On adversarial training and the 1 Nearest Neighbor classifier
This work addresses the vulnerability of deep learning classifiers to adversarial attacks, showing that a simple method can be more robust than complex adversarial training, which is incremental as it builds on existing robustness research.
The paper tackles the problem of adversarial robustness in deep learning by comparing adversarial training methods to the 1 Nearest Neighbor (1NN) classifier, finding that 1NN outperforms TRADES and most robust models in adversarial accuracy on image datasets like CIFAR10, MNIST, and Fashion-MNIST.
The ability to fool deep learning classifiers with tiny perturbations of the input has lead to the development of adversarial training in which the loss with respect to adversarial examples is minimized in addition to the training examples. While adversarial training improves the robustness of the learned classifiers, the procedure is computationally expensive, sensitive to hyperparameters and may still leave the classifier vulnerable to other types of small perturbations. In this paper we compare the performance of adversarial training to that of the simple 1 Nearest Neighbor (1NN) classifier. We prove that under reasonable assumptions, the 1NN classifier will be robust to {\em any} small image perturbation of the training images. In experiments with 135 different binary image classification problems taken from CIFAR10, MNIST and Fashion-MNIST we find that 1NN outperforms TRADES (a powerful adversarial training algorithm) in terms of average adversarial accuracy. In additional experiments with 69 robust models taken from the current adversarial robustness leaderboard, we find that 1NN outperforms almost all of them in terms of robustness to perturbations that are only slightly different from those used during training. Taken together, our results suggest that modern adversarial training methods still fall short of the robustness of the simple 1NN classifier. our code can be found at \url{https://github.com/amirhagai/On-Adversarial-Training-And-The-1-Nearest-Neighbor-Classifier} \keywords{Adversarial training}