The reviewrs reached the concensus of accepting this paper. All the reviewers think this paper provides an interesting analysis of adversarial training and could inspire future work in the community. The experimental results are somehow weaker (e.g., lack of ImageNet experiments), and we hope the authors can further improve the paper based on review comments.