Democratic Training Against Universal Adversarial Perturbations