11institutetext: University of Maryland, Baltimore County 22institutetext:
University of California, Davis

#  A Simple Approach to Adversarial Robustness in Few-shot Image
Classification

Anonymous ECCV submission  Akshayvarun Subramanya 11 Hamed Pirsiavash 22

###### Abstract

Few-shot image classification, where the goal is to generalize to tasks with
limited labeled data, has seen great progress over the years. However, the
classifiers are vulnerable to adversarial examples, posing a question
regarding their generalization capabilities. Recent works have tried to
combine meta-learning approaches with adversarial training to improve the
robustness of few-shot classifiers. We show that a simple transfer-learning
based approach can be used to train adversarially robust few-shot classifiers.
We also present a method for novel classification task based on calibrating
the centroid of the few-shot category towards the base classes. We show that
standard adversarial training on base categories along with calibrated
centroid-based classifier in the novel categories, outperforms or is on-par
with state-of-the-art advanced methods on standard benchmarks for few-shot
learning. Our method is simple, easy to scale, and with little effort can lead
to robust few-shot classifiers. Code is available here:
https://github.com/UCDvision/Simple_few_shot.git

##  1 Introduction

Few-shot learning presents the challenge of generalizing to unseen tasks with
limited data. The problem is aimed at learning quickly from few examples of
data, which is generally considered the hallmark of human intelligence. This
is an important practical problem due to the scarce availability of fully
annotated data in the real world. Researchers have shown that such a setting
can be considered for various real world computer vision tasks such as image
classification [14, 10], object detection [52], image segmentation [38], face-
recognition [22] and medical analysis [31]. As a result, it is of paramount
importance that such safety-critical systems are reliable and robust to
changes in input. Specifically in this work, we consider robustness to
adversarial examples - carefully crafted perturbations using gradients that
when added to inputs, fool the classifier. The most common method of improving
robustness is by adversarial training [18] which involves training on
adversarial examples using adversary of choice. Traditional adversarially
robust methods [30, 18, 47] consider a data-rich setting where many examples
are available per category. It has also been shown that adversarial
generalization possibly requires significantly more data [43]. This becomes
challenging in a scenario where the end-user has access to limited amount of
annotated data but is interested in building a robust few-shot classifier.
Such a setting is more practical and it is important to develop methods which
can work with minimal effort in the pre-deployment stage. We show from our
experiments that a simple approach of finetuning the network on clean data
from an adversarially robust base model can lead to significant improvement in
robustness with minimal resources.
Previous works on improving robustness for few-shot classifiers focus mainly
on meta-learning approaches where the base model is trained on adversarial
examples of episodic data. We show that standard mini-batch based adversarial
training is sufficient for learning a robust classifier. This makes our method
simple and scalable, making the process of training robust classifiers
straightforward and also creating directions to explore methods from
robustness literature.

It is important to understand the problem of few-shot learning in order to
develop their robust counterparts. The goal in few-shot learning is to learn
transferable knowledge for generalization to tasks with limited data. These
have generally been partitioned into metric learning [45, 50, 46],
optimization-based [14, 39] and hallucination based methods [23, 60, 2, 54].
The most common work among optimization based methods is MAML [14] which aims
at learning a network initialization using a bi-level optimization procedure,
that when finetuned on limited data is able to generalize to the new task.
Recent works have shown that meta-learning methods can be extended to include
adversarial robustness as well. [17, 53] perform adversarial training on top
of meta-learners to improve robustness significantly. However, adversarial
training on its own is expensive and combining with meta-learning makes the
problem computationally intensive. [53] showed that there exists a compromise
between training robust meta-learners and performance, motivating the need for
a simpler approach.

Another interesting line of work, focused on improving few-shot learning,
shows that a simple method which involves training on large scale data and
finetuning the model on the few-shot dataset can match or even outperform
meta-learning methods [10, 12]. The intuition is that the model sees examples
from all categories and can get a general sense of semantics rather than
seeing only episodic data. Such a setting also makes it easier to train on
large scale data that can lead to further improvements as shown in [12]. Our
results show considering a simple setting can be beneficial for adversarial
robustness as well.
We consider the few-shot setting and show that adversarial training along with
a centroid-based classifier can outperform previous methods in terms of
robustness. Such a setting is practically relevant, since the adversarial
training is done just once and robustness for few-shot classes can be achieved
without creating adversarial examples. We believe it also becomes easier to
incorporate new approaches to robustness, such as verifiably robust
classifiers [11, 19] and can bring together robust methods for both large and
limited dataset settings.

In the following sections, we describe our method and discuss relevant related
work. We present experimental findings and implementation details in the
subsequent sections followed by conclusion and directions for future work.

(a)

(b)

Figure 1: Our method is divided into two phases (a) Robust Base training
involves standard adversarial training with base dataset consisting of many
examples and categories (b) Novel Training involves transferring or adapting
the network for novel few-shot data using a Calibrated Nearest Centroid (CNC)
classifier. Note that the feature extractor remains frozen in the second
phase.

##  2 Method

Here we introduce notation and provide a description of our method. Our first
objective is to learn a feature extractor $f_{\theta_{b}}$ and linear
classifier $C_{\omega_{b}}$ using the abundantly-labeled base dataset $X_{b}$.
Previous approaches consider multiple few-shot tasks sampled from $X_{b}$ for
meta-learning, whereas we consider a standard mini-batch based training.
At the next stage, when a $N$-way $K$-shot few-shot task is sampled from the
novel dataset $X_{n}$, we use only the feature extractor $f_{\theta_{b}}$ and
learn a new linear classifier $C_{\omega_{n}}$ such that it can generalize to
unseen examples from novel categories. We show that a simple approach of
training a robust base model and then adapting it to novel categories can
outperform previous approaches. We divide our approach into two stages: (1)
Robust Base training and (2) Novel training.

###  2.1 Robust Base Training

Given a base dataset $X_{b}$ with large number of annotated examples per
category, we perform adversarial training using an iterative adversary such as
PGD [30]. Specifically, we solve the min-max objective

$\theta^{*}=\min_{\theta}\mathbb{E}_{(x,y)\in
X_{b}}\bigg{[}\max_{||\delta||_{p}<\epsilon}\mathcal{L}(\theta,x+\delta,y)\bigg{]}$
(1)

Here, $\mathcal{L}(\theta,x,y)$ represents the training objective, which is
commonly cross-entropy and $\theta=(\theta_{b},\omega_{b})$ represents the
combination of the feature extractor and base classifier parameters. There are
different methods for optimizing the inner maximization in Equation 1. We use
the Projected Gradient Descent (PGD) algorithm, an iterative algorithm
presented in [30] with $p=\infty$ which corresponds to finding a perturbation
$\delta$ around an $\epsilon$-bounded hypercube around $x$ that maximizes the
objective. Once we find the perturbation, the perturbed input is added to the
training set and parameters are tuned. This method is called adversarial
training and is the most widely used method to improve robustness to
adversarial examples. Note that adversarial training, which is a
computationally expensive procedure, needs to be performed just once using
base dataset. The intuition behind this approach is that the model sees
multiple categories across batches rather than episodic data, hence gaining
better understanding of semantic categories and robustness which can be
beneficial for adaptation.

Weight averaging: Weight averaging (WA) has been shown as a simple way to
improve generalization [27, 15] in deep networks as it approximates ensembling
in temporal fashion and can find flatter optima in loss surface. This method
has been used in adversarial training [20, 8] for improving robustness in
standard classification task. Since we are interested in using base parameters
at the next stage, we perform weight averaging for only the feature extractor
parameters $\theta_{b}$ and show this can be used for few-shot setting.

Similar to [20], we keep a separate copy of the weights and for every
iteration perform exponential moving average method
$\theta{{}_{b}}^{\prime}\leftarrow\tau\theta{{}_{b}}^{\prime}+(1-\tau)*\theta{{}_{b}}$
and use $\theta{{}_{b}}^{\prime}$ during the evaluation. We set $\tau=0.999$
in all our experiments.

###  2.2 Novel Training

During this stage, we consider the $N$-way, $K$-shot method as the novel task
and adapt our learnt feature extractor $f_{\theta_{b}}$ using classifier
$C_{\omega_{n}}$ . For all our experiments, we found best results when the
weights of feature extractor $f_{\theta_{b}}$ are frozen and not optimized
during novel training. Intuitively, this can be understood not wanting the
parameters of the feature extractor to be biased towards the few-shot
examples. And since we are interested in learning only from clean data during
the novel training, there can also be an effect of forgetting the robustness
learnt at the base stage. This was observed in [17] where only the final layer
was trained and rest of the parameters were frozen. During novel training, we
use only clean examples and not adversarial examples, making the process
straightforward.

Linear classifier: The simplest possible baseline is to learn a linear model
on top of the frozen feature extractor using the few shot examples of novel
categories. As shown in our experiments, this simple baseline on its own
achieves reasonable performance compared to previous approaches. This baseline
also suggests that a robust base classifier corresponds to a robust novel
classifier and a simple approach such as ours is enough to achieve robustness
for few-shot classifiers. However, as observed in previous works [53, 17] and
in our experiments, this approach alone is not sufficient to achieve improved
robustness. Interestingly, we achieve much closer results to state of the art
compared to previous works using this simple baseline. One challenge
associated with using few-shot data is that the model can become biased
towards the specific samples and may not capture the true class distribution.
Hence there is a need for more calibrated classifiers.

Background on Distribution Calibation (DC) [60]: Recent work [60] has shown
that standard accuracy of few-shot classifiers can be improved by using
Distribution Calibration. They present a free-lunch hallucination-based method
where the feature distributions of the novel categories are calibrated using
the base dataset, due to the similarity between the base and novel datasets.
The mean and covariance of each novel category is calibrated using the
statistic of base data. They use these statistics to hallucinate or sample
many points from a Gaussian distribution, and learn a logistic regression
classifier. This method was shown to improve standard accuracy significantly
under various settings.

Calibrated Nearest Centroid (CNC): DC method can be computationally expensive
due to the calculation of covariance matrix which can be of
$\mathcal{O}(N*D^{2})$ complexity where $D$ is the dimensionality of the
feature space and $N$ is the number of data points in the base dataset. The
covariance matrix is also expensive to store in memory. Moreover, sampling
from a multivariate Gaussian with non-diagonal covariance is also expensive
and can be of the order of at least $\mathcal{O}(D^{2.3})$ [5]. These can
reduce the applicability of the approach for large scale settings.

Another aspect of using the hallucinated features is that the model can become
biased to the clean features and learn a non-robust final classifier. Note
that since these additional data points are generated in the feature space and
not the image space, it is not possible to create adversarial versions of
these features and perform adversarial training using the large set of
features. This poses a problem of improving the performance without
sacrificing robustness.

To overcome these drawbacks, we present a simple method where we rely only on
the calibrated mean and classify query sample using a non-parametric Nearest
Centroid based algorithm. We call this the Calibrated Nearest Centroid (CNC)
Classifier. We find the nearest base-category centers to each novel training
sample and then average them along with the novel training sample to obtain
the new mean or centroid for the novel category. We do not consider the
covariance matrix in our method and we find this approximation works equally
well in our experiments. More formally:

$\mu_{j}=\frac{1}{m+1}(z_{j}+\sum_{i\in\mathcal{S}_{j}}\mu^{b}_{i})$ (2)

where $\mu_{j}$ is the center for the novel category $j$ and $\mathcal{S}_{j}$
is the set of $m$ base category centers that are closest to $z_{j}$,
$\mu^{b}_{i}$ is the mean of base category $i$ in the feature space. In the
case of $k$-shot setting, we calculate a centroid for each sample and average
them to get one centroid for each category.

At inference time, we simply find the nearest center to the query point and
assign its label:

$\hat{y}=\\{y_{j}|\operatorname*{arg\,max}_{j}\tilde{\mu}_{j}^{T}\tilde{z}\\}$
(3)

(a)

(b)

Figure 2: An illustration of the calibration for the Nearest Centroid
Classifier. Since we are working in the few-shot regime from novel dataset, if
the examples are not sampled from across the distribution, it may result in
centroids which do not necessarily represent the true distribution. On the
other hand, calibration using the base classes can result in centroids which
better represent the actual distribution of the class, allowing for better
generalization.

where $\tilde{z}$ and $\tilde{\mu}$ represent $\ell_{2}$ normalized version of
vectors $z$ and $\mu$ respectively, while $\hat{y}$ is the predicted category.
Note that $\ell_{2}$ normalization is performed for both query point and
centroids. Since we consider the normalized version of the vectors, euclidean
distance reduces to the form in Equation 3, similar to recent works [21]. Our
inference can be considered similar to the Linear Classifier method except
that our centres ( $\mu_{j}$ ) are estimated with simple averaging rather than
learnt using SGD. Note that similar to [60], as a preprocessing step, we
transform the embeddings by taking the square root of each dimension so that
their distribution gets closer to Gaussian form. It can be seen as “Tukey’s
Ladders of Power Transformation” [49] with $\lambda=0.5$.

