To be clear, this is not overfitting. This is non-smooth (poor?) generalizability. Overfitting is related to, but not equivalent to, generalization.<p>I&#x27;m very that skeptical data augmentation is the answer to this. The space of adversarial examples is much larger than the space of true population examples. Boosting adversarial examples would only push the classifier to work really hard to properly classify examples that don&#x27;t even belong to the population distribution. I suspect it would be equally susceptible to adversarial attacks.