities of the original malware
sample as all original API calls are kept, and only some new API calls are
added. Considering a neural network, we show that the evasion rate is 78.24
percent for adversarial examples compared to 8.16 percent for original malware
samples. This shows the effectiveness of our method in generating examples that
need to be considered in rebuilding the classifier.

negative:
Despite the remarkable performance and generalization levels of deep learning
models in a wide range of artificial intelligence tasks, it has been
demonstrated that these models can be easily fooled by the addition of
imperceptible yet malicious perturbations to natural inputs. These altered
inputs are known in the literature as adversarial examples. In this paper, we
propose a novel probabilistic framework to generalize and extend adversarial
attacks in order to produce a desired probability distribution for the classes
when we apply the attack method to a large number of inputs. This novel attack
paradigm provides the adversary with greater control over the target model,
thereby exposing, in a wide range of scenarios, threats against deep learning
models that cannot be conducted by the conventional paradigms. We introduce
four different strategies to efficiently generate such attacks, and illustrate
our approach by extending multiple adversarial attack algorithms. We also
experimentally validate our approach for the spoken command classification task
and the Tweet emotion classification task, two exemplary machine learning
problems in the audio and text domain, respectively. Our results demonstrate
that we can closely approximate any probability distribution for the classes
while maintaining a high fooling rate and even prevent the attacks from being
detected by label-shift detection methods.

negative:
Recent studies have shown that state-of-the-art deep learning models are
vulnerable to the inputs with small perturbations (adversarial examples). We
observe two critical obstacles in adversarial examples: (i) Strong adversarial
attacks (e.g., C&W attack) require manually tuning hyper-parameters and take a
long time to construct an adversarial example, making it impractical to attack
real-time systems; (ii) Most of the studies focus on non-sequential tasks, such
as image classification, yet only a few consider sequential tasks. In this
work, we speed up adversarial attacks, especially on sequential learning tasks.
By leveraging the uncertainty of each task, we directly learn the adaptive
multi-task weightings, without manually searching hyper-parameters. A unified
architecture is developed and evaluated for both non-sequential tasks and
sequential ones. To validate the effectiveness, we take the scene text
recognition task as a case study. To our best knowledge, our proposed method is
the first attempt to adversarial attack for scene text recognition. Adaptive
Attack achieves over 99.9\% success rate with 3-6X speedup compared to
state-of-the-art adversarial attacks.

negative:
Model Agnostic Meta-Learning (MAML) is one of the most representative of
gradient-based meta-learning algorithms. MAML learns new tasks with a few data
samples using inner updates from a meta-initialization point and learns the
meta-initialization parameters with outer updates. It has recently been
hypothesized that representation reuse, which makes little change in efficient
representations, is the dominant factor in the performance of the
meta-initialized model through MAML in contrast to representation change, which
causes a significant change in representations. In this study, we investigate
the necessity of representation change for the ultimate goal of few-shot
learning, which is solving domain-agnostic tasks. To this aim, we propose a
novel meta-learning algorithm, called BOIL (Body Only update in Inner Loop),
which updates only the body (extractor) of the model and freezes the head
(classifier) during inner loop updates. BOIL leverages representation change
rather than representation reuse. This is because feature vectors
(representations) have to move quickly to their corresponding frozen head
vectors. We visualize this property using cosine similarity, CKA, and empirical
results without the head. BOIL empirically shows significant performance
improvement over MAML, particularly on cross-domain tasks. The results imply
that representation change in gradient-based meta-learning approaches is a
critical component.

negative:
Adversarial training is wildly considered as one of the most effective way to
defend against adversarial examples. However, existing adversarial training
methods consume unbearable time, due to the fact that they need to generate
adversarial examples in the large input space. To speed up adversarial
training, we propose a novel adversarial training method that does not need to
generate real adversarial examples. By adding perturbations to logits to
generate Endogenous Adversarial Examples (EAEs) -- the adversarial examples in
the latent space, the time consuming gradient calculation can be avoided.
Extensive experiments are conducted on CIFAR-10 and ImageNet, and the results
show that comparing to state-of-the-art methods, our EAE adversarial training
not only shortens the training time, but also enhances the robustness of the
model and has less impact on the accuracy of clean examples than the existing
methods.

negative:
As a popular meta-learning approach, the model-agnostic meta-learning (MAML)
algorithm has been widely used due to its simplicity and effectiveness.
However, the convergence of the general multi-step MAML still remains
unexplored. In this paper, we develop a new theoretical framework to provide
such convergence guarantee for two types of objective functions that are of
interest in practice: (a) resampling case (e.g., reinforcement learning), where
loss functions take the form in expectation and new data are sampled as the
algorithm runs; and (b) finite-sum case (e.g., supervised learning), where loss
functions take the finite-sum form with given samples. For both cases, we
characterize the convergence rate and the computational complexity to attain an
$\epsilon$-accurate solution for multi-step MAML in the general nonconvex
setting. In particular, our results suggest that an inner-stage stepsize needs
to be chosen inversely proportional to the number $N$ of inner-stage steps in
order for $N$-step MAML to have guaranteed convergence. From the technical
perspective, we develop novel techniques to deal with the nested structure of
the meta gradient for multi-step MAML, which can be of independent interest.

