A unified taxonomy of adversarial attacks and defenses in few-shot learning

Leontaridis, Alexios; Λεονταρίδης, Αλέξης

Master Thesis

Author

Leontaridis, Alexios

Λεονταρίδης, Αλέξης

Date

2026-06

Abstract

Few-Shot Learning (FSL) allows a model to recognize new classes from only a few labeled examples per class, instead of the large datasets that traditional deep learning models need. It is already used in sensitive areas like medical imaging, face recognition, rare species classification and cybersecurity, where collecting many samples is difficult or even impossible. The problem is that the same things that make FSL useful, the small support set, the episodic training and the fast adaptation to new tasks, also create weak points that conventional deep learning models do not have to deal with. Adversarial machine learning has been studied a lot, and FSL robustness is also starting to get more attention, but the existing work is spread out and there is still no single taxonomy built specifically for attacks and defenses in the few-shot case. This thesis tries to cover that missing part by building a unified taxonomy of adversarial attacks and defenses for FSL models in computer vision. Everything is mapped onto a four-dimensional threat model: the attack surface, what the adversary knows, what the adversary wants to achieve, and when the attack takes place. Using these four dimensions, we sort the attacks into six families (query-set evasion, support-set poisoning, clean-label poisoning, backdoor attacks, universal adversarial perturbations and embedding-space attacks) and the defenses into four categories (adversarial training, certified defenses, detection-based methods and backdoor-specific defenses). The taxonomy makes a few patterns clear. Almost every attack assumes white-box access, targets the model's integrity and happens at inference time, while gray-box and strict black-box attacks, together with poisoning during meta-training, are barely covered in the literature. The defenses are uneven as well: there is little that protects the support set, almost nothing for embedding-space manipulations, and no real defense against FSL-specific backdoors. To connect the analysis to practice, we run a proof-of-concept on CIFAR-FS and miniImageNet with Prototypical Networks under a Conv4 and a ResNet 12 backbone, testing the model against FGSM, Adversarial Support Poisoning (ASP) and FAMF, with and without Adversarial Querying. The results confirm that robustness in FSL depends a lot on both the attack family and the backbone, and that a defense built for standard deep learning does not transfer cleanly to the few-shot setting.

Postgraduate Studies Programme

Κυβερνοασφάλεια και Τεχνολογίες Τεχνητής Νοημοσύνης / MSc Cybersecurity & AI Technologies

Department

Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα Ψηφιακών Συστημάτων

Number of pages

Language

English

URI

https://dione.lib.unipi.gr/xmlui/handle/unipi/19778

Collections

Τμήμα Ψηφιακών Συστημάτων

Show full item record

Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 3.0 Ελλάδα