Supplementary PDF.pdf

detailed information for numerical results, including the implementation of deep k-NN, mean and standard deviation information for various figures, and additional real-data experiments. The deep k-NN implementation follows the structure of two neural networks as described in Table 1, with specific architectures for MNIST and CIFAR-10 datasets. The neural networks are trained using the Adam optimizer with default learning rate, and the output of all but the last fully-connected layer is used as features for k-NN. The number of neighbors is set to 6, and the number of epochs in training is 1 for MNIST and 50 for CIFAR-10.

The text also presents various tables (2-9) showing the mean and standard error of regret for different figures, including Figure 1 (Table 2), Figure 2 (Table 3), Figure 3 (Tables 4-5), Figure 4 (Table 6), Figure 5 (Table 7), and Figure 6 (Table 8). Additionally, Table 9 compares the mean and standard deviation of error rates using k-NN and pre-processed 1NN (Pre-1NN) in HTRU2 and Credit datasets.

The text also discusses the comparison between random perturbation and non-random perturbation, introducing a white-box attack scheme (Equation 1) and presenting Theorem S.1, which provides the regret under adversarial attack. Theorem S.2 relaxes the noise distribution assumption in Theorem 1, allowing for general distributions of noise δ. The proof of regret analysis in Section 2 and 3 is sketched, including the definition of random perturbation δ and the k unsorted neighbors of x in the training samples.