The field of few-shot learning (FSL) has shown promising results in scenarios
where training data is limited, but its vulnerability to backdoor attacks
remains largely unexplored. We first explore this topic by first evaluating the
performance of the existing backdoor attack methods on few-shot learning
scenarios. Unlike in standard supervised learning, existing backdoor attack
methods failed to perform an effective attack in FSL due to two main issues.
Firstly, the model tends to overfit to either benign features or trigger
features, causing a tough trade-off between attack success rate and benign
accuracy. Secondly, due to the small number of training samples, the dirty
label or visible trigger in the support set can be easily detected by victims,
which reduces the stealthiness of attacks. It seemed that FSL could survive
from backdoor attacks. However, in this paper, we propose the Few-shot Learning
Backdoor Attack (FLBA) to show that FSL can still be vulnerable to backdoor
attacks. Specifically, we first generate a trigger to maximize the gap between
poisoned and benign features. It enables the model to learn both benign and
trigger features, which solves the problem of overfitting. To make it more
stealthy, we hide the trigger by optimizing two types of imperceptible
perturbation, namely attractive and repulsive perturbation, instead of
attaching the trigger directly. Once we obtain the perturbations, we can poison
all samples in the benign support set into a hidden poisoned support set and
fine-tune the model on it. Our method demonstrates a high Attack Success Rate
(ASR) in FSL tasks with different few-shot learning paradigms while preserving
clean accuracy and maintaining stealthiness. This study reveals that few-shot
learning still suffers from backdoor attacks, and its security should be given
attention.

本文研究了 Few-shot Learning（FSL）领域中的后门攻击问题，发现 FSL 仍然存在脆弱性，并提出了一种名为 Few-shot Learning Backdoor Attack（FLBA）的新方法，该方法通过生成触发器并使用两种类型的不可察觉扰动使攻击更具隐蔽性，并在 FSL 任务中取得了高攻击成功率，同时保持了准确性和隐蔽性。

Few-shot 学习受到背门攻击的影响吗？

Does Few-shot Learning Suffer from Backdoor Attacks?

In recent years, with the successful application of DNN in fields such as NLP
and CV, its security has also received widespread attention. (Author) proposed
the method of backdoor attack in Badnet. Switch implanted backdoor into the
model by poisoning the training samples. The model with backdoor did not
exhibit any abnormalities on the normal validation sample set, but in the input
with trigger, they were mistakenly classified as the attacker's designated
category or randomly classified as a different category from the ground truth,
This attack method seriously threatens the normal application of DNN in real
life, such as autonomous driving, object detection, etc.This article proposes a
new method to combat backdoor attacks. We refer to the features in the area
covered by the trigger as trigger features, and the remaining areas as normal
features. By introducing prerequisite calculation conditions during the
training process, these conditions have little impact on normal features and
trigger features, and can complete the training of a standard backdoor model.
The model trained under these prerequisite calculation conditions can, In the
verification set D'val with the same premise calculation conditions, the
performance is consistent with that of the ordinary backdoor model. However, in
the verification set Dval without the premise calculation conditions, the
verification accuracy decreases very little (7%~12%), while the attack success
rate (ASR) decreases from 90% to about 8%.Author call this method Prerequisite
Transformation(PT).

本文提出了一种名为先决条件转换（Prerequisite Transformation，PT）的新方法，该方法可在不破坏模型性能的情况下对抗后门攻击，同时保护触发器特征和正常特征。