A Related Work

Several recent works have aimed to design algorithms that are robust to adversarial perturbations. In practice, first order methods are a popular choice for adversarial training. These methods are appealing since they are generally applicable to many network architecture and only rely on black box access to gradient information. Hence, analyzing this algorithm is interesting in its own right. We first discuss the setting of the hyperparameters in our experiments.