1: \begin{abstract}

2: 

3:    Adversarial training is a standard technique for training adversarially robust models.  In this paper, we study adversarial training as an alternating best-response strategy in a 2-player zero-sum game. We prove that even in a simple scenario of a linear classifier and a statistical model that abstracts robust vs. non-robust features, the alternating best response strategy of such game may not converge. On the other hand, a unique pure Nash equilibrium of the game exists and is provably robust. We support our theoretical results with experiments, showing the non-convergence of adversarial training and the robustness of Nash equilibrium.

4: %   We study optimal adversarial training where we directly optimize the m we leverage the closed form solution of adversarial examples and show that this procedure also leads to a robust classifier.

5: %   Given this, we propose training a robust model with a strategy, \emph{stochastic fictitious play}, with a guarantee of convergence to Nash equilibrium. 

6:    

7: %   and optimal adversarial training.

8: %   the convergence of stochastic fictitious play, 

9:    

10:   

11: 

12: 

13:   

14: \end{abstract}

15: