Exploring Memorization in Adversarial Training
  Deep learning models have a propensity for fitting the entire training set
even with random labels, which requires memorization of every training sample.
In this paper, we explore the memorization effect in adversarial training (AT)
for promoting a deeper understanding of model capacity, convergence,
generalization, and especially robust overfitting of the adversarially trained
models. We first demonstrate that deep networks have sufficient capacity to
memorize adversarial examples of training data with completely random labels,
but not all AT algorithms can converge under the extreme circumstance. Our
study of AT with random labels motivates further analyses on the convergence
and generalization of AT. We find that some AT approaches suffer from a
gradient instability issue and most recently suggested complexity measures
cannot explain robust generalization by considering models trained on random
labels. Furthermore, we identify a significant drawback of memorization in AT
that it could result in robust overfitting. We then propose a new mitigation
algorithm motivated by detailed memorization analyses. Extensive experiments on
various datasets validate the effectiveness of the proposed method.