negative:
White box adversarial perturbations are generated via iterative optimization
algorithms most often by minimizing an adversarial loss on a $\ell_p$
neighborhood of the original image, the so-called distortion set. Constraining
the adversarial search with different norms results in disparately structured
adversarial examples. Here we explore several distortion sets with
structure-enhancing algorithms. These new structures for adversarial examples
might provide challenges for provable and empirical robust mechanisms. Because
adversarial robustness is still an empirical field, defense mechanisms should
also reasonably be evaluated against differently structured attacks. Besides,
these structured adversarial perturbations may allow for larger distortions
size than their $\ell_p$ counter-part while remaining imperceptible or
perceptible as natural distortions of the image. We will demonstrate in this
work that the proposed structured adversarial examples can significantly bring
down the classification accuracy of adversarialy trained classifiers while
showing low $\ell_2$ distortion rate. For instance, on ImagNet dataset the
structured attacks drop the accuracy of adversarial model to near zero with
only 50\% of $\ell_2$ distortion generated using white-box attacks like PGD. As
a byproduct, our finding on structured adversarial examples can be used for
adversarial regularization of models to make models more robust or improve
their generalization performance on datasets which are structurally different.

negative:
The problem of adversarial examples, evasion attacks on machine learning
classifiers, has proven extremely difficult to solve. This is true even when,
as is the case in many practical settings, the classifier is hosted as a remote
service and so the adversary does not have direct access to the model
parameters.
  This paper argues that in such settings, defenders have a much larger space
of actions than have been previously explored. Specifically, we deviate from
the implicit assumption made by prior work that a defense must be a stateless
function that operates on individual examples, and explore the possibility for
stateful defenses.
  To begin, we develop a defense designed to detect the process of adversarial
example generation. By keeping a history of the past queries, a defender can
try to identify when a sequence of queries appears to be for the purpose of
generating an adversarial example. We then introduce query blinding, a new
class of attacks designed to bypass defenses that rely on such a defense
approach.
  We believe that expanding the study of adversarial examples from stateless
classifiers to stateful systems is not only more realistic for many black-box
settings, but also gives the defender a much-needed advantage in responding to
the adversary.

negative:
Deep neural networks have been shown to be vulnerable to adversarial examples
deliberately constructed to misclassify victim models. As most adversarial
examples have restricted their perturbations to $L_{p}$-norm, existing defense
methods have focused on these types of perturbations and less attention has
been paid to unrestricted adversarial examples; which can create more realistic
attacks, able to deceive models without affecting human predictions. To address
this problem, the proposed adversarial attack generates an unrestricted
adversarial example with a limited number of parameters. The attack selects
three points on the input image and based on their locations transforms the
image into an adversarial example. By limiting the range of movement and
location of these three points and using a discriminatory network, the proposed
unrestricted adversarial example preserves the image appearance. Experimental
results show that the proposed adversarial examples obtain an average success
rate of 93.5% in terms of human evaluation on the MNIST and SVHN datasets. It
also reduces the model accuracy by an average of 73% on six datasets MNIST,
FMNIST, SVHN, CIFAR10, CIFAR100, and ImageNet. It should be noted that, in the
case of attacks, lower accuracy in the victim model denotes a more successful
attack. The adversarial train of the attack also improves model robustness
against a randomly transformed image.

negative:
This paper discusses an Enhanced Model-Agnostic Meta-Learning (E-MAML)
algorithm that generates fast convergence of the policy function from a small
number of training examples when applied to new learning tasks. Built on top of
Model-Agnostic Meta-Learning (MAML), E-MAML maintains a set of policy
parameters learned in the environment for previous tasks. We apply E-MAML to
developing reinforcement learning (RL)-based online fault tolerant control
schemes for dynamic systems. The enhancement is applied when a new fault
occurs, to re-initialize the parameters of a new RL policy that achieves faster
adaption with a small number of samples of system behavior with the new fault.
This replaces the random task sampling step in MAML. Instead, it exploits the
extant previously generated experiences of the controller. The enhancement is
sampled to maximally span the parameter space to facilitate adaption to the new
fault. We demonstrate the performance of our approach combining E-MAML with
proximal policy optimization (PPO) on the well-known cart pole example, and
then on the fuel transfer system of an aircraft.

negative:
Meta-learning allows an intelligent agent to leverage prior learning episodes
as a basis for quickly improving performance on a novel task. Bayesian
hierarchical modeling provides a theoretical framework for formalizing
meta-learning as inference for a set of parameters that are shared across
tasks. Here, we reformulate the model-agnostic meta-learning algorithm (MAML)
of Finn et al. (2017) as a method for probabilistic inference in a hierarchical
Bayesian model. In contrast to prior methods for meta-learning via hierarchical
Bayes, MAML is naturally applicable to complex function approximators through
its use of a scalable gradient descent procedure for posterior inference.
Furthermore, the identification of MAML as hierarchical Bayes provides a way to
understand the algorithm's operation as a meta-learning procedure, as well as
an opportunity to make use of computational strategies for efficient inference.
We use this opportunity to propose an improvement to the MAML algorithm that
makes use of techniques from approximate inference and curvature estimation.

