  The ability to fool deep learning classifiers with tiny perturbations of the
input has lead to the development of adversarial training in which the loss
with respect to adversarial examples is minimized in addition to the training
examples. While adversarial training improves the robustness of the learned
classifiers, the procedure is computationally expensive, sensitive to
hyperparameters and may still leave the classifier vulnerable to other types of
small perturbations. In this paper we compare the performance of adversarial
training to that of the simple 1 Nearest Neighbor (1NN) classifier. We prove
that under reasonable assumptions, the 1NN classifier will be robust to {\em
any} small image perturbation of the training images. In experiments with 135
different binary image classification problems taken from CIFAR10, MNIST and
Fashion-MNIST we find that 1NN outperforms TRADES (a powerful adversarial
training algorithm) in terms of average adversarial accuracy. In additional
experiments with 69 robust models taken from the current adversarial robustness
leaderboard, we find that 1NN outperforms almost all of them in terms of
robustness to perturbations that are only slightly different from those used
during training. Taken together, our results suggest that modern adversarial
training methods still fall short of the robustness of the simple 1NN
classifier. our code can be found at
\url{https://github.com/amirhagai/On-Adversarial-Training-And-The-1-Nearest-Neighbor-Classifier}
\keywords{Adversarial training}
