  We connect adversarial training for binary classification to a geometric
evolution equation for the decision boundary. Relying on a perspective that
recasts adversarial training as a regularization problem, we introduce a
modified training scheme that constitutes a minimizing movements scheme for a
nonlocal perimeter functional. We prove that the scheme is monotone and
consistent as the adversarial budget vanishes and the perimeter localizes, and
as a consequence we rigorously show that the scheme approximates a weighted
mean curvature flow. This highlights that the efficacy of adversarial training
may be due to locally minimizing the length of the decision boundary. In our
analysis, we introduce a variety of tools for working with the subdifferential
of a supremal-type nonlocal total variation and its regularity properties.
