On the Robustness of Deep K-Nearest Neighbors