The ability to fool deep learning classifiers with tiny perturbations of the input has lead to the development of adversarial training in which the loss with respect to adversarial examples is minimized in addition to the training examples. While adversarial training improves the robustness of the learned classifiers, the procedure is computationally expensive, sensitive to hyperparameters and may still leave the classifier vulnerable to other types of small perturbations. In this paper we analyze the adversarial robustness of the 1 Nearest Neighbor (1NN) classifier and compare its performance to adversarial training. We prove that under reasonable assumptions, the 1 NN classifier will be robust to {\em any} small image perturbation of the training images and will give high adversarial accuracy on test images as the number of training examples goes to infinity. In experiments with 45 different binary image classification problems taken from CIFAR10, we find that 1NN outperform TRADES (a powerful adversarial training algorithm) in terms of average adversarial accuracy. In additional experiments with 69 pretrained robust models for CIFAR10, we find that 1NN outperforms almost all of them in terms of robustness to perturbations that are only slightly different from those seen during training. Taken together, our results suggest that modern adversarial training methods still fall short of the robustness of the simple 1NN classifier. our code can be found at https://github.com/amirhagai/On-Adversarial-Training-And-The-1-Nearest-Neighbor-Classifier

翻译：通过微小的输入扰动欺骗深度学习分类器的能力，催生了对抗训练的发展。该方法在最小化训练样本损失的同时，也最小化对抗样本的损失。虽然对抗训练能提升学习分类器的鲁棒性，但该过程计算成本高、对超参数敏感，且可能仍使分类器易受其他类型微小扰动的影响。本文分析了1近邻（1NN）分类器的对抗鲁棒性，并将其性能与对抗训练进行了比较。我们证明，在合理假设下，当训练样本数量趋于无穷时，1NN分类器将能够抵抗训练图像的任何微小扰动，并在测试图像上获得高对抗准确率。在取自CIFAR10的45个二值图像分类问题的实验中，我们发现1NN在平均对抗准确率方面优于TRADES（一种强大的对抗训练算法）。在针对CIFAR10的69个预训练鲁棒模型的补充实验中，我们发现1NN在抵抗与训练期间所见扰动略有不同的扰动方面，几乎优于所有模型。综合我们的结果表明，现代对抗训练方法在鲁棒性上仍不及简单的1NN分类器。我们的代码可访问https://github.com/amirhagai/On-Adversarial-Training-And-The-1-Nearest-Neighbor-Classifier获取。