We study the problem of learning classifiers robust to universal adversarial perturbations. While prior work approaches this problem via robust optimization, adversarial training, or input transformation, we instead phrase it as a two-player zero-sum game. In this new formulation, both players simultaneously play the same game, where one player chooses a classifier that minimizes a classification loss whilst the other player creates an adversarial perturbation that increases the same loss when applied to every sample in the training set. By observing that performing a classification (respectively creating adversarial samples) is the best response to the other player, we propose a novel extension of a game-theoretic algorithm, namely fictitious play, to the domain of training robust classifiers. Finally, we empirically show the robustness and versatility of our approach in two defence scenarios where universal attacks are performed on several image classification datasets -CIFAR10, CIFAR100 and ImageNet.
Being familiar but not an expert in either game theory or adversarial training, my review will focus on the overall soundness of the proposed method
Summary:
The authors propose to tackle the problem of adversarial training.
Deep networks are know to be susceptible to adversarial attacks.
Adversarial training is concerned with the training of networks that both achieve good performance for the original task while being robust to adversarial attacks.
They propose to focus on universal adversarial perturbations, as opposed to per-sample perturbations. The latter is a subclass of the former. 
It doesn’t strike as the most natural scenario: I can’t really think of a practical image classification scenario where one would want to perturb a whole dataset of image with a single perturbation. That said, this focus leads to simpler algorithms (complexity and storage wise) which are worth exploring.
The authors first present the min-max problem of adversarial training at hand where a classifier f mimizes a loss L for a dataset D, while the conman maximizes the loss over perturbation of the dataset \epsilon.
They then introduce an algorithm to solve it inspired by fictitious play:
A sequence of classifiers and perturbed datasets are created iteratively by the two players (classifier, conman) and each player uses the complete history of its opponent to make its next move.
The objective solved by each player  is :
conman: fool all past classifiers with a single new perturbation
classifier: be robust to all past perturbations so far.
Although it makes intuitive sense, it is unclear from the manuscript whether this formulation provides any convergence guarantees. It would be great to know whether the connection to fictitious play is purely inspirational or if any of the theoretical guarantees from game theory apply here.
The conman’s objective to fool all past classifiers is the bottleneck (in terms of storage) and an approximation is proposed: the mean loss over past classifiers is replaced by the loss under a single ‘average’ classifier trained on all past dataset, with the intuition that this average classifier summarizes all past classifiers
A particular algorithm for perturbation learning is described and the proposed algorithm is compared against two baselines: a pre-existing adversarial training algorithm, an non-adversarial algorithm
The metrics chosen are accuracy and adversarial accuracy.
On standard classification tasks, adversarial algorithms perform slightly less well on the original task (accuracy) but are robust to perturbation as expected,
It would be interesting to know if these good performances extend to per-sample perturbations: Do a network trained on universal perturbations perform well against per sample perturbation? 
Remarks:
sgn missing in the adversarial patch update (and who is alpha?)
introduce terminology: white box black box