The field of few-shot learning (FSL) has shown promising results in scenarios where training data is limited, but its vulnerability to backdoor attacks remains largely unexplored. We first explore this topic by first evaluating the performance of the existing backdoor attack methods on few-shot learning scenarios. Unlike in standard supervised learning, existing backdoor attack methods failed to perform an effective attack in FSL due to two main issues. Firstly, the model tends to overfit to either benign features or trigger features, causing a tough trade-off between attack success rate and benign accuracy. Secondly, due to the small number of training samples, the dirty label or visible trigger in the support set can be easily detected by victims, which reduces the stealthiness of attacks. It seemed that FSL could survive from backdoor attacks. However, in this paper, we propose the Few-shot Learning Backdoor Attack (FLBA) to show that FSL can still be vulnerable to backdoor attacks. Specifically, we first generate a trigger to maximize the gap between poisoned and benign features. It enables the model to learn both benign and trigger features, which solves the problem of overfitting. To make it more stealthy, we hide the trigger by optimizing two types of imperceptible perturbation, namely attractive and repulsive perturbation, instead of attaching the trigger directly. Once we obtain the perturbations, we can poison all samples in the benign support set into a hidden poisoned support set and fine-tune the model on it. Our method demonstrates a high Attack Success Rate (ASR) in FSL tasks with different few-shot learning paradigms while preserving clean accuracy and maintaining stealthiness. This study reveals that few-shot learning still suffers from backdoor attacks, and its security should be given attention.

翻译：小样本学习（FSL）在训练数据有限的场景中展现出显著效果，但其对后门攻击的脆弱性尚缺乏充分研究。我们首先通过评估现有后门攻击方法在小样本学习场景中的表现来探索该问题。与标准监督学习不同，现有后门攻击方法在FSL中难以实现有效攻击，主要存在两大问题：其一，模型倾向于过拟合良性特征或触发器特征，导致攻击成功率与良性准确率之间难以平衡；其二，由于训练样本数量稀少，支持集中的脏标签或可见触发器易被受害者察觉，削弱了攻击的隐蔽性。这似乎表明FSL能够抵御后门攻击。然而，本文提出小样本学习后门攻击（FLBA），证明FSL仍可能受到后门攻击的威胁。具体而言，我们首先生成一个触发器以最大化中毒特征与良性特征之间的差距，使模型能够同时学习良性特征和触发器特征，从而解决过拟合问题。为提升隐蔽性，我们通过优化两种不可察觉扰动（即吸引扰动与排斥扰动）来隐藏触发器，而非直接附加触发器。获得扰动后，可将良性支持集中的所有样本转化为隐蔽中毒支持集，并在其上微调模型。本方法在不同小样本学习范式下均实现了高攻击成功率（ASR），同时保持干净准确率与隐蔽性。该研究表明小样本学习仍会受到后门攻击威胁，其安全性应引起重视。