Defending Against Adversarial Examples with K-Nearest Neighbor

Understand

Robustness is an increasingly important property of machine learning models as they become more and more prevalent.

• We propose a defense against adversarial examples based on a k-nearest neighbor (kNN) on the intermediate activation of neural networks.
• Our scheme surpasses state-of-the-art defenses on MNIST and CIFAR-10 against l2-perturbation by a significant margin.
• With our models, the mean perturbation norm required to fool our MNIST model is 3.07 and 2.30 on CIFAR-10.