At the inference time, a Nearest Centroid-based method requires less memory
and computation compared to a Nearest Neighbor classifier since we only have
to store and compare with one prototype per class rather than entire training
set.

##  3 Related Work

Few shot Image Classification: Few-shot learning is a challenging problem in
computer vision where the goal is rapid generalization to unseen tasks. Metric
learning approaches such as [45, 50, 46] were some of the earliest approaches
towards tacking this problem. [45] learn a metric space where prototypical
representation of each category is utilized for classifying novel data. [40]
showed that rather than taking the average, learning the prototypes along with
the model can lead to better performance. More recently, a family of
algorithms based on learning to learn [1] or meta-learning have gained
considerable attention. [39] develop an LSTM based meta-learner to train
anothet network for the few-shot task. [14, 33] create a model agnostic
algorithm which aims to learn a good initialization that can adapt to new
tasks. Hallucination based methods such as [23, 54, 2] also present promising
directions towards improved generalization. [16, 36] try to directly predict
the weights of the classifier for novel categories. [60] calibrate the
distributions of few shot examples using the statistics of categories with
larger number of examples. Our calibration is similar to [60], but we apply it
at category-level rather than instance-level. However recent works have shown
that simple baselines which are non-episodic in nature can provide competitive
performance for few-shot image classification task [10, 12]. Such line of work
provide for non-sophisticated baselines and pose a question to the community
to rethink the approach towards few shot learning.

Adversarial examples: Adversarial examples are carefully crafted perturbations
designed to fool the model [47, 18, 28]. [18] showed that adversarial examples
can be created rather easily using the sign of single gradient step, which
they called as Fast Gradient Sign Method (FGSM). The existence of such
examples raises a question regarding the generalization capabilities of Deep
Neural networks. Many defenses have been proposed to overcome this problem
[34, 57, 13, 29], but they have been bypassed with slight modifications to the
adversary [3, 6, 7]. One of the most common approaches called adversarial
training involves incorporating the adversarial examples into the training
set. [30] showed that the first order adversary, based on the Projected
Gradient Descent (PGD) algorithm can be used to train robust neural networks.
Provable methods have developed which can provide certification on the
susceptibility of an input towards adversaries [55, 56, 37, 19]. A class of
algorithms based on randomized smoothing [11, 59] have shown promising results
in training large scale neural networks. [63] provide a theoretical analysis
on the robustness vs accuracy trade-off, which had been studied empirically
[48], and show that their algorithm named TRADES improves robustness compared
to previous approaches. [44] use the gradients from the backpropagation
algorithm to improve robustness with minimal cost.

Adversarial Robustness for Few-shot classifiers: Recent works have tried to
address the problem of adversarial examples in the context of few-shot
learning. [61] used the FGSM adversary to create adversarial examples and
optimized a meta-learner to be robust to adversarial examples. [17] showed
that meta-learning algorithms can be supplemented with adversarial examples in
the query set to learn robustness. Their method called Adversarial Querying
was shown to be robust to strong attacks such as PGD. Many meta-learning
approaches were extended to their robust counterparts by including adversarial
query examples. Recently, [53] also proposed a similar approach where MAML was
used as the base meta learning algorithm. [53] also showed that including a
contrastive learning objective similar to [9] can provide a way to use
unlabelled data when learning the model and thus improve both standard and
robust accuracy.

##  4 Experiments

In this section, we describe our experiments and provide implementation
details. We consider three benchmark datasets - Mini-ImageNet, CIFAR-FS and
CUB for our experiments. Mini-ImageNet consists of 100 classes derived from
ImageNet dataset [42] where each category consists of 600 images. This was
first proposed in [50] and recent works follow the split provided by [39]
consisting of 64 base, 16 validation and 20 novel classes. We use images of
size 84x84 for all experiments with Mini-ImageNet. CIFAR-FS was proposed in
[4] as a benchmark for few-shot classification. It splits CIFAR-100 dataset
similar to Mini-ImageNet. CUB [51] is a fine-grained dataset which has been
used as a benchmark for few-shot classification. It consists of 11788 images
split across 200 categories. We use the split provided by [25] consisting of
100 base , 50 validation and 50 novel classes. As per our knowledge, we are
the first to show adversarial robustness for a fine-grained dataset under few-
shot setting. Note that there is no intersection of categories across base and
novel subsets for all datasets. We use Pytorch [35] framework and NVIDIA
2080Ti GPUs for our experiments.

Implementation details: In the base training stage, as described in Section
2.1, we follow the attack parameters of [17] and use iterative PGD attack with
7 iterations during training with $\epsilon=8/255$ and $\alpha=2/255$ for all
experiments unless otherwise mentioned. We mainly use the standard network
architecture ResNet [24] and also provide results for other architectures. For
weight averaging, we set the parameter $\tau=0.999$. We use SGD optimizer with
a learning rate of 0.1 and weight decay of $1e-5$ for the feature extractor
parameters $\theta_{b}$ and $1e-4$ for the classifier parameters $\omega_{b}$.
We train the model for 250 epochs with a batch size of 64. For novel training
and learning the Linear Classifier, we follow the setting described in [10]
and learn the parameters using SGD with momentum $0.9$ and learning rate
$\eta=0.01$. We set the dampening as $0.9$ and weight decay of $1e-3$. For our
calibration, we use $m=2$ number of base categories. For calculating Robust
Accuracy, we use 20 iterations of PGD to create an adversarial example and
measure accuracy w.r.t ground truth. We report both Standard Accuracy and
Robust Accuracy for 5-way, 1-shot and 5-way, 5-shot settings averaged over
1000 different trials on the test set. We report the mean of the different
trials as well as the 95% confidence intervals for all our experiments. Since
our goal is to build robust models, we mainly focus on improving Robust
Accuracy.

We compare our results with [17] ,which we refer to as Adversarial Querying
(AQ) where adversarial examples are created for query data and [53] which we
refer as OFA where MAML [14] is used to adversarially train the model. We
refer to training a linear classifier during the novel training stage as
Linear and the Calibrated Nearest Centroid classifier as CNC.

###  4.1 Mini-ImageNet

We present our main results on Mini-ImageNet in Table 1. We observe that CNC
method outperforms other approaches in Robust Accuracy under most settings and
boosts standard accuracy as well. We also show results on large-scale
architectures such as WideResNets [62] and DenseNets [26]. The difference
becomes clear as we move to larger architectures. Our Linear classifier also
serves as a strong baseline for robust few-shot settings.

|  | 1-shot | 5-shot
---|---|---|---
Method | Backbone | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | ResNet18 | 41.48 $\pm$ 0.56 | 20.52 $\pm$ 0.45 | 59.32 $\pm$ 0.53 | 32.18 $\pm$ 0.50
Ours (Linear) | ResNet18 | 42.63 $\pm$ 0.56 | 19.56$\pm$ 0.45 | 61.35 $\pm$ 0.51 | 30.63 $\pm$ 0.52
Ours (CNC) | ResNet18 | 44.98 $\pm$ 0.59 | 21.38 $\pm$ 0.46 | 61.30 $\pm$ 0.55 | 33.41 $\pm$ 0.51
AQ | WRN-50-2 | 38.99 $\pm$ 0.55 | 22.09 $\pm$ 0.45 | 57.11 $\pm$ 0.51 | 33.62 $\pm$ 0.50
Ours (Linear) | WRN-50-2 | 43.14 $\pm$ 0.54 | 19.94 $\pm$ 0.43 | 62.93 $\pm$ 0.50 | 30.52 $\pm$ 0.52
Ours (CNC) | WRN-50-2 | 46.71 $\pm$ 0.62 | 23.04 $\pm$ 0.50 | 63.60 $\pm$ 0.55 | 36.06 $\pm$ 0.54
AQ | WRN-28-10 | 44.17 $\pm$ 0.60 | 23.81 $\pm$ 0.48 | 62.41 $\pm$ 0.54 | 33.62 $\pm$ 0.50
Ours (Linear) | WRN-28-10 | 52.36 $\pm$ 0.62 | 22.23$\pm$0.52 | 72.11 $\pm$ 0.51 | 32.29 $\pm$ 0.59
Ours (CNC) | WRN-28-10 | 53.22 $\pm$ 0.66 | 22.91 $\pm$ 0.51 | 70.13 $\pm$ 0.52 | 35.40 $\pm$ 0.58
AQ | DenseNet121 | 38.32 $\pm$ 0.55 | 10.19 $\pm$ 0.32 | 56.65 $\pm$ 0.51 | 17.77 $\pm$ 0.41
Ours (Linear) | DenseNet121 | 39.77 $\pm$ 0.56 | 18.16$\pm$0.42 | 57.45$\pm$ 0.54 | 27.89 $\pm$0.52
Ours (CNC) | DenseNet121 | 42.05$\pm$ 0.60 | 20.21 $\pm$ 0.45 | 58.59$\pm$0.55 | 32.24$\pm$0.56
AQ | DenseNet161 | 37.35 $\pm$ 0.52 | 9.80 $\pm$ 0.31 | 55.97 $\pm$ 0.53 | 16.69 $\pm$ 0.38
Ours (Linear) | DenseNet161 | 40.75 $\pm$ 0.55 | 17.44 $\pm$ 0.41 | 59.84 $\pm$ 0.53 | 27.11$\pm$ 0.50
Ours (CNC) | DenseNet161 | 43.48 $\pm$ 0.60 | 20.63 $\pm$ 0.45 | 60.92 $\pm$ 0.54 | 33.87 $\pm$ 0.53

Table 1: Results on Mini-ImageNet dataset. Our CNC method outperforms other
approaches which becomes clear as we move to larger architectures. We can also
see that our linear classifier serves as a strong baseline and can be used to
learn robust few-shot classifier.

Our method is straightforward to scale for large architectures since they are
equivalent to standard adversarial training. However, we observed that scaling
meta-learning combined with PGD adversarial training is a difficult task.
To provide a comparison, we trained both AQ and our model on 4 NVIDIA TITAN
RTX GPUs using WideResNet-28-10 backbones. AQ method took 1.7 hour/epoch and
required 60 epochs while our method took 0.36 hour/epoch for 250 epochs. The
total training time for AQ was around 100 hours whereas our method took around
90 hours. This shows that our approach is more easily scalable compared to
previous methods.

|  | Conv4 | ResNet18
---|---|---|---
Method | Base training | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | AT | 29.6 | 24.9 | 30.04 | 20.05
OFA | AT | 40.82 | 23.04 | 38.94 | 19.94
OFA | TRADES | 37.1 | 25.51 | 41.94 | 20.19
OFA | CL | 38.60 | 26.81 | 43.98 | 21.47
Ours (Linear) | AT | 38.39 $\pm$ 0.37 | 28.76 $\pm$ 0.33 | 44.93$\pm$ 0.37 | 29.30 $\pm$ 0.33
Ours (CNC) | AT | 39.23 $\pm$ 0.38 | 30.77 $\pm$ 0.35 | 49.15 $\pm$ 0.41 | 35.59 $\pm$ 0.38
Table 2: Comparison with [53] on Mini-ImageNet dataset. Note that both TRADES
and CL use additional unlabelled data in a semi-supervised manner. Our method
outperforms previous approaches on both settings.

Comparison with OFA: We compare with another recent work OFA [53] where MAML
was combined with adversarial training to improve robustness. We present them
separately compared to previous results as the attack parameters and testing
configuration followed are different. For a fair comparison, we use the same
setting and we refer the readers to [53]. Base training column indicates the
type of adversary used during base dataset training where AT indicates PGD
adversarial training, TRADES is the algorithm presented in [63] and CL
corresponds to using the Contrastive Learning objective [9]. Both TRADES and
CL use additional unlabelled data in a semi-supervised manner. We observe from
Table 2 that our method has clear gains in terms of robust accuracy and
surpasses standard accuracy in some cases as well.

