Training a model on deliberately perturbed inputs so that it becomes more robust against adversarial attacks.