negative:
Model agnostic meta-learning (MAML) is a popular state-of-the-art
meta-learning algorithm that provides good weight initialization of a model
given a variety of learning tasks. The model initialized by provided weight can
be fine-tuned to an unseen task despite only using a small amount of samples
and within a few adaptation steps. MAML is simple and versatile but requires
costly learning rate tuning and careful design of the task distribution which
affects its scalability and generalization. This paper proposes a more robust
MAML based on an adaptive learning scheme and a prioritization task buffer(PTB)
referred to as Robust MAML (RMAML) for improving scalability of training
process and alleviating the problem of distribution mismatch. RMAML uses
gradient-based hyper-parameter optimization to automatically find the optimal
learning rate and uses the PTB to gradually adjust train-ing task distribution
toward testing task distribution over the course of training. Experimental
results on meta reinforcement learning environments demonstrate a substantial
performance gain as well as being less sensitive to hyper-parameter choice and
robust to distribution mismatch.

negative:
Advances in machine learning have led to broad deployment of systems with
impressive performance on important problems. Nonetheless, these systems can be
induced to make errors on data that are surprisingly similar to examples the
learned system handles correctly. The existence of these errors raises a
variety of questions about out-of-sample generalization and whether bad actors
might use such examples to abuse deployed systems. As a result of these
security concerns, there has been a flurry of recent papers proposing
algorithms to defend against such malicious perturbations of correctly handled
examples. It is unclear how such misclassifications represent a different kind
of security problem than other errors, or even other attacker-produced examples
that have no specific relationship to an uncorrupted input. In this paper, we
argue that adversarial example defense papers have, to date, mostly considered
abstract, toy games that do not relate to any specific security concern.
Furthermore, defense papers have not yet precisely described all the abilities
and limitations of attackers that would be relevant in practical security.
Towards this end, we establish a taxonomy of motivations, constraints, and
abilities for more plausible adversaries. Finally, we provide a series of
recommendations outlining a path forward for future work to more clearly
articulate the threat model and perform more meaningful evaluation.

negative:
We introduce ES-MAML, a new framework for solving the model agnostic meta
learning (MAML) problem based on Evolution Strategies (ES). Existing algorithms
for MAML are based on policy gradients, and incur significant difficulties when
attempting to estimate second derivatives using backpropagation on stochastic
policies. We show how ES can be applied to MAML to obtain an algorithm which
avoids the problem of estimating second derivatives, and is also conceptually
simple and easy to implement. Moreover, ES-MAML can handle new types of
nonsmooth adaptation operators, and other techniques for improving performance
and estimation of ES methods become applicable. We show empirically that
ES-MAML is competitive with existing methods and often yields better adaptation
with fewer queries.

negative:
The paper studies the complexity of the optimization problem behind the
Model-Agnostic Meta-Learning (MAML) algorithm. The goal of the study is to
determine the global convergence of MAML on sequential decision-making tasks
possessing a common structure. We are curious to know when, if at all, the
benign landscape of the underlying tasks results in a benign landscape of the
corresponding MAML objective. For illustration, we analyze the landscape of the
MAML objective on LQR tasks to determine what types of similarities in their
structures enable the algorithm to converge to the globally optimal solution.

negative:
A core capability of intelligent systems is the ability to quickly learn new
tasks by drawing on prior experience. Gradient (or optimization) based
meta-learning has recently emerged as an effective approach for few-shot
learning. In this formulation, meta-parameters are learned in the outer loop,
while task-specific models are learned in the inner-loop, by using only a small
amount of data from the current task. A key challenge in scaling these
approaches is the need to differentiate through the inner loop learning
process, which can impose considerable computational and memory burdens. By
drawing upon implicit differentiation, we develop the implicit MAML algorithm,
which depends only on the solution to the inner level optimization and not the
path taken by the inner loop optimizer. This effectively decouples the
meta-gradient computation from the choice of inner loop optimizer. As a result,
our approach is agnostic to the choice of inner loop optimizer and can
gracefully handle many gradient steps without vanishing gradients or memory
constraints. Theoretically, we prove that implicit MAML can compute accurate
meta-gradients with a memory footprint that is, up to small constant factors,
no more than that which is required to compute a single inner loop gradient and
at no overall increase in the total computational cost. Experimentally, we show
that these benefits of implicit MAML translate into empirical gains on few-shot
image recognition benchmarks.