###  4.2 CIFAR-FS

Here we present results on CIFAR-FS dataset. The organization is similar to
Mini-ImageNet dataset where we presented two tables for fair comparison with
previous approaches. To compare with Adversarial Querying (AQ) [17], we use a
ResNet18 backbone and use attack parameters $\epsilon=8/255$ and
$\alpha=2/255$ with 20-iteration PGD for testing. As seen in Table 3, our
Calibrated Nearest Centroid classifier outperforms previous approaches on
Robust Accuracy, which is the main focus of our work. We also observe that we
match or outperform on Standard Accuracy under both 1-shot and 5-shot
settings.

|  | 1-shot | 5-shot
---|---|---|---
Method | Backbone | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | ResNet18 | 45.41$\pm$ 0.68 | 21.76 $\pm$ 0.59 | 64.98 $\pm$ 0.58 | 34.24 $\pm$ 0.65
Ours (Linear) | ResNet18 | 44.76 $\pm$ 0.63 | 21.01 $\pm$ 0.58 | 62.23 $\pm$ 0.63 | 31.60$\pm$ 0.66
Ours (CNC) | ResNet18 | 48.89$\pm$ 0.71 | 27.16 $\pm$ 0.66 | 64.36$\pm$ 0.61 | 39.13 $\pm$ 0.71

Table 3: Results on CIFAR-FS dataset. We can see our CNC method outperforms
compared to previous approaches. This experiment uses the same attack
parameters as [17].

For fair comparison with [53], we train a model with Conv4 backbone and use
their attack parameters. The results are presented in Table 4. As explained
earlier, Base training column indicates the type of adversary used during base
dataset training where AT indicates PGD adversarial training, TRADES uses the
algorithm presented in [63] and CL corresponds to using the Contrastive
Learning objective [9]. We see a similar trend as before where our CNC
outperforms previous approaches. We also conduct an experiment using TRADES
during Base Training, allowing us to compare methods that use similar
adversary. Under such comparable settings, our method outperforms previous
approaches. This experiment shows that our method can generalize to other
adversarial training methods and we believe that as more advanced methods are
developed in the community, they can be incorporated in a straightforward
manner to improve robustness under few-shot settings.

|  | 1-shot | 5-shot
---|---|---|---
Method | Base training | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | AT | 31.25 | 26.34 | 52.32 | 33.96
OFA | AT | 39.76 | 26.15 | 57.18 | 32.62
OFA | TRADES | 40.59 | 28.06 | 57.62 | 34.76
OFA | CL | 41.25 | 29.33 | 57.95 | 35.3
Ours (Linear) | AT | 41.12 $\pm$ 0.40 | 25.65 $\pm$ 0.37 | 56.20 $\pm$ 0.39 | 34.73 $\pm$ 0.41
Ours (CNC) | AT | 41.81$\pm$ 0.41 | 28.22 $\pm$ 0.40 | 53.52 $\pm$ 0.40 | 39.09 $\pm$ 0.42
Ours (CNC) | TRADES | 43.56$\pm$0.43 | 28.12 $\pm$ 0.41 | 56.99 $\pm$ 0.40 | 39.48 $\pm$0.43
Table 4: Comparison with [53] for Conv4 backbone on CIFAR-FS dataset.
Comparing methods that use same base training procedure (AT or TRADES ) , we
can see that our CNC method outperforms on Robust Accuracy under both 1-shot
and 5-shot settings. This experiment shows that our method can generalize to
other adversarial training methods as well.

###  4.3 CUB

For results on CUB dataset, we use the same attack parameters described for
Mini-ImageNet i.e, $\epsilon=8/255$, $\alpha=2/255$, 7 iterations of PGD
during training and 20 during testing. We use ResNet18 backbone and implement
AQ as per the guidelines given in [17] and our best implementation is
presented in Table 5.

Since CUB is a fine-grained classification dataset, the base and novel
categories share greater similarity compared to previous datasets. Hence it
serves as an opportunity to understand how the robustness transfers from base
to novel dataset, i.e whether the similarity in classes acts as a boon or bane
under fine-grained dataset settings. As seen from our experiments, the linear
classifier baseline performs reasonably well indicating that a robust base
classifier transfers to a robust novel classifier. The CNC method also
benefits under such settings and outperforms all other methods on both
Standard and Robust Accuracy.

|  | 1-shot | 5-shot
---|---|---|---
Method | Backbone | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | ResNet18 | 54.27 $\pm$ 0.79 | 28.23 $\pm$ 0.66 | 68.42 $\pm$ 0.62 | 37.10 $\pm$ 0.66
Ours (Linear) | ResNet18 | 51.93 $\pm$ 0.71 | 27.24 $\pm$ 0.64 | 69.83 $\pm$ 0.61 | 37.06 $\pm$ 0.68
Ours (CNC) | ResNet18 | 56.42 $\pm$ 0.78 | 32.18$\pm$ 0.70 | 71.51 $\pm$ 0.60 | 44.33 $\pm$ 0.69

Table 5: Results on CUB dataset. We show that robustness transfers from base
to novel datasets under fine-grained classification setting as well. Our
Linear classifier serves as a strong baseline and our CNC method outperforms
on both metrics.

###  4.4 TieredImageNet

We also consider the large scale dataset TieredImageNet[41], which is a subset
sampled hierarchically from ILSVRC12. We use the standard split of 351 base
classes and 160 novel classes. Each class is a child of one of the 34 more
abstract categories from ImageNet. Hence, the classes are spread differently
compared to MiniImageNet. This allows us to test our method against varying
hardness and diversity of the few-shot categories. The similarity between the
base and novel categories is also varied in this context and shows that our
method performs well under such settings. As seen in Table 6 that the linear
classifier acts as a strong baseline and our CNC method outperforms previous
works.

|  | 1-shot | 5-shot
---|---|---|---
Method | Backbone | Standard | Robust | Standard | Robust
|  | Acc. | Acc. | Acc. | Acc.
AQ | ResNet18 | 49.77 $\pm$ 0.70 | 29.78 $\pm$ 0.65 | 66.72 $\pm$ 0.56 | 43.73 $\pm$ 0.63
Ours (Linear) | ResNet18 | 50.47 $\pm$ 0.69 | 27.90 $\pm$ 0.60 | 68.48 $\pm$ 0.60 | 40.30 $\pm$ 0.65
Ours (CNC) | ResNet18 | 51.38 $\pm$ 0.71 | 30.27 $\pm$ 0.62 | 68.50$\pm$ 0.59 | 44.64$\pm$ 0.66
Table 6: Results on TieredImageNet dataset.

##  5 Discussion

In this section, we provide additional intuition into our method and also
showcase some benefits of our simple framework. We also refer the readers to
appendix for more experiments and analysis.

| Base | Novel | 1-shot | 5-shot
---|---|---|---|---
| Training | Training |  |
Exp. | WA | DC | CNC | Linear | Standard | Robust | Standard | Robust
Id |  |  |  |  | Acc. | Acc. | Acc. | Acc.
1 | ✗ | ✗ | ✗ | ✓ | 41.40 $\pm$ 0.56 | 18.25 $\pm$ 0.45 | 59.30 $\pm$ 0.54 | 27.96 $\pm$ 0.50
2 | ✗ | ✓ | ✗ | ✗ | 43.72 $\pm$ 0.57 | 14.18 $\pm$ 0.38 | 58.04 $\pm$ 0.52 | 13.97 $\pm$ 0.39
3 | ✗ | ✗ | ✓ | ✗ | 42.56 $\pm$ 0.60 | 19.57 $\pm$ 0.45 | 58.22 $\pm$ 0.53 | 30.42 $\pm$ 0.50
4 | ✓ | ✗ | ✗ | ✓ | 42.63 $\pm$ 0.56 | 19.56 $\pm$ 0.45 | 61.35 $\pm$ 0.51 | 30.63 $\pm$ 0.52
5 | ✓ | ✓ | ✗ | ✗ | 44.73 $\pm$ 0.59 | 15.29 $\pm$ 0.41 | 59.78 $\pm$ 0.53 | 19.49 $\pm$ 0.49
6 | ✓ | ✗ | ✓ | ✗ | 44.98 $\pm$ 0.59 | 21.38 $\pm$ 0.46 | 61.30 $\pm$ 0.55 | 33.41 $\pm$ 0.51

Table 7: Illustration of different configurations of Base and Novel training.
Here we show results on ResNet18 backbone on Mini-ImageNet dataset. WA
represents Weight Averaging, DC represents Distribution Calibration and CNC
corresponds to the Calibrated Nearest Centroid classifier.

Analysis : Here, we would like to study the effect of different combinations
of the base and novel training, allowing us to analyse them carefully. We
perform an experiment on Mini-ImageNet dataset on ResNet18 backbone similar to
Table 1 and the results are presented in Table 7. We observe that the simple
baseline of robust base training and training a linear classifier during novel
training works reasonably well which can be a considered a strong baseline
(Exp Id 1,4). We also observe that DC algorithm proposed in [60] improves
standard accuracy but introduces a drop in robustness (Exp Id 2,5). Note that
DC involves hallucination of examples at a feature level and learning a
Logistic Regression Classifier. We believe that one reason for the drop in
robustness is because the final classifier becomes biased to the clean
hallucinated examples, leading to non-robust margins across different classes.
In most configurations we observe that our method matches or even outperforms
the DC method and more importantly improves robustness (Exp Id 5,6). This
shows that the robustness of the base dataset is transferred to the novel
setting and the calibration based Nearest Centroid classifier can improve
robustness in few-shot setting. The impact of weight averaging (WA) method can
be observed when considering Exp Ids 3 and 6. The temporal ensembling nature
of the method helps in finding flatter minima, thereby boosting performance.
Previous works [20] have shown that this can be used for standard robust
classifiers. Here, we observe this holds true under a transfer-learning type
setting. We find that the combination of these methods can lead to improved
performance.

Extension to verifiably robust models: An advantage of our simple framework is
that we can incorporate methods from the adversarial examples literature for
few-shot learning. Specifically, we consider verifiably robust procedures
where the goal is to provide a guarantee on adversarial robustness of the
model. Standard adversarial training methods do not lead to provably robust
models leading to low verified accuracy, we observe a similar trend in our
experiments as well. Many methods have been proposed in this area [32, 64, 11]
and we consider one of them - Interval Bound Propagation (IBP) [19]. This
allows to train a provably robust model whose accuracy does not drop below the
verified accuracy for a given threat model. Here we show that replacing PGD-
training with IBP during the robust base training stage described in section
2.1 can lead to verifiable robustness for few-shot classifiers. We show
results for 1-shot setting in Table 8 where we use a ResNet18 backbone on
CIFAR-FS dataset. We use the training procedure as described in [58] with
$\epsilon=8/255$ for 1000 epochs. Here Robust Accuracy refers to 20-iteration
PGD testing and Verified Accuracy is calculated similar to [19]. We believe
this experiment can encourage researchers to incorporate more advanced
verification methods in the future and develop algorithms for few-shot
settings.

| 1-shot
---|---
Method | Standard | Robust | Verified
| Acc. | Acc. | Acc.
IBP + Linear | 37.01 $\pm$ 0.65 | 26.77 $\pm$ 0.59 | 21.79$\pm$ 0.55
IBP + CNC | 37.72 $\pm$ 0.65 | 28.12 $\pm$ 0.62 | 23.25 $\pm$ 0.61
Table 8: Extension to verifiably robust classifiers. We show that it is
possible to train verifiably robust models for few-shot settings. This is an
added advantage of our framework due to the similarity to standard classifier
training. Results are shown using ResNet18 backbone on CIFAR-FS dataset.

Varying the number of base categories chosen: We plot the variation of mean
Robust Accuracy with number of base neighbors $m$ in Figure 3. When $m=0$, the
method becomes similar to a Nearest Centroid Classifier without calibration.
We find best results with $m=2$ which we use for all our experiments. This
means that centroids from $m=2$ base categories is sufficient to boost the
performance of our model. Note that this calibration step is performed once
prior to the inference and can be considered a preprocessing step, hence not
affecting the inference time. This experiment also allows to study the
relationship between the base and novel datasets, which although have no
overlap in categories share some similarity in terms of transferable abstract
level concepts. Such a setting is difficult to consider for episodic
baselines, since they observe only few categories per task and hence do not
contain information across multiple categories. We would like to emphasize
that we use the same dataset as previous meta-learning based approaches, only
that our base training is standard mini-batch training.

(a) 1-shot

(b) 5-shot

Figure 3: Variation of Robust accuracy with number of base centers $m$ for 1-shot and 5-shot settings | 1-shot
---|---
Method | Standard | Robust
| Acc. | Acc.
Linear No Adv | 42.63 $\pm$ 0.56 | 19.56 $\pm$ 0.45
Linear 7-PGD | 42.00 $\pm$ 0.56 | 18.83 $\pm$ 0.42
Linear 20-PGD | 42.03 $\pm$ 0.58 | 19.01 $\pm$ 0.42
Ours (CNC) | 44.98 $\pm$ 0.59 | 21.38 $\pm$ 0.46
Table 9: Experiment where adversarial examples from few-shot data are included
to perform adversarial training on the linear classifier. No Adv refers to
clean examples used for learning the linear layer. 7-PGD refers to 7-step PGD
and 20-PGD refers to 20-step PGD used in training. Robust Accuracy is
calculated using 20-step PGD. Our method outperforms on both metrics without
increasing computation that arises due to adversarial training.

