Paper shows the loss landscape of adversarial training is spiky and hard to train on, with interesting theoretical and experimental contributions. The reviewers had many questions, some answered in the author response, and we encourage the authors to address these best they can when they revise the paper.