Defending Against Adversarial Examples with K-Nearest Neighbor