We do not use adversarial training (Goodfellow et al., 2015) because it would require running an adversarial search procedure at each training step, which would be prohibitively slow.
their models were still be fooled by running a more expensive search procedure at test time.