Research map / Adversarial robustness and security / Certified and empirical robustness
Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use fixed k in k-nearest neighbors | k-nearest neighbors · Regions where η(x) ∈ (0, 1) | robustness radius | Hurt |
| Increase k at the rate required for uniform convergence | k-nearest neighbors · Robust strict interiors, large-sample limit | robustness | Helped |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · Halfmoon | accuracy under white-box attacks | Helped |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · Abalone | accuracy under white-box attacks | Helped |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · MNIST 1v7, small white-box attack radii | classification accuracy | Hurt |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · MNIST 1v7, large white-box attack radii | classification accuracy | Helped |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · Halfmoon and Abalone, black-box attacks | accuracy under attack | Helped |
| Modify the training set by retaining confident, locally consistent points and enforcing separation between opposite labels | RobustNN · MNIST 1v7, neural-network substitute black-box attack at small radii | accuracy under attack | Hurt |
| Attack with a black-box substitute instead of a white-box attacker | All evaluated classifiers · Halfmoon, MNIST 1v7, and Abalone | accuracy under attack | Helped |
| Use a kernel substitute rather than a neural-network substitute | Black-box attacks · Halfmoon, MNIST 1v7, and Abalone | attack effectiveness | Helped |
Closest papers by meaning
- Adversarial Examples for k-Nearest Neighbor Classifiers Based on Higher-Order Voronoi Diagrams (NeurIPS 2021 · similarity 0.91)
- Fast Adversarial Robustness Certification of Nearest Prototype Classifiers for Arbitrary Seminorms (NeurIPS 2020 · similarity 0.91)
- Adversarial vulnerability for any classifier (NeurIPS 2018 · similarity 0.90)
- Consistent Non-Parametric Methods for Maximizing Robustness (NeurIPS 2021 · similarity 0.90)
- Benchmarking Adversarial Robustness on Image Classification (CVPR 2020 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.