Using Adversarial examples from few-shot categories: We additionally consider
an experiment where adversarial examples of the few-shot data are used when
learning the linear classifier. Although this makes the learning more complex
due to the adversarial training procedure, we perform this baseline experiment
and learn the linear layer.We use a 7-step PGD and 20-step PGD when learning
the classifier. As seen in Table 9 we observe a drop in performance which
suggests that the network might be biased towards adversary of the few-shot
data. This suggests that creating adversarial examples increases computation
but does not lead to performance gains. Our CNC method outperforms previous
methods without increasing computational burden due to creation of adversarial
examples. This experiment uses ResNet18 backbone on Mini-ImageNet dataset.

##  6 Conclusion

We present a simple and scalable approach for improving robustness in few-shot
image classifiers. Our method outperforms previous approaches when compared
with standard few-shot learning benchmarks on both standard and robust
accuracy. Note that our method is similar to traditional adversarial machine
learning approaches rather than meta-learning methods, hence it becomes easier
to introduce concepts such as certified robustness which is unexplored for
few-shot classifiers. We show preliminary results and plan to explore this
direction in future works. We believe that the simplicity of our approach
would be beneficial to the community, upon which researchers can develop
robust few-shot classifiers.

Acknowledgment: This material is based upon work partially supported by the
United States Air Force under Contract No. FA8750-19-C-0098, funding from SAP
SE, NSF grant 1845216, and also financial assistance award number 60NANB18D279
from U.S. Department of Commerce, National Institute of Standards and
Technology. Any opinions, findings, and conclusions or recommendations
expressed in this material are those of the authors and do not necessarily
reflect the views of the United States Air Force, DARPA, or other funding
agencies.

## References

  * [1] Andrychowicz, M., Denil, M., Gomez, S., Hoffman, M.W., Pfau, D., Schaul, T., Shillingford, B., De Freitas, N.: Learning to learn by gradient descent by gradient descent. arXiv preprint arXiv:1606.04474 (2016)
  * [2] Antoniou, A., Storkey, A., Edwards, H.: Data augmentation generative adversarial networks. arXiv preprint arXiv:1711.04340 (2017)
  * [3] Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: International Conference on Machine Learning. pp. 274–283 (2018)
  * [4] Bertinetto, L., Henriques, J.F., Valmadre, J., Torr, P.H., Vedaldi, A.: Learning feed-forward one-shot learners. arXiv preprint arXiv:1606.05233 (2016)
  * [5] Bishop, C.M.: Pattern Recognition and Machine Learning. Springer (2006)
  * [6] Carlini, N., Wagner, D.: Defensive distillation is not robust to adversarial examples
  * [7] Carlini, N., Wagner, D.: Adversarial examples are not easily detected: Bypassing ten detection methods. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. pp. 3–14. ACM (2017)
  * [8] Chen, T., Zhang, Z., Liu, S., Chang, S., Wang, Z.: Robust overfitting may be mitigated by properly learned smoothening
  * [9] Chen, T., Kornblith, S., Norouzi, M., Hinton, G.: A simple framework for contrastive learning of visual representations. In: International conference on machine learning. pp. 1597–1607. PMLR (2020)
  * [10] Chen, W.Y., Liu, Y.C., Kira, Z., Wang, Y.C.F., Huang, J.B.: A closer look at few-shot classification. arXiv preprint arXiv:1904.04232 (2019)
  * [11] Cohen, J., Rosenfeld, E., Kolter, Z.: Certified adversarial robustness via randomized smoothing. In: International Conference on Machine Learning. pp. 1310–1320. PMLR (2019)
  * [12] Dhillon, G.S., Chaudhari, P., Ravichandran, A., Soatto, S.: A baseline for few-shot image classification. arXiv preprint arXiv:1909.02729 (2019)
  * [13] Feinman, R., Curtin, R.R., Shintre, S., Gardner, A.B.: Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 (2017)
  * [14] Finn, C., Abbeel, P., Levine, S.: Model-agnostic meta-learning for fast adaptation of deep networks. In: International Conference on Machine Learning. pp. 1126–1135. PMLR (2017)
  * [15] Garipov, T., Izmailov, P., Podoprikhin, D., Vetrov, D., Wilson, A.G.: Loss surfaces, mode connectivity, and fast ensembling of dnns. arXiv preprint arXiv:1802.10026 (2018)
  * [16] Gidaris, S., Komodakis, N.: Dynamic few-shot visual learning without forgetting. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 4367–4375 (2018)
  * [17] Goldblum, M., Fowl, L., Goldstein, T.: Robust few-shot learning with adversarially queried meta-learners. arXiv preprint arXiv:1910.00982 (2019)
  * [18] Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: International Conference on Learning Representations (2015), http://arxiv.org/abs/1412.6572
  * [19] Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arandjelovic, R., Mann, T., Kohli, P.: On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715 (2018)
  * [20] Gowal, S., Qin, C., Uesato, J., Mann, T., Kohli, P.: Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 (2020)
  * [21] Grill, J.B., Strub, F., Altché, F., Tallec, C., Richemond, P.H., Buchatskaya, E., Doersch, C., Pires, B.A., Guo, Z.D., Azar, M.G., et al.: Bootstrap your own latent: A new approach to self-supervised learning. arXiv preprint arXiv:2006.07733 (2020)
  * [22] Guo, J., Zhu, X., Zhao, C., Cao, D., Lei, Z., Li, S.Z.: Learning meta face recognition in unseen domains. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (June 2020)
  * [23] Hariharan, B., Girshick, R.: Low-shot visual recognition by shrinking and hallucinating features. In: Proceedings of the IEEE International Conference on Computer Vision. pp. 3018–3027 (2017)
  * [24] He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (June 2016)
  * [25] Hilliard, N., Phillips, L., Howland, S., Yankov, A., Corley, C.D., Hodas, N.O.: Few-shot learning with metric-agnostic conditional embeddings. arXiv preprint arXiv:1802.04376 (2018)
  * [26] Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 4700–4708 (2017)
  * [27] Izmailov, P., Podoprikhin, D., Garipov, T., Vetrov, D., Wilson, A.G.: Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407 (2018)
  * [28] Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 (2016)
  * [29] Li, X., Li, F.: Adversarial examples detection in deep networks with convolutional filter statistics. arXiv preprint arXiv:1612.07767 (2016)
  * [30] Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018), https://openreview.net/forum?id=rJzIBfZAb
  * [31] Maicas, G., Bradley, A.P., Nascimento, J.C., Reid, I., Carneiro, G.: Training medical image analysis systems like radiologists. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 546–554. Springer (2018)
  * [32] Mirman, M., Gehr, T., Vechev, M.: Differentiable abstract interpretation for provably robust neural networks. In: International Conference on Machine Learning. pp. 3578–3586. PMLR (2018)
  * [33] Nichol, A., Achiam, J., Schulman, J.: On first-order meta-learning algorithms. arXiv preprint arXiv:1803.02999 (2018)
  * [34] Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: Security and Privacy (SP), 2016 IEEE Symposium on. pp. 582–597. IEEE (2016)
  * [35] Paszke, A., Gross, S., Chintala, S., Chanan, G., Yang, E., DeVito, Z., Lin, Z., Desmaison, A., Antiga, L., Lerer, A.: Automatic differentiation in pytorch (2017)
  * [36] Qi, H., Brown, M., Lowe, D.G.: Low-shot learning with imprinted weights. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 5822–5830 (2018)
  * [37] Raghunathan, A., Steinhardt, J., Liang, P.: Semidefinite relaxations for certifying robustness to adversarial examples. arXiv preprint arXiv:1811.01057 (2018)
  * [38] Rakelly, K., Shelhamer, E., Darrell, T., Efros, A., Levine, S.: Conditional networks for few-shot semantic segmentation (2018)
  * [39] Ravi, S., Larochelle, H.: Optimization as a model for few-shot learning (2016)
  * [40] Ravichandran, A., Bhotika, R., Soatto, S.: Few-shot learning with embedded class models and shot-free meta training. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 331–339 (2019)
  * [41] Ren, M., Triantafillou, E., Ravi, S., Snell, J., Swersky, K., Tenenbaum, J.B., Larochelle, H., Zemel, R.S.: Meta-learning for semi-supervised few-shot classification. arXiv preprint arXiv:1803.00676 (2018)
  * [42] Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., Berg, A.C., Fei-Fei, L.: ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV) (2015). https://doi.org/10.1007/s11263-015-0816-y
  * [43] Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K., Mądry, A.: Adversarially robust generalization requires more data. arXiv preprint arXiv:1804.11285 (2018)
  * [44] Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J., Studer, C., Davis, L.S., Taylor, G., Goldstein, T.: Adversarial training for free! arXiv preprint arXiv:1904.12843 (2019)
  * [45] Snell, J., Swersky, K., Zemel, R.S.: Prototypical networks for few-shot learning. arXiv preprint arXiv:1703.05175 (2017)
  * [46] Sung, F., Yang, Y., Zhang, L., Xiang, T., Torr, P.H., Hospedales, T.M.: Learning to compare: Relation network for few-shot learning. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 1199–1208 (2018)
  * [47] Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., Fergus, R.: Intriguing properties of neural networks. CoRR abs/1312.6199 (2013), http://arxiv.org/abs/1312.6199
  * [48] Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., Madry, A.: Robustness may be at odds with accuracy. arXiv preprint arXiv:1805.12152 (2018)
  * [49] Tukey, J.W., et al.: Exploratory data analysis, vol. 2. Reading, Mass. (1977)
  * [50] Vinyals, O., Blundell, C., Lillicrap, T., Kavukcuoglu, K., Wierstra, D.: Matching networks for one shot learning. arXiv preprint arXiv:1606.04080 (2016)
  * [51] Wah, C., Branson, S., Welinder, P., Perona, P., Belongie, S.: The caltech-ucsd birds-200-2011 dataset (2011)
  * [52] Wang, G., Luo, C., Sun, X., Xiong, Z., Zeng, W.: Tracking by instance detection: A meta-learning approach. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 6288–6297 (2020)
  * [53] Wang, R., Xu, K., Liu, S., Chen, P.Y., Weng, T.W., Gan, C., Wang, M.: On fast adversarial robustness adaptation in model-agnostic meta-learning. arXiv preprint arXiv:2102.10454 (2021)
  * [54] Wang, Y.X., Girshick, R., Hebert, M., Hariharan, B.: Low-shot learning from imaginary data. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 7278–7286 (2018)
  * [55] Wong, E., Kolter, Z.: Provable defenses against adversarial examples via the convex outer adversarial polytope. In: International Conference on Machine Learning. pp. 5286–5295. PMLR (2018)
  * [56] Wong, E., Schmidt, F.R., Metzen, J.H., Kolter, J.Z.: Scaling provable adversarial defenses. arXiv preprint arXiv:1805.12514 (2018)
  * [57] Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., Yuille, A.L.: Adversarial examples for semantic segmentation and object detection. CoRR abs/1703.08603 (2017), http://arxiv.org/abs/1703.08603
  * [58] Xu, K., Shi, Z., Zhang, H., Wang, Y., Chang, K.W., Huang, M., Kailkhura, B., Lin, X., Hsieh, C.J.: Automatic perturbation analysis for scalable certified robustness and beyond. Advances in Neural Information Processing Systems 33 (2020)
  * [59] Yang, G., Duan, T., Hu, J.E., Salman, H., Razenshteyn, I., Li, J.: Randomized smoothing of all shapes and sizes. In: International Conference on Machine Learning. pp. 10693–10705. PMLR (2020)
  * [60] Yang, S., Liu, L., Xu, M.: Free lunch for few-shot learning: Distribution calibration. In: International Conference on Learning Representations (ICLR) (2021)
  * [61] Yin, C., Tang, J., Xu, Z., Wang, Y.: Adversarial meta-learning. arXiv preprint arXiv:1806.03316 (2018)
  * [62] Zagoruyko, S., Komodakis, N.: Wide residual networks. arXiv preprint arXiv:1605.07146 (2016)
  * [63] Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., Jordan, M.: Theoretically principled trade-off between robustness and accuracy. In: International Conference on Machine Learning. pp. 7472–7482. PMLR (2019)
  * [64] Zhang, H., Chen, H., Xiao, C., Gowal, S., Stanforth, R., Li, B., Boning, D., Hsieh, C.J.: Towards stable and efficient training of verifiably robust neural networks. arXiv preprint arXiv:1906.06316 (2019)

##  Appendix 0.A Appendix

Variation of Robust Accuracy with number of attack iterations: We vary the
number of attack iterations of PGD and observe a fairly stable performance for
both 1-shot and 5-shot settings, as seen in Table 10. This experiment shows
that defense is not sensitive to the number of attack iterations.

| 1-shot | 5-shot
---|---|---
PGD | Robust | Robust
Iterations | Acc. | Acc.
20 | 25.32 $\pm$ 0.52 | 38.83 $\pm$ 0.57
40 | 25.19 $\pm$ 0.53 | 38.46 $\pm$ 0.54
100 | 25.64 $\pm$ 0.53 | 38.22 $\pm$ 0.56
200 | 25.09 $\pm$ 0.54 | 38.62 $\pm$ 0.57

Table 10: Variation of attack iterations

Variation of Robust Accuracy with perturbation budget $\epsilon$: To check for
the absence of gradient masking, we increase $\epsilon$ from 8/255 to 128/255
in Figure 4. As expected, we observe that both 1-shot and 5-shot accuracy drop
to zero with increased $\epsilon$. Note that we plot only the the mean
accuracy over 1000 different tasks.