negative:
Deep learning models for graphs have achieved strong performance for the task
of node classification. Despite their proliferation, currently there is no
study of their robustness to adversarial attacks. Yet, in domains where they
are likely to be used, e.g. the web, adversaries are common. Can deep learning
models for graphs be easily fooled? In this work, we introduce the first study
of adversarial attacks on attributed graphs, specifically focusing on models
exploiting ideas of graph convolutions. In addition to attacks at test time, we
tackle the more challenging class of poisoning/causative attacks, which focus
on the training phase of a machine learning model. We generate adversarial
perturbations targeting the node's features and the graph structure, thus,
taking the dependencies between instances in account. Moreover, we ensure that
the perturbations remain unnoticeable by preserving important data
characteristics. To cope with the underlying discrete domain we propose an
efficient algorithm Nettack exploiting incremental computations. Our
experimental study shows that accuracy of node classification significantly
drops even when performing only few perturbations. Even more, our attacks are
transferable: the learned attacks generalize to other state-of-the-art node
classification models and unsupervised approaches, and likewise are successful
even when only limited knowledge about the graph is given.

negative:
Deep learning models are known to be vulnerable to adversarial examples. A
practical adversarial attack should require as little as possible knowledge of
attacked models. Current substitute attacks need pre-trained models to generate
adversarial examples and their attack success rates heavily rely on the
transferability of adversarial examples. Current score-based and decision-based
attacks require lots of queries for the attacked models. In this study, we
propose a novel adversarial imitation attack. First, it produces a replica of
the attacked model by a two-player game like the generative adversarial
networks (GANs). The objective of the generative model is to generate examples
that lead the imitation model returning different outputs with the attacked
model. The objective of the imitation model is to output the same labels with
the attacked model under the same inputs. Then, the adversarial examples
generated by the imitation model are utilized to fool the attacked model.
Compared with the current substitute attacks, imitation attacks can use less
training data to produce a replica of the attacked model and improve the
transferability of adversarial examples. Experiments demonstrate that our
imitation attack requires less training data than the black-box substitute
attacks, but achieves an attack success rate close to the white-box attack on
unseen data with no query.

negative:
The field of few-shot learning has recently seen substantial advancements.
Most of these advancements came from casting few-shot learning as a
meta-learning problem. Model Agnostic Meta Learning or MAML is currently one of
the best approaches for few-shot learning via meta-learning. MAML is simple,
elegant and very powerful, however, it has a variety of issues, such as being
very sensitive to neural network architectures, often leading to instability
during training, requiring arduous hyperparameter searches to stabilize
training and achieve high generalization and being very computationally
expensive at both training and inference times. In this paper, we propose
various modifications to MAML that not only stabilize the system, but also
substantially improve the generalization performance, convergence speed and
computational overhead of MAML, which we call MAML++.

negative:
In this work we present a formal theoretical framework for assessing and
analyzing two classes of malevolent action towards generic Artificial
Intelligence (AI) systems. Our results apply to general multi-class classifiers
that map from an input space into a decision space, including artificial neural
networks used in deep learning applications. Two classes of attacks are
considered. The first class involves adversarial examples and concerns the
introduction of small perturbations of the input data that cause
misclassification. The second class, introduced here for the first time and
named stealth attacks, involves small perturbations to the AI system itself.
Here the perturbed system produces whatever output is desired by the attacker
on a specific small data set, perhaps even a single input, but performs as
normal on a validation set (which is unknown to the attacker). We show that in
both cases, i.e., in the case of an attack based on adversarial examples and in
the case of a stealth attack, the dimensionality of the AI's decision-making
space is a major contributor to the AI's susceptibility. For attacks based on
adversarial examples, a second crucial parameter is the absence of local
concentrations in the data probability distribution, a property known as
Smeared Absolute Continuity. According to our findings, robustness to
adversarial examples requires either (a) the data distributions in the AI's
feature space to have concentrated probability density functions or (b) the
dimensionality of the AI's decision variables to be sufficiently small. We also
show how to construct stealth attacks on high-dimensional AI systems that are
hard to spot unless the validation set is made exponentially large.

negative:
Model Agnostic Meta Learning (MAML) is widely used to find a good
initialization for a family of tasks. Despite its success, a critical challenge
in MAML is to calculate the gradient w.r.t. the initialization of a long
training trajectory for the sampled tasks, because the computation graph can
rapidly explode and the computational cost is very expensive. To address this
problem, we propose Adjoint MAML (A-MAML). We view gradient descent in the
inner optimization as the evolution of an Ordinary Differential Equation (ODE).
To efficiently compute the gradient of the validation loss w.r.t. the
initialization, we use the adjoint method to construct a companion, backward
ODE. To obtain the gradient w.r.t. the initialization, we only need to run the
standard ODE solver twice -- one is forward in time that evolves a long
trajectory of gradient flow for the sampled task; the other is backward and
solves the adjoint ODE. We need not create or expand any intermediate
computational graphs, adopt aggressive approximations, or impose proximal
regularizers in the training loss. Our approach is cheap, accurate, and
adaptable to different trajectory lengths. We demonstrate the advantage of our
approach in both synthetic and real-world meta-learning tasks.

