Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Automatic Attack Discovery for Few-Shot Class-Incremental Learning via Large Language Models

Haidong Kang, Wei Wu, Hanling Wang

TL;DR

This work addresses security vulnerabilities in Few-Shot Class-Incremental Learning (FSCIL) by introducing ACraft, an LLM-driven framework that automatically designs adversarial attack algorithms tailored for FSCIL. ACraft uses a PPO-based closed-loop to iteratively refine attack strategies produced by a Large Language Model, optimizing a Multi-Attribute Utility fitness that balances attack impact and computational cost. Empirical results on miniImageNet, CIFAR-100, and CUB-200 show ACraft significantly degrades state-of-the-art FSCIL methods beyond expert-designed attacks while maintaining low attack costs, and it generalizes across multiple FSCIL frameworks. The approach demonstrates a new direction for robust continual learning, enabling automated discovery of adversarial techniques without human expert intervention.

Abstract

Few-shot class incremental learning (FSCIL) is a more realistic and challenging paradigm in continual learning to incrementally learn unseen classes and overcome catastrophic forgetting on base classes with only a few training examples. Previous efforts have primarily centered around studying more effective FSCIL approaches. By contrast, less attention was devoted to thinking the security issues in contributing to FSCIL. This paper aims to provide a holistic study of the impact of attacks on FSCIL. We first derive insights by systematically exploring how human expert-designed attack methods (i.e., PGD, FGSM) affect FSCIL. We find that those methods either fail to attack base classes, or suffer from huge labor costs due to relying on huge expert knowledge. This highlights the need to craft a specialized attack method for FSCIL. Grounded in these insights, in this paper, we propose a simple yet effective ACraft method to automatically steer and discover optimal attack methods targeted at FSCIL by leveraging Large Language Models (LLMs) without human experts. Moreover, to improve the reasoning between LLMs and FSCIL, we introduce a novel Proximal Policy Optimization (PPO) based reinforcement learning to optimize learning, making LLMs generate better attack methods in the next generation by establishing positive feedback. Experiments on mainstream benchmarks show that our ACraft significantly degrades the performance of state-of-the-art FSCIL methods and dramatically beyond human expert-designed attack methods while maintaining the lowest costs of attack.

Automatic Attack Discovery for Few-Shot Class-Incremental Learning via Large Language Models

TL;DR

This work addresses security vulnerabilities in Few-Shot Class-Incremental Learning (FSCIL) by introducing ACraft, an LLM-driven framework that automatically designs adversarial attack algorithms tailored for FSCIL. ACraft uses a PPO-based closed-loop to iteratively refine attack strategies produced by a Large Language Model, optimizing a Multi-Attribute Utility fitness that balances attack impact and computational cost. Empirical results on miniImageNet, CIFAR-100, and CUB-200 show ACraft significantly degrades state-of-the-art FSCIL methods beyond expert-designed attacks while maintaining low attack costs, and it generalizes across multiple FSCIL frameworks. The approach demonstrates a new direction for robust continual learning, enabling automated discovery of adversarial techniques without human expert intervention.

Abstract

Few-shot class incremental learning (FSCIL) is a more realistic and challenging paradigm in continual learning to incrementally learn unseen classes and overcome catastrophic forgetting on base classes with only a few training examples. Previous efforts have primarily centered around studying more effective FSCIL approaches. By contrast, less attention was devoted to thinking the security issues in contributing to FSCIL. This paper aims to provide a holistic study of the impact of attacks on FSCIL. We first derive insights by systematically exploring how human expert-designed attack methods (i.e., PGD, FGSM) affect FSCIL. We find that those methods either fail to attack base classes, or suffer from huge labor costs due to relying on huge expert knowledge. This highlights the need to craft a specialized attack method for FSCIL. Grounded in these insights, in this paper, we propose a simple yet effective ACraft method to automatically steer and discover optimal attack methods targeted at FSCIL by leveraging Large Language Models (LLMs) without human experts. Moreover, to improve the reasoning between LLMs and FSCIL, we introduce a novel Proximal Policy Optimization (PPO) based reinforcement learning to optimize learning, making LLMs generate better attack methods in the next generation by establishing positive feedback. Experiments on mainstream benchmarks show that our ACraft significantly degrades the performance of state-of-the-art FSCIL methods and dramatically beyond human expert-designed attack methods while maintaining the lowest costs of attack.

Paper Structure

This paper contains 17 sections, 8 equations, 4 figures, 4 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Challenges
  3. Contributions
  4. Rethinking the design of Attack Algorithms
  5. Automatic Attack Discovery for FSCIL
  6. Overview of ACraft
  7. Mathematical Formulation
  8. Core Mechanisms of Attack Generation
  9. The Closed-Loop Algorithmic Workflow
  10. Experiment and Discussions
  11. Experimental Settings
  12. Results on FSCIL Benchmarks
  13. Generalizability on more FSCIL Frameworks
  14. Ablation study
  15. The impact of various LLMs:
  16. ...and 2 more sections

Figures (4)

  • Figure 1: A comparison of the designed way of Attack. (a) Manual design relies on expert knowledge. (b) A naive method via LLMs. (c) Our method proposes an LLM-driven ACraft framework to automatically discover optimal Attack for FSCIL.
  • Figure 2: ACraft v.s. existing attacks for FSCIL task in CUB200 dataset.
  • Figure 3: Overview of ACraft.
  • Figure 4: ACraft v.s. existing attacks for FSCIL task in Cifar-100 dataset.