The ability to fool deep learning classifiers with tiny perturbations of the
input has lead to the development of adversarial training in which the loss
with respect to adversarial examples is minimized in addition to the training
examples. While adversarial training improves the robustness of the learned
classifiers, the procedure is computationally expensive, sensitive to
hyperparameters and may still leave the classifier vulnerable to other types of
small perturbations. In this paper we analyze the adversarial robustness of the
1 Nearest Neighbor (1NN) classifier and compare its performance to adversarial
training. We prove that under reasonable assumptions, the 1 NN classifier will
be robust to {\em any} small image perturbation of the training images and will
give high adversarial accuracy on test images as the number of training
examples goes to infinity. In experiments with 45 different binary image
classification problems taken from CIFAR10, we find that 1NN outperform TRADES
(a powerful adversarial training algorithm) in terms of average adversarial
accuracy. In additional experiments with 69 pretrained robust models for
CIFAR10, we find that 1NN outperforms almost all of them in terms of robustness
to perturbations that are only slightly different from those seen during
training. Taken together, our results suggest that modern adversarial training
methods still fall short of the robustness of the simple 1NN classifier. our
code can be found at
this https URL

在这篇论文中，我们分析了 1 Nearest Neighbor（1NN）分类器的对抗鲁棒性，并将其性能与对抗性训练进行了比较。通过实验证明，在来自 CIFAR10 的 45 个不同二进制图像分类问题上，1NN 在平均对抗准确性方面优于 TRADES（一种强大的对抗性训练算法）。此外，对于与训练期间稍有不同的扰动，我们的实验结果表明，1NN 在 69 个经预训练的 CIFAR10 的鲁棒模型中超过了几乎所有模型。综上所述，我们的结果表明，现代对抗性训练方法仍然无法达到简单的 1NN 分类器的鲁棒性。

关于对抗训练和最近邻分类器的研究

On adversarial training and the 1 Nearest Neighbor classifier

Over the past few years, there has been significant interest in Quantum
Machine Learning (QML) among researchers, as it has the potential to transform
the field of machine learning. Several models that exploit the properties of
quantum mechanics have been developed for practical applications. In this
study, we investigated the application of our previously proposed quantum
pre-processing filter (QPF) to binary image classification. We evaluated the
QPF on four datasets: MNIST (handwritten digits), EMNIST (handwritten digits
and alphabets), CIFAR-10 (photographic images) and GTSRB (real-life traffic
sign images). Similar to our previous multi-class classification results, the
application of QPF improved the binary image classification accuracy using
neural network against MNIST, EMNIST, and CIFAR-10 from 98.9% to 99.2%, 97.8%
to 98.3%, and 71.2% to 76.1%, respectively, but degraded it against GTSRB from
93.5% to 92.0%. We then applied QPF in cases using a smaller number of training
and testing samples, i.e. 80 and 20 samples per class, respectively. In order
to derive statistically stable results, we conducted the experiment with 100
trials choosing randomly different training and testing samples and averaging
the results. The result showed that the application of QPF did not improve the
image classification accuracy against MNIST and EMNIST but improved it against
CIFAR-10 and GTSRB from 65.8% to 67.2% and 90.5% to 91.8%, respectively.
Further research will be conducted as part of future work to investigate the
potential of QPF to assess the scalability of the proposed approach to larger
and complex datasets.

通过研究，我们评估了量子预处理过滤器 (QPF) 在二进制图像分类中的应用，并发现其对 MNIST、EMNIST 和 CIFAR-10 的图像分类准确率有所改善，但对 GTSRB 的分类准确率有所降低，并发现 QPF 在样本较少的情况下能提升图像分类准确率。为了进一步研究其潜力，我们将在未来的工作中探索 QPF 方法在更大且复杂数据集中的可扩展性。