negative:
Deep neural networks are vulnerable to adversarial examples, which poses
security concerns on these algorithms due to the potentially severe
consequences. Adversarial attacks serve as an important surrogate to evaluate
the robustness of deep learning models before they are deployed. However, most
of existing adversarial attacks can only fool a black-box model with a low
success rate. To address this issue, we propose a broad class of momentum-based
iterative algorithms to boost adversarial attacks. By integrating the momentum
term into the iterative process for attacks, our methods can stabilize update
directions and escape from poor local maxima during the iterations, resulting
in more transferable adversarial examples. To further improve the success rates
for black-box attacks, we apply momentum iterative algorithms to an ensemble of
models, and show that the adversarially trained models with a strong defense
ability are also vulnerable to our black-box attacks. We hope that the proposed
methods will serve as a benchmark for evaluating the robustness of various deep
models and defense methods. With this method, we won the first places in NIPS
2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack
competitions.

negative:
An important research direction in machine learning has centered around
developing meta-learning algorithms to tackle few-shot learning. An especially
successful algorithm has been Model Agnostic Meta-Learning (MAML), a method
that consists of two optimization loops, with the outer loop finding a
meta-initialization, from which the inner loop can efficiently learn new tasks.
Despite MAML's popularity, a fundamental open question remains -- is the
effectiveness of MAML due to the meta-initialization being primed for rapid
learning (large, efficient changes in the representations) or due to feature
reuse, with the meta initialization already containing high quality features?
We investigate this question, via ablation studies and analysis of the latent
representations, finding that feature reuse is the dominant factor. This leads
to the ANIL (Almost No Inner Loop) algorithm, a simplification of MAML where we
remove the inner loop for all but the (task-specific) head of a MAML-trained
network. ANIL matches MAML's performance on benchmark few-shot image
classification and RL and offers computational improvements over MAML. We
further study the precise contributions of the head and body of the network,
showing that performance on the test tasks is entirely determined by the
quality of the learned features, and we can remove even the head of the network
(the NIL algorithm). We conclude with a discussion of the rapid learning vs
feature reuse question for meta-learning algorithms more broadly.

negative:
Efficiently adapting to new environments and changes in dynamics is critical
for agents to successfully operate in the real world. Reinforcement learning
(RL) based approaches typically rely on external reward feedback for
adaptation. However, in many scenarios this reward signal might not be readily
available for the target task, or the difference between the environments can
be implicit and only observable from the dynamics. To this end, we introduce a
method that allows for self-adaptation of learned policies: No-Reward Meta
Learning (NoRML). NoRML extends Model Agnostic Meta Learning (MAML) for RL and
uses observable dynamics of the environment instead of an explicit reward
function in MAML's finetune step. Our method has a more expressive update step
than MAML, while maintaining MAML's gradient based foundation. Additionally, in
order to allow more targeted exploration, we implement an extension to MAML
that effectively disconnects the meta-policy parameters from the fine-tuned
policies' parameters. We first study our method on a number of synthetic
control problems and then validate our method on common benchmark environments,
showing that NoRML outperforms MAML when the dynamics change between tasks.

negative:
Multi-label learning deals with the problem that each instance is associated
with multiple labels simultaneously. Most of the existing approaches aim to
improve the performance of multi-label learning by exploiting label
correlations. Although the data augmentation technique is widely used in many
machine learning tasks, it is still unclear whether data augmentation is
helpful to multi-label learning. In this article, we propose to leverage the
data augmentation technique to improve the performance of multi-label learning.
Specifically, we first propose a novel data augmentation approach that performs
clustering on the real examples and treats the cluster centers as virtual
examples, and these virtual examples naturally embody the local label
correlations and label importances. Then, motivated by the cluster assumption
that examples in the same cluster should have the same label, we propose a
novel regularization term to bridge the gap between the real examples and
virtual examples, which can promote the local smoothness of the learning
function. Extensive experimental results on a number of real-world multi-label
datasets clearly demonstrate that our proposed approach outperforms the
state-of-the-art counterparts.

negative:
In Machine Learning as a Service, a provider trains a deep neural network and
gives many users access. The hosted (source) model is susceptible to model
stealing attacks, where an adversary derives a surrogate model from API access
to the source model. For post hoc detection of such attacks, the provider needs
a robust method to determine whether a suspect model is a surrogate of their
model. We propose a fingerprinting method for deep neural network classifiers
that extracts a set of inputs from the source model so that only surrogates
agree with the source model on the classification of such inputs. These inputs
are a subclass of transferable adversarial examples which we call conferrable
adversarial examples that exclusively transfer with a target label from a
source model to its surrogates. We propose a new method to generate these
conferrable adversarial examples. We present an extensive study on the
irremovability of our fingerprint against fine-tuning, weight pruning,
retraining, retraining with different architectures, three model extraction
attacks from related work, transfer learning, adversarial training, and two new
adaptive attacks. Our fingerprint is robust against distillation, related model
extraction attacks, and even transfer learning when the attacker has no access
to the model provider's dataset. Our fingerprint is the first method that
reaches a ROC AUC of 1.0 in verifying surrogates, compared to a ROC AUC of 0.63
by previous fingerprints.

