A Discussion of 'Adversarial Examples Are Not Bugs, They Are Features': Learning from Incorrectly Labeled Data

Here, we show that since the incorrect labels are generated using a trained model, information is being “leaked” about that trained model into the mislabeled examples. In particular, this an indirect form of model distillation — training on this dataset allows a new model to somewhat recover the features of the original model. The new model’s decision boundary loosely matches the original model’s decision boundary, i.e., the original model has been somewhat distilled after training on its adversarial examples.