# Minimum-Norm Adversarial Examples on KNN and KNN-Based Models

arXiv: https://arxiv.org/abs/2003.06559 · HTML: https://mlsanity.com/paper/2003.06559/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Mar 2020.

## Built on by (most cited first, 2 of 2)

- [p-DkNN: Out-of-Distribution Detection Through Statistical Testing of Deep Representations](https://mlsanity.com/paper/2207.12545/) (2022)
- [Benefit of Interpolation in Nearest Neighbor Algorithms](https://mlsanity.com/paper/2202.11817/) (2022)

## Abstract (arXiv)

We study the robustness against adversarial examples of kNN classifiers and classifiers that combine kNN with neural networks. The main difficulty lies in the fact that finding an optimal attack on kNN is intractable for typical datasets. In this work, we propose a gradient-based attack on kNN and kNN-based defenses, inspired by the previous work by Sitawarin & Wagner [1]. We demonstrate that our attack outperforms their method on all of the models we tested with only a minimal increase in the computation time. The attack also beats the state-of-the-art attack [2] on kNN when k > 1 using less than 1% of its running time. We hope that this attack can be used as a new baseline for evaluating the robustness of kNN and its variants.