negative:
Model-agnostic meta-learning (MAML) is arguably one of the most popular
meta-learning algorithms nowadays. Nevertheless, its performance on few-shot
classification is far behind many recent algorithms dedicated to the problem.
In this paper, we point out several key facets of how to train MAML to excel in
few-shot classification. First, we find that MAML needs a large number of
gradient steps in its inner loop update, which contradicts its common usage in
few-shot classification. Second, we find that MAML is sensitive to the class
label assignments during meta-testing. Concretely, MAML meta-trains the
initialization of an $N$-way classifier. These $N$ ways, during meta-testing,
then have "$N!$" different permutations to be paired with a few-shot task of
$N$ novel classes. We find that these permutations lead to a huge variance of
accuracy, making MAML unstable in few-shot classification. Third, we
investigate several approaches to make MAML permutation-invariant, among which
meta-training a single vector to initialize all the $N$ weight vectors in the
classification head performs the best. On benchmark datasets like MiniImageNet
and TieredImageNet, our approach, which we name UNICORN-MAML, performs on a par
with or even outperforms many recent few-shot classification algorithms,
without sacrificing MAML's simplicity.

negative:
We propose a new computationally-efficient first-order algorithm for
Model-Agnostic Meta-Learning (MAML). The key enabling technique is to interpret
MAML as a bilevel optimization (BLO) problem and leverage the sign-based
SGD(signSGD) as a lower-level optimizer of BLO. We show that MAML, through the
lens of signSGD-oriented BLO, naturally yields an alternating optimization
scheme that just requires first-order gradients of a learned meta-model. We
term the resulting MAML algorithm Sign-MAML. Compared to the conventional
first-order MAML (FO-MAML) algorithm, Sign-MAML is theoretically-grounded as it
does not impose any assumption on the absence of second-order derivatives
during meta training. In practice, we show that Sign-MAML outperforms FO-MAML
in various few-shot image classification tasks, and compared to MAML, it
achieves a much more graceful tradeoff between classification accuracy and
computation efficiency.

negative:
It has been empirically observed that defense mechanisms designed to protect
neural networks against $\ell_\infty$ adversarial examples offer poor
performance against $\ell_2$ adversarial examples and vice versa. In this paper
we conduct a geometrical analysis that validates this observation. Then, we
provide a number of empirical insights to illustrate the effect of this
phenomenon in practice. Then, we review some of the existing defense mechanism
that attempts to defend against multiple attacks by mixing defense strategies.
Thanks to our numerical experiments, we discuss the relevance of this method
and state open questions for the adversarial examples community.

negative:
As an essential tool in security, the intrusion detection system bears the
responsibility of the defense to network attacks performed by malicious
traffic. Nowadays, with the help of machine learning algorithms, intrusion
detection systems develop rapidly. However, the robustness of this system is
questionable when it faces adversarial attacks. For the robustness of detection
systems, more potential attack approaches are under research. In this paper, a
framework of the generative adversarial networks, called IDSGAN, is proposed to
generate the adversarial malicious traffic records aiming to attack intrusion
detection systems by deceiving and evading the detection. Given that the
internal structure and parameters of the detection system are unknown to
attackers, the adversarial attack examples perform the black-box attacks
against the detection system. IDSGAN leverages a generator to transform
original malicious traffic records into adversarial malicious ones. A
discriminator classifies traffic examples and dynamically learns the real-time
black-box detection system. More significantly, the restricted modification
mechanism is designed for the adversarial generation to preserve original
attack functionalities of adversarial traffic records. The effectiveness of the
model is indicated by attacking multiple algorithm-based detection models with
different attack categories. The robustness is verified by changing the number
of the modified features. A comparative experiment with adversarial attack
baselines demonstrates the superiority of our model.

negative:
The continual learning problem involves training models with limited capacity
to perform well on a set of an unknown number of sequentially arriving tasks.
While meta-learning shows great potential for reducing interference between old
and new tasks, the current training procedures tend to be either slow or
offline, and sensitive to many hyper-parameters. In this work, we propose
Look-ahead MAML (La-MAML), a fast optimisation-based meta-learning algorithm
for online-continual learning, aided by a small episodic memory. Our proposed
modulation of per-parameter learning rates in our meta-learning update allows
us to draw connections to prior work on hypergradients and meta-descent. This
provides a more flexible and efficient way to mitigate catastrophic forgetting
compared to conventional prior-based methods. La-MAML achieves performance
superior to other replay-based, prior-based and meta-learning based approaches
for continual learning on real-world visual classification benchmarks. Source
code can be found here: https://github.com/montrealrobotics/La-MAML

negative:
Recently, model-agnostic meta-learning (MAML) has garnered tremendous
attention. However, the stochastic optimization of MAML is still immature.
Existing algorithms for MAML exploit the "episode" idea by sampling some tasks
and some data points for each sampled task at each iteration for updating the
meta-model. However, they either do not necessarily guarantee convergence with
a constant mini-batch size or require processing a large number of tasks at
every iteration, which is not viable for continual learning or cross-device
federated learning where only a small number of tasks are available
per-iteration or per-round. This paper addresses these issues by (i) proposing
efficient memory-based stochastic algorithms for MAML with the vanishing
convergence error, which only requires sampling a constant number of tasks and
a constant number of data samples per-iteration; (ii) proposing
communication-efficient distributed memory-based MAML algorithms for
personalized federated learning in both the cross-device (with client sampling)
and the cross-silo (without client sampling) settings. The theoretical results
significantly improve the optimization theory for MAML and the empirical
results also corroborate the theory.

