It is well known that deep learning models have a propensity for fitting the entire training set even with random labels, which requires memorization of every training sample. In this paper, we investigate the memorization effect in adversarial training (AT) for promoting a deeper understanding of capacity, convergence, generalization, and especially robust overfitting of adversarially trained classifiers. We first demonstrate that deep networks have sufficient capacity to memorize adversarial examples of training data with completely random labels, but not all AT algorithms can converge under the extreme circumstance. Our study of AT with random labels motivates further analyses on the convergence and generalization of AT. We find that some AT methods suffer from a gradient instability issue, and the recently suggested complexity measures cannot explain robust generalization by considering models trained on random labels. Furthermore, we identify a significant drawback of memorization in AT that it could result in robust overfitting. We then propose a new mitigation algorithm motivated by detailed memorization analyses. Extensive experiments on various datasets validate the effectiveness of the proposed method.

研究表明，深度学习模型具有记忆整个训练集的倾向，通过对对抗训练（AT）中记忆效应的探索，揭示了模型容量、收敛、泛化和特别是对抗性训练模型的鲁棒过拟合等问题，提出了一种减缓鲁棒过拟合的算法，并通过各种数据集上的广泛实验验证了该算法的有效性。

对抗性训练中的记忆研究