As shown in Table  2, our approach decreases misclassification error and dramatically decreases the adversary's success rate.
adversarial training on real adversarial examples generated by HotFlip, is more effective than training on pseudo-adversarial examples created by adding noise to the embeddings.