negative:
This paper considers meta-learning problems, where there is a distribution of
tasks, and we would like to obtain an agent that performs well (i.e., learns
quickly) when presented with a previously unseen task sampled from this
distribution. We analyze a family of algorithms for learning a parameter
initialization that can be fine-tuned quickly on a new task, using only
first-order derivatives for the meta-learning updates. This family includes and
generalizes first-order MAML, an approximation to MAML obtained by ignoring
second-order derivatives. It also includes Reptile, a new algorithm that we
introduce here, which works by repeatedly sampling a task, training on it, and
moving the initialization towards the trained weights on that task. We expand
on the results from Finn et al. showing that first-order meta-learning
algorithms perform well on some well-established benchmarks for few-shot
classification, and we provide theoretical analysis aimed at understanding why
these algorithms work.

negative:
Deep neural networks are vulnerable to adversarial attacks. White-box
adversarial attacks can fool neural networks with small adversarial
perturbations, especially for large size images. However, keeping successful
adversarial perturbations imperceptible is especially challenging for
transfer-based black-box adversarial attacks. Often such adversarial examples
can be easily spotted due to their unpleasantly poor visual qualities, which
compromises the threat of adversarial attacks in practice. In this study, to
improve the image quality of black-box adversarial examples perceptually, we
propose structure-aware adversarial attacks by generating adversarial images
based on psychological perceptual models. Specifically, we allow higher
perturbations on perceptually insignificant regions, while assigning lower or
no perturbation on visually sensitive regions. In addition to the proposed
spatial-constrained adversarial perturbations, we also propose a novel
structure-aware frequency adversarial attack method in the discrete cosine
transform (DCT) domain. Since the proposed attacks are independent of the
gradient estimation, they can be directly incorporated with existing
gradient-based attacks. Experimental results show that, with the comparable
attack success rate (ASR), the proposed methods can produce adversarial
examples with considerably improved visual quality for free. With the
comparable perceptual quality, the proposed approaches achieve higher attack
success rates: particularly for the frequency structure-aware attacks, the
average ASR improves more than 10% over the baseline attacks.

negative:
In this paper, we establish the ordinary differential equation (ODE) that
underlies the training dynamics of Model-Agnostic Meta-Learning (MAML). Our
continuous-time limit view of the process eliminates the influence of the
manually chosen step size of gradient descent and includes the existing
gradient descent training algorithm as a special case that results from a
specific discretization. We show that the MAML ODE enjoys a linear convergence
rate to an approximate stationary point of the MAML loss function for strongly
convex task losses, even when the corresponding MAML loss is non-convex.
Moreover, through the analysis of the MAML ODE, we propose a new BI-MAML
training algorithm that significantly reduces the computational burden
associated with existing MAML training methods. To complement our theoretical
findings, we perform empirical experiments to showcase the superiority of our
proposed methods with respect to the existing work.

negative:
In past years model-agnostic meta-learning (MAML) has been one of the most
promising approaches in meta-learning. It can be applied to different kinds of
problems, e.g., reinforcement learning, but also shows good results on few-shot
learning tasks. Besides their tremendous success in these tasks, it has still
not been fully revealed yet, why it works so well. Recent work proposes that
MAML rather reuses features than rapidly learns. In this paper, we want to
inspire a deeper understanding of this question by analyzing MAML's
representation. We apply representation similarity analysis (RSA), a
well-established method in neuroscience, to the few-shot learning instantiation
of MAML. Although some part of our analysis supports their general results that
feature reuse is predominant, we also reveal arguments against their
conclusion. The similarity-increase of layers closer to the input layers arises
from the learning task itself and not from the model. In addition, the
representations after inner gradient steps make a broader change to the
representation than the changes during meta-training.

negative:
Model-agnostic meta-learning (MAML) is one of the most popular and widely
adopted meta-learning algorithms, achieving remarkable success in various
learning problems. Yet, with the unique design of nested inner-loop and
outer-loop updates, which govern the task-specific and meta-model-centric
learning, respectively, the underlying learning objective of MAML remains
implicit and thus impedes a more straightforward understanding of it. In this
paper, we provide a new perspective of the working mechanism of MAML. We
discover that MAML is analogous to a meta-learner using a supervised
contrastive objective. The query features are pulled towards the support
features of the same class and against those of different classes. Such
contrastiveness is experimentally verified via an analysis based on the cosine
similarity. Moreover, we reveal that vanilla MAML has an undesirable
interference term originating from the random initialization and the cross-task
interaction. We thus propose a simple but effective technique, zeroing trick,
to alleviate the interference. Extensive experiments are conducted on both
mini-ImageNet and Omniglot datasets to demonstrate the consistent improvement
brought by our proposed method, validating its effectiveness.

