This paper is somewhat borderline: it contributes some novel ideas from control theory to adversarial learning on one hand, yet also leaves open questions and a somewhat weak experimental evaluation. In the end, the positive aspects slightly outweigh the concerns.