Evaluating the Robustness of Nearest Neighbor Classifiers: A Primal-Dual Perspective