(a) 1-shot

(b) 5-shot

Figure 4: Variation of Robust Accuracy with different perturbation budget
$\epsilon$

Number of base categories chosen: We plot the variation of standard accuracy
with $m$ in Figure 5 for 1-shot and 5-shot settings. It is to be noted that we
plot only the mean accuracy averaged over 1000 test episodes. We find best
results with $m=2$ which we use for all our experiments.

(a) 1-shot

(b) 5-shot

Figure 5: Variation of Standard accuracy with number of base centers

##  Appendix 0.B Societal Impact

We believe most AI algorithms including ours can be exploited by adversaries
for unethical applications. On the positive side, we are developing algorithms
that make deep networks robust to adversarial attacks, eliminating some of
such undesired applications. Moreover, while publishing such defense
algorithms may enable a larger community to access and benefit from them,
leading to democratized AI, it can also enable adversaries to develop better
attacks.

To ensure that our results are reproducible, we include all implementation
details of our work and also provide code. We believe that readers will have
sufficient knowledge of the hyperparameters associated with our method to
reproduce the results.


# The fate of the Kondo cloud in a superconductor

Cătălin Paşcu Moca  MTA-BME Quantum Dynamics and Correlations Research Group,
Eötvös Loránd Research Network  Department of Physics, University of Oradea,
410087, Oradea, Romania  Ireneusz Weymann  Institute of Spintronics and
Quantum Information, Faculty of Physics, Adam Mickiewicz University, 61-614
Poznań, Poland  Miklós Antal Werner  MTA-BME Quantum Dynamics and Correlations
Research Group, Eötvös Loránd Research Network  Department of Theoretical
Physics, Budapest University of Technology and Economics, Budafoki út 8.,
H-1111 Budapest, Hungary  Gergely Zaránd  MTA-BME Quantum Dynamics and
Correlations Research Group, Eötvös Loránd Research Network  BME-MTA Exotic
Quantum Phases ’Lendület’ Research Group, Institute of Physics, Budapest
University of Technology and Economics, Budafoki út 8., H-1111 Budapest,
Hungary

###### Abstract

Magnetic impurities embedded in a metal are screened by the Kondo effect,
signaled by the formation of an extended correlation cloud, the so-called
Kondo or screening cloud. In a superconductor, the Kondo state turns into sub-
gap Yu-Shiba-Rusinov (Shiba) states, and a quantum phase transition occurs
between screened and unscreened phases once the superconducting energy gap
$\Delta$ becomes sufficiently large compared to the Kondo temperature,
$T_{K}$. Here we show that, although the Kondo state does not form in the
unscreened phase, the Kondo cloud does exist in both quantum phases. However,
while screening is complete in the screened phase, it is only partial in the
unscreened phase. Compensation, a quantity introduced to characterize the
integrity of the cloud, is universal, and shown to be related to the magnetic
impurities’ $g$-factor, monitored experimentally by bias spectroscopy.

#### Introduction.—

One of the most fascinating manifestations of magnetic interactions in metals
is the Kondo effect Hewson (1992), where a local spin interacts with a sea of
non-interacting electrons, to get there completely dissolved by quantum
fluctuations below the so-called Kondo temperature, $T_{K}$. This magic
quantum spin vanish is accompanied by the formation of the so-called _Kondo
cloud_ , as characterized by the ground state correlation function

$C(\mathbf{r})\equiv\langle{\vec{S}}_{\rm
imp}\,\cdot\vec{s}\;(\mathbf{r})\rangle\,,$ (1)

with $\vec{s}\;(\mathbf{r})$ the electrons’ spin density at position
$\mathbf{r}$, and ${\vec{S}}_{\rm imp}$ the spin of the magnetic impurity,
which we assume to be of size $S_{\rm imp}=1/2$, which is typical in quantum
dot devices. The antiferromagnetic correlations in Eq. (1) have been
investigated theoretically Gubernatis  _et al._ (1987); Chen  _et al._ (1987,
1992); Sørensen and Affleck (1996); Barzykin and Affleck (1996); Affleck and
Simon (2001); Costamagna  _et al._ (2006); Hand  _et al._ (2006); Borda
(2007); Affleck  _et al._ (2008); Bergmann (2008); Holzner  _et al._ (2009);
Büsser  _et al._ (2010); Mitchell  _et al._ (2011); Medvedyeva  _et al._
(2013); Lechtenberg and Anders (2014); Ghosh  _et al._ (2014); Nuss  _et al._
(2015); Florens and Snyman (2015) and also attempted to be measured
experimentally by many Boyce and Slichter (1974); Prüser  _et al._ (2011);
Jiang  _et al._ (2011); Figgins  _et al._ (2019). They oscillate fast in
space, and are characterized by an exponentially large length scale, the so-
called Kondo scale, $\xi_{K}\approx v_{F}/T_{K}$, with $v_{F}$ the Fermi
velocity 111We use units $\hbar=k_{B}=1$.. In $D$ spatial dimensions,– apart
from logarithmic corrections Borda (2007); Affleck  _et al._ (2008); Affleck
(2010),– the envelope of $C(r)$ decays as $\sim 1/r^{D}$ at short distances,
$r<\xi_{K}$, while it falls off as $\sim 1/r^{D+1}$ for $r\gg\xi_{K}$. Simple
estimates yield the Kondo scale $\xi_{K}$ as large as $\sim 1\mu\rm m$ in
typical metals, a distance comparable to the physical dimensions of mesoscopic
devices.

The antiferromagnetic correlations residing in this huge Kondo cloud are,
however, quite small, as signaled by the sum rule Borda (2007); Borda  _et
al._ (2009)

$\int\;\langle{\vec{S}}_{\rm imp}\,\cdot\vec{s}\;(\mathbf{r})\rangle\;{\rm
d}^{D}\mathbf{r}=-\frac{3}{4}\;\kappa\;\;,$ (2)

with $\langle\dots\rangle$ referring to the ground state average, and
$\kappa=1$ a certain measure of quantum screening, introduced later. Equation
(2) just expresses that, after all, there is only a _single_ spin that is
needed to forms a singlet state with the impurity, and that this compensating
conduction electron spin is smeared in the Kondo volume, $\sim\xi_{K}^{D}$.
Entanglement entropy Bayat  _et al._ (2010, 2012) calculations and the study
of entanglement witness operators Lee  _et al._ (2015) also corroborate this
picture, and confirm that the local spin’s entanglement, i.e. the Kondo cloud
resides within a distance $\xi_{K}$ from the impurity. Although many
theoretical proposals have been put forward to measure the Kondo cloud by now
Affleck and Simon (2001); Affleck  _et al._ (2008); Park  _et al._ (2013), the
cloud remained elusive for experimentalists for a very long time Boyce and
Slichter (1974); Prüser  _et al._ (2011); Jiang  _et al._ (2011); Figgins  _et
al._ (2019), and its large extension has only been confirmed very recently via
Fabry-Pérot oscillations in a mesoscopic system V. Borzenets  _et al._ (2020).

Figure 1: Schematic ”phase diagram” of the model at zero temperature. When
$\Delta>T_{K}$, the ground state is a doublet with an asymptotically free spin
decoupled from the superconductor, while in the opposite limit, when
$\Delta<T_{K}$, the ground state is a many-body singlet.

In this work we investigate the fate of the Kondo compensation cloud in an
$s$-wave superconductor. In a superconductor, the superconducting gap $\Delta$
competes with the Kondo effect, and prohibits screening of the magnetic
impurity for weak interactions, $T_{K}\ll\Delta$. In this case, the magnetic
impurity spin remains free even at very small temperatures, but it binds
superconducting quasiparticles to itself antiferromagnetically, amounting to
discrete (singlet) sub-gap electron and hole excitations 222These two Shiba
states are not distinct, they are the electronic and hole parts of the same
quantum state, called the Shiba states Yu (1965); Shiba (1968); Rusinov  _et
al._ (1974). Beyond a critical magnetic coupling, i.e. for
$\Delta/T_{K}<(\Delta/T_{K})_{c}\approx 1.1$ 333The critical value depends on
the precise definition of the Kondo temperature, $T_{K}$. Throughout this
work, we define $T_{K}$ as the half-width of the Kondo resonance, i.e., that
of the composite fermion’s spectral function Costi (2000)., a first order
quantum phase transition occurs, and the subgap singlet excitation becomes the
ground state, as illustrated in Fig. 1. A spin $S_{\rm imp}=1/2$ impurity
embedded into a superconductor has therefore two quantum phases, a screened
_singlet phase_ for $\Delta/T_{K}<(\Delta/T_{K})_{c}$, and a _doublet phase_
for $\Delta/T_{K}>(\Delta/T_{K})_{c}$.

Here we investigate the structure of the Kondo compensation cloud in these two
phases. Somewhat surprisingly, we find that the superconductor does _not_
destroy the Kondo cloud even in the unscreened doublet quantum phase, just
reduces the degree of compensation, $\kappa$, from its value $\kappa=1$ in the
singlet phase to $\kappa=\kappa(\Delta/T_{K})<1$ in the doublet quantum phase.
We dub the corresponding fractional compensation cloud as the _Shiba cloud_.
The fractional compensation emerges as a result of the competition of the
Kondo screening length, $\xi_{K}$, and the superconducting correlation length,
$\xi$, and in the doublet phase the extension of the cloud is just the
coherence length, $\xi$, rather than $\xi_{K}$. This enormous extension of the
Shiba cloud is in agreement with recent experiments on side-coupled
superconducting quantum dot devices, measuring the size of Shiba states
Scherübl  _et al._ (2020).

#### Compensation.–-

We first show that Eq. (1) is satisfied with $\kappa=1$ in the singlet phase,
$\Delta/T_{K}<(\Delta/T_{K})_{c}$. To prove Eq. (1), we only need to exploit
SU(2) symmetry and the fact that the ground state $|G\rangle$ is a singlet,
implying that $|G\rangle$ is an eigenstate of the total spin operator,
${\vec{S}}_{T}$, with zero eigenvalue,

${\vec{S}}_{T}|G\rangle=({\vec{S}}_{\rm imp}+\int{\rm
d}^{D}\mathbf{r}\;\vec{s}\;(\mathbf{r}))|G\rangle=0\;.$

Multiplying this equation by $\langle G|\,{\vec{S}}\dots$ from the left and
using ${\vec{S}}_{\rm imp}\cdot{\vec{S}}_{\rm imp}=3/4$ yields immediately Eq.
(2) with $\kappa=1$.

We now show that a similar relation holds even in the doublet phase, but with
$\kappa<1$, defining the degree of _compensation_. In the doublet phase, we
have two degenerate ground states, $|\\!\Uparrow\rangle$ and
$|\\!\Downarrow\rangle$. These two states transform among each other upon the
action of the total spin operators as

${\vec{S}}_{T}|\alpha\rangle=\sum_{\beta}\frac{1}{2}\;{\vec{\sigma}}_{\beta\alpha}|\beta\rangle\,,$

with $\alpha$ and $\beta$ referring to $|\\!\Uparrow\rangle$ and
$|\\!\Downarrow\rangle$, and $\boldsymbol{\sigma}$ the Pauli matrices. Similar
to the spin $S_{T}=0$ case, we now multiply this equation by
$\langle\alpha|\,{\vec{S}}_{\rm imp}\dots$, and average over $\alpha$. On the
right hand side, however, we can now use the Wigner-Eckart theorem, according
to which

$\langle\alpha|{\vec{S}}_{\;{\rm
imp}}|\beta\rangle=g\;\frac{1}{2}{{\vec{\sigma}}\;}_{\alpha\beta}\;,$

with $g$ the $g$-factor of the impurity spin. This immediately yields Eq. (2)
with

$\kappa=1-g\;.$ (3)

For a free spin we have $g=1$, implying no compensation, $\kappa=0$. However,
as we discuss below, for a spin embedded into a superconductor, $g$ becomes
finite due to quantum fluctuations, leading to a partial compensation of the
spin and a squeezed Kondo cloud.

