The ability to fool deep learning classifiers with tiny perturbations of the
input has lead to the development of adversarial training in which the loss
with respect to adversarial examples is minimized in addition to the training
examples. While adversarial training improves the robustness of the learned
classifiers, the procedure is computationally expensive, sensitive to
hyperparameters and may still leave the classifier vulnerable to other types of
small perturbations. In this paper we analyze the adversarial robustness of the
1 Nearest Neighbor (1NN) classifier and compare its performance to adversarial
training. We prove that under reasonable assumptions, the 1 NN classifier will
be robust to {\em any} small image perturbation of the training images and will
give high adversarial accuracy on test images as the number of training
examples goes to infinity. In experiments with 45 different binary image
classification problems taken from CIFAR10, we find that 1NN outperform TRADES
(a powerful adversarial training algorithm) in terms of average adversarial
accuracy. In additional experiments with 69 pretrained robust models for
CIFAR10, we find that 1NN outperforms almost all of them in terms of robustness
to perturbations that are only slightly different from those seen during
training. Taken together, our results suggest that modern adversarial training
methods still fall short of the robustness of the simple 1NN classifier. our
code can be found at
this https URL

在这篇论文中，我们分析了 1 Nearest Neighbor（1NN）分类器的对抗鲁棒性，并将其性能与对抗性训练进行了比较。通过实验证明，在来自 CIFAR10 的 45 个不同二进制图像分类问题上，1NN 在平均对抗准确性方面优于 TRADES（一种强大的对抗性训练算法）。此外，对于与训练期间稍有不同的扰动，我们的实验结果表明，1NN 在 69 个经预训练的 CIFAR10 的鲁棒模型中超过了几乎所有模型。综上所述，我们的结果表明，现代对抗性训练方法仍然无法达到简单的 1NN 分类器的鲁棒性。