negative:
We consider the tracking problem as a special type of object detection
problem, which we call instance detection. With proper initialization, a
detector can be quickly converted into a tracker by learning the new instance
from a single image. We find that model-agnostic meta-learning (MAML) offers a
strategy to initialize the detector that satisfies our needs. We propose a
principled three-step approach to build a high-performance tracker. First, pick
any modern object detector trained with gradient descent. Second, conduct
offline training (or initialization) with MAML. Third, perform domain
adaptation using the initial frame. We follow this procedure to build two
trackers, named Retina-MAML and FCOS-MAML, based on two modern detectors
RetinaNet and FCOS. Evaluations on four benchmarks show that both trackers are
competitive against state-of-the-art trackers. On OTB-100, Retina-MAML achieves
the highest ever AUC of 0.712. On TrackingNet, FCOS-MAML ranks the first on the
leader board with an AUC of 0.757 and the normalized precision of 0.822. Both
trackers run in real-time at 40 FPS.

negative:
We study the convergence of a class of gradient-based Model-Agnostic
Meta-Learning (MAML) methods and characterize their overall complexity as well
as their best achievable accuracy in terms of gradient norm for nonconvex loss
functions. We start with the MAML method and its first-order approximation
(FO-MAML) and highlight the challenges that emerge in their analysis. By
overcoming these challenges not only we provide the first theoretical
guarantees for MAML and FO-MAML in nonconvex settings, but also we answer some
of the unanswered questions for the implementation of these algorithms
including how to choose their learning rate and the batch size for both tasks
and datasets corresponding to tasks. In particular, we show that MAML can find
an $\epsilon$-first-order stationary point ($\epsilon$-FOSP) for any positive
$\epsilon$ after at most $\mathcal{O}(1/\epsilon^2)$ iterations at the expense
of requiring second-order information. We also show that FO-MAML which ignores
the second-order information required in the update of MAML cannot achieve any
small desired level of accuracy, i.e., FO-MAML cannot find an $\epsilon$-FOSP
for any $\epsilon>0$. We further propose a new variant of the MAML algorithm
called Hessian-free MAML which preserves all theoretical guarantees of MAML,
without requiring access to second-order information.

negative:
Deep learning models require a large amount of data to perform well. When
data is scarce for a target task, we can transfer the knowledge gained by
training on similar tasks to quickly learn the target. A successful approach is
meta-learning, or "learning to learn" a distribution of tasks, where "learning"
is represented by an outer loop, and "to learn" by an inner loop of gradient
descent. However, a number of recent empirical studies argue that the inner
loop is unnecessary and more simple models work equally well or even better. We
study the performance of MAML as a function of the learning rate of the inner
loop, where zero learning rate implies that there is no inner loop. Using
random matrix theory and exact solutions of linear models, we calculate an
algebraic expression for the test loss of MAML applied to mixed linear
regression and nonlinear regression with overparameterized models.
Surprisingly, while the optimal learning rate for adaptation is positive, we
find that the optimal learning rate for training is always negative, a setting
that has never been considered before. Therefore, not only does the performance
increase by decreasing the learning rate to zero, as suggested by recent work,
but it can be increased even further by decreasing the learning rate to
negative values. These results help clarify under what circumstances
meta-learning performs best.

negative:
We formulate a principle for classification with the knowledge of the
marginal distribution over the data points (unlabeled data). The principle is
cast in terms of Tikhonov style regularization where the regularization penalty
articulates the way in which the marginal density should constrain otherwise
unrestricted conditional distributions. Specifically, the regularization
penalty penalizes any information introduced between the examples and labels
beyond what is provided by the available labeled examples. The work extends
Szummer and Jaakkola's information regularization (NIPS 2002) to multiple
dimensions, providing a regularizer independent of the covering of the space
used in the derivation. We show in addition how the information regularizer can
be used as a measure of complexity of the classification task with unlabeled
data and prove a relevant sample-complexity bound. We illustrate the
regularization principle in practice by restricting the class of conditional
distributions to be logistic regression models and constructing the
regularization penalty from a finite set of unlabeled examples.

negative:
Machine learning models in health care are often deployed in settings where
it is important to protect patient privacy. In such settings, methods for
differentially private (DP) learning provide a general-purpose approach to
learn models with privacy guarantees. Modern methods for DP learning ensure
privacy through mechanisms that censor information judged as too unique. The
resulting privacy-preserving models, therefore, neglect information from the
tails of a data distribution, resulting in a loss of accuracy that can
disproportionately affect small groups. In this paper, we study the effects of
DP learning in health care. We use state-of-the-art methods for DP learning to
train privacy-preserving models in clinical prediction tasks, including x-ray
classification of images and mortality prediction in time series data. We use
these models to perform a comprehensive empirical investigation of the
tradeoffs between privacy, utility, robustness to dataset shift, and fairness.
Our results highlight lesser-known limitations of methods for DP learning in
health care, models that exhibit steep tradeoffs between privacy and utility,
and models whose predictions are disproportionately influenced by large
demographic groups in the training data. We discuss the costs and benefits of
differentially private learning in health care.