#### Perturbation theory.—

In the limit $\Delta\gg T_{k}$ perturbation theory and a renormalization group
approach can be used to assess the origin of $g$. We consider for that the
Kondo model

$H=J\,{\vec{S}}_{\rm imp}\cdot\vec{s}\;(0)+H_{\rm host}\,,$ (4)

with $J$ the local Kondo coupling, and
$\vec{s}\;(0)=\frac{1}{2}\psi^{\dagger}(0)\mathbold{\sigma}\psi(0)$ the spin
density at the origin, expressed now in terms of the conduction electrons’
field operator,
$\psi_{\sigma}(\mathbf{r})=\sum_{\mathbf{k}}e^{i\mathbf{k}\mathbf{r}}/\sqrt{V}\;c_{\mathbf{k}\sigma}$.
The term $H_{\rm host}$ describes the non-interacting superconducting host,

$H_{\rm
host}=\sum_{\mathbf{k},\sigma}\epsilon_{\mathbf{k}}\,c^{\dagger}_{\mathbf{k}\sigma}c_{\mathbf{k}\sigma}+\sum_{\mathbf{k},\sigma}(\Delta\,c^{\dagger}_{\mathbf{k}\uparrow}c^{\dagger}_{-\mathbf{k}\downarrow}+\text{h.c.})\;.$

To determine $\kappa$, we simply compute $\langle\Uparrow\\!|S_{\rm
imp}^{z}|\\!\\!\Uparrow\rangle=g/2$ perturbatively in $J$. A straightforward
calculation yields Moca  _et al._

$\kappa=1-g=\frac{j_{0}^{2}}{4}\ln\left(\frac{\Lambda_{0}}{\Delta}\right)+{\cal
O}(j_{0}^{3})\;,$ (5)

with $\Lambda_{0}$ a bandwidth cutoff of the order of the Fermi energy, and
$j_{0}=J\varrho_{0}$ the usual dimensionless Kondo coupling, defined by means
of the local density of states at the Fermi energy, $\varrho_{0}$. Clearly,
the compensation contains a logarithmic singularity, which must be handled by
resumming the perturbation series up to infinite order. We have performed this
resummation in subleading (so-called leading logarithmic) order by using the
multiplicative renormalization group (RG) Moca  _et al._ , and exploiting the
invariance of the impurity contribution to the free energy under the RG. This
calculation yields the expression

$\kappa=1-\exp\left[\frac{1}{2}\,{j_{0}}-\frac{1}{2}\,{j(\Delta/T_{K})}\right]\;,$
(6)

with $j(\Delta/T_{K})$ the renormalized exchange coupling,

$j(\Delta/T_{K})\approx\frac{1}{\ln\left(\frac{{\cal
F}\Delta}{T_{K}}\right)-\frac{1}{2}\ln\left(\ln\left(\frac{{\cal
F}\Delta}{T_{K}}\right)\right)}\;.$ (7)

Here $T_{K}=\Lambda_{0}\,{\cal F}\,\sqrt{j_{0}}\,e^{-1/j_{0}}$ denotes the
Kondo temperature in the next to leading logarithmic approximation, with
${\cal F}\approx 2.5$ determined numerically to fit the Kondo temperature,
defined as the half-width of the Kondo resonance Costi (2000). Obviously, in
the limit $j_{0}\to 0$, Eq. (6) becomes a universal function,
$\kappa=\kappa(\Delta/T_{K})$.

#### Numerics.—

Figure 2:  Compensation $\kappa$ across the quantum phase transition as a
function of $\Delta/T_{K}$, for $j_{0}=0.05$. In the fully screened regime,
$\Delta/T_{K}\lesssim 1.1$, $\kappa$ remains $1$, and it displays a universal
jump of size $\Delta\kappa\simeq 0.719$ at the quantum phase transition,
followed by a monotonous decrease in the partially screened regime. Blue and
yellow squares represent DMRG and NRG results, while the solid line presents
the theoretical result, Eq. (6).

To verify the above scenario and to determine the compensation
$\kappa(\Delta/T_{K})$ accurately, we carried out detailed numerical
simulations using numerical renormalization group (NRG) Wilson (1975) as well
as density matrix renormalization group (DMRG) White (1996); Schollwöck (2005)
methods. In both approaches, we can compute the ground state expectation value
of the local spin, extract the $g$-factor from that, and express the
compensation $\kappa$ as

$\kappa=1-2\langle\Uparrow|S_{\rm imp}^{z}|\Uparrow\rangle$ (8)

in the unscreened phase. The results are presented in Fig. 2. They show
perfect agreement with each other, and also with the analytical expressions,
Eqs. (6) and (7). The compensation right at the quantum phase transition is
around $\kappa_{c}\approx 0.28$, thus quantum fluctuations screen around 1/3’d
of the total spin, even in the doublet phase.

The build-up of finite compensation is accompanied by the evolution of the
screening cloud. We can directly monitor this latter in one dimension with
DMRG computations. In the absence of superconductivity,– apart from an
oscillating part $\sim\cos(2\,k_{F}x)$,– spin-spin correlations decays as
$|C(x)|\sim\xi_{K}/x$ at short distances, $x\ll\xi_{K}$, while they fall off
quadratically for $x\gg\xi_{K}$, where $|C(x)|\sim(\xi_{K}/x)^{2}$ Ishii
(1978); Barzykin and Affleck (1996); Affleck  _et al._ (2008); Borda  _et al._
(2009). The power law decay originates in both regimes from electron-hole
excitations. In a superconductor, however, electron-hole excitations of energy
$\delta E<2\Delta$ are forbidden. Correspondingly, the power law behavior is
suppressed beyond the associated superconducting correlation length,
$\xi=\Delta/v_{F}$, beyond which correlations show an exponential decay, as
also demonstrated by perturbation theory (see Ref. Moca  _et al._ ). The Shiba
phase transition occurs right when the Kondo and coherence lengths become
approximately equal, $\xi\approx\xi_{K}$: the spin becomes fully screened
under the condition that the Kondo compensation cloud fits into the coherence
volume $\sim\xi^{D}$.

Figure 3: Envelope for the equal-time spin-spin correlation function $C(x)$
defined in Eq. (1) as a function of the distance from the impurity spin in a
one dimensional chain, as computed by DMRG. For $\Delta=0$, the envelope
function shows the expected universal scaling in the near and far regions. For
$\Delta\neq 0$, the algebraic behavior turns into an exponential decay,
$C(x)\propto\exp(-x/\xi)$, with $\xi=v_{F}/\Delta$ the coherence length.

This behavior is clearly observed in our DMRG simulations performed on a one-
dimensional superconducting lattice, with a Kondo impurity placed at its end
(see Fig. 3). In our simulations, we focused on the case of half filling, and
extracted the envelope function of $C(x)$ from the value of
$C(x)\equiv\langle{\vec{S}}_{\rm imp}\,\cdot\vec{s}\;(x)\rangle$ at the even
sites 444The Fermi momentum $k_{F}=\pi/2$, guarantees that the even sites
corresponding to $x=n\pi/k_{F}$ represents the envelope function itself. For
$\Delta=0$, the envelope function shows the expected behavior of $C(x)\sim
1/x$ and $C(x)\sim 1/x^{2}$ for small and large distances, respectively. The
presence of the superconducting gap alters this behavior fundamentally, and
induces an exponential decay of the form, $C(x)\propto\exp(-x/\xi)$, once $x$
gets larger than $\xi$.

#### Connection to experiments –

Figure 4:  Experimental setup for measuring the compensation $\kappa$. The
quantum dot is coupled to a normal (N), a superconducting (SC), and a
ferromagnetic (FM) lead.

These predictions can be tested experimentally. The degree of compensation, in
particular, can be measured by investigating the magnetic splitting of an
artificial atom (quantum dot), attached to a superconductor, and placed in a
local field, as realized in the setup presented in Fig. 4. The local exchange
field is induced by attaching a ferromagnetic electrode to the quantum dot,
and the strength of this field can be tuned efficiently by shifting the
quantum dot’s level Martinek  _et al._ (2003); Hauptmann  _et al._ (2008);
Hofstetter  _et al._ (2010); Gaass  _et al._ (2011). A tunnel coupling to the
superconductor establishes the exchange coupling, $J$, and gives rise to Kondo
screening Buitelaar  _et al._ (2002); Hofstetter  _et al._ (2010); Deacon  _et
al._ (2010a, b). Finally the third, normal electrode is used used to perform
co-tunneling spectroscopy Scherübl  _et al._ (2020) and thus measure the
exchange field induced splitting Hauptmann  _et al._ (2008); Hofstetter  _et
al._ (2010); Gaass  _et al._ (2011). All elements of this circuit have been
demonstrated experimentally.

#### Conclusions.—

We have investigated the fate of the Kondo cloud of a magnetic impurity
embedded in a superconducting host, and have shown that the impurity’s spin
remains partially compensated by quantum fluctuations even in the
superconducting phase. The extension of the fractional compensation cloud is
just the superconducting correlation length, $\xi$. The degree of compensation
displays a universal jump at the parity changing transition point, and is a
universal function of $\Delta/T_{K}$, which we determined analytically and
numerically, and which can be accessed experimentally by a proposed
experimental set-up.

_Acknowledgments.–_ This research has been supported by the National Research
Development and Innovation Office (NKFIH) through the OTKA Grant FK 132146,
the Hungarian Quantum Technology National Excellence Program under project no.
2017-1.2.1-NKP-2017-00001, and by the NKFIH fund TKP2020 IES (Grant No. BME-
IE-NAT), under the auspices of the Ministry for Innovation and Technology.
Support by the Polish National Science Centre grant No. 2017/27/B/ST3/00621,
and by the Romanian National Authority for Scientific Research and Innovation,
UEFISCDI, under project no. PN-III-P4-ID-PCE-2020-0277 is also acknowledged.

## References

  * Hewson (1992) A. C. Hewson,  _The Kondo Problem to Heavy Fermions_ (Cambridge University Press, 1992).
  * Gubernatis  _et al._ (1987) J. E. Gubernatis, J. E. Hirsch, and D. J. Scalapino, Phys. Rev. B 35, 8478 (1987).
  * Chen  _et al._ (1987) K. Chen, C. Jayaprakash, and H. R. Krishna-Murthy, Phys. Rev. Lett. 58, 929 (1987).
  * Chen  _et al._ (1992) K. Chen, C. Jayaprakash, and H. R. Krishnamurthy, Phys. Rev. B 45, 5368 (1992).
  * Sørensen and Affleck (1996) E. S. Sørensen and I. Affleck, Phys. Rev. B 53, 9153 (1996).
  * Barzykin and Affleck (1996) V. Barzykin and I. Affleck, Phys. Rev. Lett. 76, 4959 (1996).
  * Affleck and Simon (2001) I. Affleck and P. Simon, Phys. Rev. Lett. 86, 2854 (2001).
  * Costamagna  _et al._ (2006) S. Costamagna, C. J. Gazza, M. E. Torio, and J. A. Riera, Phys. Rev. B 74, 195103 (2006).
  * Hand  _et al._ (2006) T. Hand, J. Kroha, and H. Monien, Phys. Rev. Lett. 97, 136604 (2006).
  * Borda (2007) L. Borda, Phys. Rev. B 75, 041307 (2007).
  * Affleck  _et al._ (2008) I. Affleck, L. Borda, and H. Saleur, Phys. Rev. B 77, 180404 (2008).
  * Bergmann (2008) G. Bergmann, Phys. Rev. B 77, 104401 (2008).
  * Holzner  _et al._ (2009) A. Holzner, I. P. McCulloch, U. Schollwöck, J. von Delft, and F. Heidrich-Meisner, Phys. Rev. B 80, 205114 (2009).
  * Büsser  _et al._ (2010) C. A. Büsser, G. B. Martins, L. Costa Ribeiro, E. Vernek, E. V. Anda, and E. Dagotto, Phys. Rev. B 81, 045111 (2010).
  * Mitchell  _et al._ (2011) A. K. Mitchell, M. Becker, and R. Bulla, Phys. Rev. B 84, 115120 (2011).
  * Medvedyeva  _et al._ (2013) M. Medvedyeva, A. Hoffmann, and S. Kehrein, Phys. Rev. B 88, 094306 (2013).
  * Lechtenberg and Anders (2014) B. Lechtenberg and F. B. Anders, Phys. Rev. B 90, 045117 (2014).
  * Ghosh  _et al._ (2014) S. Ghosh, P. Ribeiro, and M. Haque, Journal of Statistical Mechanics: Theory and Experiment 2014, P04011 (2014).
  * Nuss  _et al._ (2015) M. Nuss, M. Ganahl, E. Arrigoni, W. von der Linden, and H. G. Evertz, Phys. Rev. B 91, 085127 (2015).
  * Florens and Snyman (2015) S. Florens and I. Snyman, Phys. Rev. B 92, 195106 (2015).
  * Boyce and Slichter (1974) J. B. Boyce and C. P. Slichter, Phys. Rev. Lett. 32, 61 (1974).
  * Prüser  _et al._ (2011) H. Prüser, M. Wenderoth, P. E. Dargel, A. Weismann, R. Peters, T. Pruschke, and R. G. Ulbrich, Nature Physics 7, 203 (2011).
  * Jiang  _et al._ (2011) Y. Jiang, Y. N. Zhang, J. X. Cao, R. Q. Wu, and W. Ho, Science 333, 324 (2011).
  * Figgins  _et al._ (2019) J. Figgins, L. S. Mattos, W. Mar, Y.-T. Chen, H. C. Manoharan, and D. K. Morr, Nature Communications 10, 5588 (2019).
  * Note (1) We use units $\hbar=k_{B}=1$.
  * Affleck (2010) I. Affleck, “The kondo screening cloud: what it is and how to observe it,” (2010), arXiv:0911.2209 [cond-mat.mes-hall] .
  * Borda  _et al._ (2009) L. Borda, M. Garst, and J. Kroha, Phys. Rev. B 79, 100408 (2009).
  * Bayat  _et al._ (2010) A. Bayat, P. Sodano, and S. Bose, Phys. Rev. B 81, 064429 (2010).
  * Bayat  _et al._ (2012) A. Bayat, S. Bose, P. Sodano, and H. Johannesson, Phys. Rev. Lett. 109, 066403 (2012).
  * Lee  _et al._ (2015) S.-S. B. Lee, J. Park, and H.-S. Sim, Phys. Rev. Lett. 114, 057203 (2015).
  * Park  _et al._ (2013) J. Park, S.-S. B. Lee, Y. Oreg, and H.-S. Sim, Phys. Rev. Lett. 110, 246603 (2013).
  * V. Borzenets  _et al._ (2020) I. V. Borzenets, J. Shim, J. C. H. Chen, A. Ludwig, A. D. Wieck, S. Tarucha, H.-S. Sim, and M. Yamamoto, Nature 579, 210 (2020).
  * Note (2) These two Shiba states are not distinct, they are the electronic and hole parts of the same quantum state.
  * Yu (1965) L. Yu, Acta Physica Sinica 21, 115304 (1965).
  * Shiba (1968) H. Shiba, Progress of theoretical Physics 40, 435 (1968).
  * Rusinov  _et al._ (1974) A. I. Rusinov, D. C. Kat, and Y. V. Kopaev, Journal of Experimental and Theoretical Physics 38, 991 (1974).
  * Note (3) The critical value depends on the precise definition of the Kondo temperature, $T_{K}$. Throughout this work, we define $T_{K}$ as the half-width of the Kondo resonance, i.e., that of the composite fermion’s spectral function Costi (2000).
  * Scherübl  _et al._ (2020) Z. Scherübl, G. Fülöp, C. P. Moca, J. Gramich, A. Baumgartner, P. Makk, T. Elalaily, C. Schönenberger, J. Nygård, G. Zaránd, and S. Csonka, Nature Communications 11, 1834 (2020).
  * (39) C. P. Moca, I. Weymann, M. A. Werner, and G. Zarand, Supplementary Material .
  * Costi (2000) T. A. Costi, Phys. Rev. Lett. 85, 1504 (2000).
  * Wilson (1975) K. G. Wilson, Rev. Mod. Phys. 47, 773 (1975).
  * White (1996) S. R. White, Phys. Rev. Lett. 77, 3633 (1996).
  * Schollwöck (2005) U. Schollwöck, Rev. Mod. Phys. 77, 259 (2005).
  * Ishii (1978) H. Ishii, Journal of Low Temperature Physics 32, 457 (1978).
  * Note (4) The Fermi momentum $k_{F}=\pi/2$, guarantees that the even sites corresponding to $x=n\pi/k_{F}$ represents the envelope function itself.
  * Martinek  _et al._ (2003) J. Martinek, Y. Utsumi, H. Imamura, J. Barnaś, S. Maekawa, J. König, and G. Schön, Phys. Rev. Lett. 91, 127203 (2003).
  * Hauptmann  _et al._ (2008) J. R. Hauptmann, J. Paaske, and P. E. Lindelof, Nature Physics 4, 373 (2008).
  * Hofstetter  _et al._ (2010) L. Hofstetter, A. Geresdi, M. Aagesen, J. Nygård, C. Schönenberger, and S. Csonka, Phys. Rev. Lett. 104, 246804 (2010).
  * Gaass  _et al._ (2011) M. Gaass, A. K. Hüttel, K. Kang, I. Weymann, J. von Delft, and C. Strunk, Phys. Rev. Lett. 107, 176808 (2011).
  * Buitelaar  _et al._ (2002) M. R. Buitelaar, T. Nussbaumer, and C. Schönenberger, Phys. Rev. Lett. 89, 256801 (2002).
  * Deacon  _et al._ (2010a) R. S. Deacon, Y. Tanaka, A. Oiwa, R. Sakano, K. Yoshida, K. Shibata, K. Hirakawa, and S. Tarucha, Phys. Rev. Lett. 104, 076805 (2010a).
  * Deacon  _et al._ (2010b) R. S. Deacon, Y. Tanaka, A. Oiwa, R. Sakano, K. Yoshida, K. Shibata, K. Hirakawa, and S. Tarucha, Phys. Rev. B 81, 121308 (2010b).
  * Fowler and Zawadowski (1971) M. Fowler and A. Zawadowski, Solid State Communications 9, 471 (1971).
  * Schlottmann (1982) P. Schlottmann, Phys. Rev. B 25, 4815 (1982).
  * Bulla  _et al._ (2008) R. Bulla, T. A. Costi, and T. Pruschke, Rev. Mod. Phys. 80, 395 (2008).
  * Tóth  _et al._ (2008) A. I. Tóth, C. P. Moca, O. Legeza, and G. Zaránd, Phys. Rev. B 78, 245109 (2008).
  * Legeza  _et al._ (2008) O. Legeza, C. P. Moca, A. I. Toth, I. Weymann, and G. Zarand, “Manual for the Flexible DM-NRG code,” (2008), arXiv:0809.3143 [cond-mat.str-el] .
  * Moca  _et al._ (2012) C. P. Moca, A. Alex, J. von Delft, and G. Zaránd, Phys. Rev. B 86, 195128 (2012).
  * (59) O. Legeza, C. P. Moca, A. I. Toth, I. Weymann, and G. Zarand, “Flexible DM-NRG code, http://www.phy.bme.hu/~dmnrg/,” .

##  I Supplemental Information

Here we present certain details of the perturbative and renormalization group
calculations outlined in the main paper, and give some further details on the
numerical renormalization group computations.

###  I.1 Perturbation theory

We consider an $S_{\rm imp}={1\over 2}$ impurity spin embedded in an s-wave
BCS superconductor, with the impurity coupled to the spin density at position
$\mathbf{r}=0$. The Hamiltonian, as already given in the main text, is the sum
of the Kondo interaction,

$H_{\rm K}=J\,{\vec{S}}_{\rm imp}\cdot\boldsymbol{s}(0),$ (9)

and the BCS Hamiltonian

$H_{\rm
host}=\sum_{\mathbf{k},\sigma}\epsilon_{\mathbf{k}}\,c^{\dagger}_{\mathbf{k}\sigma}c_{\mathbf{k}\sigma}+\sum_{\mathbf{k},\sigma}(\Delta\,c^{\dagger}_{\mathbf{k}\uparrow}c^{\dagger}_{-\mathbf{k}\downarrow}+\text{h.c.})\;.$
(10)

The spin density at $\mathbf{r}=0$ is given by $\boldsymbol{s}(0)={1\over
2}\sum_{\mathbf{k},\mathbf{k}^{\prime},\sigma\sigma^{\prime}}c^{\dagger}_{\mathbf{k}\sigma}\boldsymbol{\sigma}_{\sigma\sigma^{\prime}}c_{\mathbf{k}^{\prime}\sigma^{\prime}}$,
where $c^{\dagger}_{\mathbf{k}\sigma}$ denotes the creation operator of
electrons with momentum $\mathbf{k}$ and spin $\sigma$. The energy
$\epsilon_{\mathbf{k}}$ is measured with respect to the Fermi energy
($\epsilon_{\mathbf{k}}=0\leftrightarrow E_{F}$), and we assume half filling.
We perform a perturbative calculation in $J$ in the free spin regime,
$T_{K}\ll\Delta$, and compute the expectation value $\langle{\vec{S}}^{z}_{\rm
imp}\rangle$. In the non-interacting limit, $J=0$, the unperturbed ground
state is a direct product of the BCS ground state and the impurity spin,
$|\phi_{0}\rangle=|\rm{BCS}\rangle\otimes|\Uparrow\rangle$. Here, we assume
the presence of a small external magnetic field, which lifts the spin
degeneracy and selects the spin up state. First order of perturbation yields a
state $|\phi\rangle=|\phi_{0}\rangle+|\delta\phi\rangle$, with

$|\delta\phi\rangle=-{J\over
2}\,\sum_{\sigma\sigma^{\prime}}\sum_{\begin{subarray}{c}\mathbf{k},\mathbf{k}^{\prime}\\\
\epsilon_{\mathbf{k}}>0\\\
\epsilon_{\mathbf{k}^{\prime}}<0\end{subarray}}{{{\vec{S}}_{\rm imp}}\over
E_{\mathbf{k}}+E_{\mathbf{k}^{\prime}}}\,c^{\dagger}_{\mathbf{k}\sigma}\;{\vec{\sigma}}_{\sigma\sigma^{\prime}}\;c_{\mathbf{k}^{\prime}\sigma^{\prime}}|\rm
BCS\rangle\otimes|\Uparrow\rangle,$

with $E_{\mathbf{k}}=\sqrt{\epsilon_{\mathbf{k}}^{2}+\Delta^{2}}$ the
quasiparticles’ excitation energy. Second order corrections to the wave
function can be shown to cancel and, to order ${\cal O}(J^{2})$, the
expectation value of the impurity spin $\langle S^{z}_{\rm imp}\rangle$ is
given by

$\langle S^{z}_{\rm imp}\rangle=\frac{\langle\phi|S^{z}_{\rm
imp}|\phi\rangle}{\langle\phi|\phi\rangle}\simeq{1\over 2}\left\\{1-{1\over
4}J^{2}\sum_{\mathbf{k}\mathbf{k}^{\prime}}\frac{1}{(E_{\mathbf{k}}+E_{\mathbf{k}^{\prime}})^{2}}\right\\}.$

Replacing the momentum sums by integrals
$\sum_{\mathbf{k}}\to\rho_{0}\int_{-\Lambda_{0}}^{\Lambda_{0}}\text{d}\epsilon$,
we obtain with logarithmic precision

$\langle S^{z}_{\rm imp}\rangle={1\over 2}\left\\{1-{1\over
4}j_{0}^{2}\ln(\Lambda_{0}/\Delta)+{\cal O}(j_{0}^{3})\right\\},$ (11)

where $j_{0}=\varrho_{0}J$ is the dimensionless exchange coupling. This is
just Eq. (5) of the main text.

We can also use the same approach to compute the correlation
$\langle{\vec{S}}_{\rm imp}\cdot\vec{s}\;(x)\rangle$ in a one dimensional
version of the model, where we replace $H_{\rm host}$ by

$\displaystyle H_{\rm chain}$ $\displaystyle=$
$\displaystyle-t\sum_{x=1}^{L-1}\sum_{\sigma}\big{(}c^{\dagger}_{x\,\sigma}c_{x+1\,\sigma}+{\rm
h.c.}\big{)}\phantom{nnn}$
$\displaystyle\phantom{n}+\;\sum_{x=1}^{L}\big{(}\Delta\;c^{\dagger}_{x\uparrow}c^{\dagger}_{x\downarrow}+\text{h.c.}\big{)},$

and couple the impurity spin to the spin density at the first site,
${\vec{s}\;}={1\over 2}\;c^{\dagger}_{1}\,{{{\vec{\sigma}}\;}}\,c_{1}$.
Hamiltonian (I.1) can be solved directly in real space by using the density
matrix renormalization group (DMRG) approach. Figure 5 compares the results of
a complete DMRG computation and those of second order perturbation theory,
which are demonstrated to provide good approximation for
$\langle{\vec{S}}_{\rm imp}\cdot\vec{s}\;(x)\rangle$, away from the quantum
phase transition.

Figure 5:  Comparison of the perturbative and DMRG results for the envelope of
spin-spin correlator in a one-dimensional superconducting chain. The system
size is fixed to $L=200$ sites, $J/t=1.8$, corresponding to $j_{0}=0.28$, and
$\Delta/t=0.1$. With these parameters $\Delta/T_{K}=2.45$.

###  I.2 Multiplicative renormalization group approach

In this section we show, how one can derive Eqs. (6) and (7) by means of the
multiplicative renormalization group approach. The multiplicative
renormalization group for the Kondo problem is best formulated in terms of
pseudofermions, $f^{\dagger}_{s}$, used to express the spin operator as
${\vec{S}}_{\rm
imp}=\sum_{s,s^{\prime}}f^{\dagger}_{s}{\vec{S}}_{ss^{\prime}}f_{s^{\prime}}$
with the additional constraint, $\sum_{s}f^{\dagger}_{s}f_{s}\equiv 1$. In
this language, the impurity part of the Hamiltonian is

$H_{\rm
imp}=\frac{J}{2}\,\sum_{\sigma,\sigma^{\prime},s,s^{\prime}}f^{\dagger}_{s}{\vec{S}}_{ss^{\prime}}f_{s^{\prime}}\cdot\psi^{\dagger}_{\sigma}{{\vec{\sigma}}\;}_{\sigma\sigma^{\prime}}\psi_{\sigma^{\prime}}-h\sum_{s}s\,f^{\dagger}_{s}f_{s},$
(13)

with $\psi=\psi(0)$ the electrons’ field operator at the impurity site, and
the second term a Zeeman field, $h$, acting on the impurity spin.

Thermodynamics as well as dynamical correlations can then be formulated in
terms of the pseudofermions’ unperturbed Green’s function, ${\cal
G}^{(0)}_{ss^{\prime}}(\tau)\equiv-i\langle{\rm
T}_{\tau}f_{s}(\tau)f^{\dagger}_{s^{\prime}}(0)\rangle_{0}$, the conduction
electrons’ unperturbed local Green’s function,
${G}_{\sigma\sigma^{\prime}}^{(0)}(\tau)\equiv-i\langle{\rm
T}_{\tau}\psi_{\sigma}(\tau)\psi^{\dagger}_{\sigma^{\prime}}(0)\rangle_{0}$,
and the vertex,
$\Gamma^{(0)}_{s\sigma,s^{\prime}\sigma^{\prime}}=\frac{J}{2}\;{\vec{S}}_{ss^{\prime}}\cdot{{\vec{\sigma}}\;}_{\sigma\sigma^{\prime}}$.
Similar to quantum electrodynamics, multiplicative renormalization is a
transformation

$\Lambda\to\Lambda^{\prime},\quad J\to J^{\prime},\quad h\to h^{\prime},$ (14)

which transforms the electron-impurity vertex function, $\Gamma$, and the
impurity’s dressed Green’s function $\cal G$ multiplicatively,

${\cal G}\to Z\,{\cal G},\quad\Gamma\to Z^{-1}\,\Gamma\;,$

while it leaves the impurity contribution to the free energy, $F_{\rm imp}$
unchanged. This transformation can be formulated in terms of simple scaling
equations Fowler and Zawadowski (1971); Schlottmann (1982)

$\displaystyle\frac{\text{d}j}{\text{d}l}$ $\displaystyle=$ $\displaystyle
j^{2}-\frac{1}{2}j^{3}+\dots\;,$ (15) $\displaystyle\frac{\text{d}\ln
h}{\text{d}l}$ $\displaystyle=$
$\displaystyle-\frac{1}{2}j^{2}+\dots=-\frac{1}{2}\frac{\text{d}j}{\text{d}l}+\dots\;\;,$
(16)

where $l=\ln(\Lambda_{0}/\Lambda^{\prime})$ denotes the scaling variable,
$j=J\varrho_{0}$ is the dimensionless coupling and we have displayed terms
appearing only in the next to leading logarithmic order. These equations are
valid for $\omega,\Lambda^{\prime}\gg\Delta$, where the gap has only little
effect and can therefore be disregarded, and must be solved with the initial
condition, $j(\Lambda^{\prime}\to\Lambda_{0})=j_{0}$.

To compute the expectation value of the spin in the presence of a finite gap,
$\Delta$, we first notice that the size of the spin can be obtained as

$\langle\Uparrow|S_{\rm imp}^{z}|\Uparrow\rangle=\lim_{h\to
0^{+}}\frac{-1}{k_{B}T}\frac{\partial}{\partial h}F_{\rm
imp}(j,h,\Lambda_{0})\;.$ (17)

However, the impurity’s free energy is invariant under the renormalization
group, implying that

$\frac{\partial}{\partial h}F_{\rm imp}(j,h,\Lambda_{0})\;=\frac{\partial
h^{\prime}}{\partial h}\;\frac{\partial}{\partial h^{\prime}}F_{\rm
imp}(j^{\prime},h^{\prime},\Lambda^{\prime})\;,$ (18)

and therefore

$\langle\Uparrow|S_{\rm
imp}^{z}|\Uparrow\rangle_{j,\Lambda_{0}}=\left(\frac{\partial
h^{\prime}}{\partial h}\right)\;\langle\Uparrow|S_{\rm
imp}^{z}|\Uparrow\rangle_{j^{\prime},\Lambda^{\prime}}\;.$ (19)

If we now set the renormalized bandwidth equal to the superconducting gap,
$\Lambda^{\prime}\to\Delta$, then we have no more conduction electrons, and
the impurity remains unscreened: $\langle\Uparrow|S_{\rm
imp}^{z}|\Uparrow\rangle=1/2$. The prefactor in Eq. (19) is thus just the
$g$-factor, which we can determine by simply integrating Eq. (16) to yield

$g=\frac{\partial h^{\prime}}{\partial
h}=\exp\Big{\\{}-\frac{1}{2}(j_{\Delta}-j_{0})\Big{\\}}\;,$ (20)

with $j_{\Delta}=j^{\prime}(\Lambda^{\prime}\to\Delta)$. This amounts to
$\kappa=1-g$, given by Eq. (6).

To derive Eq. (7), we integrate (15) to obtain

$\ln\frac{\Lambda_{0}}{\Lambda^{\prime}}=f(j^{\prime})-f(j_{0})$ (21)

with the function $f(j)$ given as

$f(j)=-\frac{1}{j}+\frac{1}{2}\ln\,j-\frac{1}{2}\ln\big{(}1-\frac{j}{2}\big{)}\;.$
(22)

The Kondo temperature is determined by the condition that the effective
coupling be of a value $j^{\prime}\equiv j^{*}\sim 1$,

$\ln\frac{\Lambda_{0}}{T_{K}}=f(j^{*})-f(j_{0})\;.$ (23)

Combining this with Eq. (21), we arrive at the equation,

$\ln\frac{\Lambda^{\prime}}{T_{K}}=f(j^{*})-f(j^{\prime})\;.$ (24)

Setting now $\Lambda^{\prime}\to\Delta$ we thus obtain the implicit equation

$\frac{1}{j}_{\Delta}=\ln\frac{\Delta}{T_{K}}-C+\frac{1}{2}\ln\,j_{\Delta}+\frac{j_{\Delta}}{4}+\dots\;,$
(25)

where $C=f(j^{*})$. An iterative solution of this equation gives

$j_{\Delta}\approx\frac{1}{\ln\left(\frac{{\cal
F}\Delta}{T_{K}}\right)-\frac{1}{2}\ln\left(\ln\left(\frac{{\cal
F}\Delta}{T_{K}}\right)\right)+\frac{1}{4\ln\left(\frac{{\cal
F}\Delta}{T_{K}}\right)}}\;,$ (26)

with ${\cal F}=e^{-C}$. Dropping the last, negligible term yields the
expression in the main text. The value of $j^{*}$ and thus that of $\cal F$ is
somewhat arbitrary. We set it such that the resulting Kondo scale,
$T_{K}={\cal F}\;\Lambda_{0}\;\sqrt{j_{0}}\;\exp(-1/j_{0})$ be identical to
the Kondo scale extracted from the NRG calculations, defined there as the
half-width of the so-called composite fermion’s resonance (see next
subsection). This yields the value, ${\cal F}\approx 2.5$, which allows us to
compare the perturbative and numerical calculations without any other
adjustable parameter.

###  I.3 Details of NRG calculations

Figure 6: The spectral function for the composite fermion operator calculated
for various values of the exchange coupling $j_{0}$. The Kondo temperature
$T_{K}$ is determined as the half width at half maximum of the spectral
function resonance. The calculation is done at zero temperature.

In the strongly correlated regime, where the Kondo correlations are dominant,
the numerical renormalization group (NRG) method provides accurate predictions
Wilson (1975); Bulla  _et al._ (2008). Contrary to DMRG, NRG works in the
energy space, where it uses a logarithmic discretizition, allowing one to
reach very small energy scales. The NRG Hamiltonian defined on the Wilson
chain for our problem has the form

$\displaystyle H_{\rm NRG}$ $\displaystyle=$ $\displaystyle J\;{\vec{S}}_{\rm
imp}\cdot{\vec{s}}_{0}+\sum_{i=0,\sigma}^{N}\xi_{i}\big{(}f^{\dagger}_{i\sigma}f_{i+1\sigma}+h.c.\big{)}$
(27) $\displaystyle+$
$\displaystyle\Delta\sum_{i=0}^{N}\big{(}f^{\dagger}_{i\uparrow}f^{\dagger}_{i\downarrow}+h.c.\big{)},$

where the impurity spin is coupled by the Kondo exchange to the local spin at
site 0. In Eq. (27), $N$ is the length of the chain, and $\xi_{i}$ denotes
hopping amplitudes, exponentially decreasing along the chain. The operator
$f^{\dagger}_{i\sigma}$ denotes the creation operator at site $i$ for a
fermion with spin $\sigma$, and ${\vec{s}}_{0}={1\over
2}\sum_{\sigma\sigma^{\prime}}f^{\dagger}_{0\sigma}{\vec{\sigma}}_{\sigma\sigma^{\prime}}f_{0\sigma^{\prime}}$
is the spin density at site $i=0$.

We solve the Hamiltonian (27) iteratively, by keeping at least $1024$ lowest-
energy eigenstates at each step of the iteration, and by exploiting the U(1)
symmetry associated with the conservation of the total $S_{z}$ spin component.
For these computations, we have used our open access flexible DM-NRG code Tóth
_et al._ (2008); Legeza  _et al._ (2008); Moca  _et al._ (2012); Legeza  _et
al._ .

The Kondo temperature is determined as the half width at half maximum of the
spectral function of the composite fermion, $F^{\dagger}={\vec{S}}_{\rm
imp}\cdot{{\vec{\sigma}}\;}\,f^{\dagger}_{0}$. Typical results for the
composite fermion spectral function are displayed in Fig. 6, together with the
corresponding values of dimensionless couplings, $j_{0}$, and Kondo
temperatures, $T_{K}$. This comparison allows us to extract the prefactor
${\cal F}\approx 2.5$ in Eq. (7).

###  I.4 Details of DMRG calculations

For the DMRG calculation we used the two-site approach introduced by White
White (1996) within the matrix product state formalism Schollwöck (2005). The
chain Hamiltonian is given by Eq. (I.1), and the impurity spin is coupled to
the first site. To determine the ground state and compute the spin-spin
correlator we used the $U(1)$ symmetry for the $z$ component of the total spin
$S_{T}^{z}$. The chain length used in the calculations was in general fixed to
$L=200$, but larger chain lengths, up to $L=400$ were also tested. The bond
dimension $M$ was fixed in between $400$ to $1000$.

For each set of parameters the ground state was computed in the $S_{T}=0$ and
$S_{T}=1/2$ sectors, which allowed us to capture the parity changing
transition. Our findings for the phase diagram using DMRG match those obtained
by using the NRG approach.