A computer-implemented method of training a more secure neural network having a plurality of network parameters, the method comprising: obtaining a plurality of training inputs and, for each of the plurality of training inputs, a respective target output for the training input; and training the neural network on each of the plurality of training inputs, comprising: processing each of the training inputs using the neural network and in accordance with current values of the network parameters to generate a respective network output for each of the training inputs; computing a respective loss for each of the training inputs by evaluating a loss function, wherein the loss function measures a difference between (i) an output generated by the neural network by processing an input in an input - output pair and (ii) an output in the input - output pair, and wherein computing the loss for each of the training inputs comprises evaluating the loss function at the input - output pair that includes the training input and the target output for the training input; identifying, from a plurality of possible perturbations, a maximally non-linear perturbation, wherein a perturbation is a set of values that (i) is the same dimensionality as the training input and (ii) has a norm that does not exceed a threshold value and wherein the maximally non-linear perturbation is a perturbation for which the loss function is most non-linear when evaluated at an input - output pair that includes (i) a perturbed training input generated by applying the possible perturbation to a given training input and (ii) a target output for the given training input; determining an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation; and wherein the training inputs are images and the network output is an image classification output, or objection detection output. obtaining a plurality of training inputs and, for each of the plurality of training inputs, a respective target output for the training input; and training the neural network on each of the plurality of training inputs, comprising: processing each of the training inputs using the neural network and in accordance with current values of the network parameters to generate a respective network output for each of the training inputs; computing a respective loss for each of the training inputs by evaluating a loss function, wherein the loss function measures a difference between (i) an output generated by the neural network by processing an input in an input - output pair and (ii) an output in the input - output pair, and wherein computing the loss for each of the training inputs comprises evaluating the loss function at the input - output pair that includes the training input and the target output for the training input; identifying, from a plurality of possible perturbations, a maximally non-linear perturbation, wherein a perturbation is a set of values that (i) is the same dimensionality as the training input and (ii) has a norm that does not exceed a threshold value and wherein the maximally non-linear perturbation is a perturbation for which the loss function is most non-linear when evaluated at an input - output pair that includes (i) a perturbed training input generated by applying the possible perturbation to a given training input and (ii) a target output for the given training input; determining an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation; and processing each of the training inputs using the neural network and in accordance with current values of the network parameters to generate a respective network output for each of the training inputs; computing a respective loss for each of the training inputs by evaluating a loss function, wherein the loss function measures a difference between (i) an output generated by the neural network by processing an input in an input - output pair and (ii) an output in the input - output pair, and wherein computing the loss for each of the training inputs comprises evaluating the loss function at the input - output pair that includes the training input and the target output for the training input; identifying, from a plurality of possible perturbations, a maximally non-linear perturbation, wherein a perturbation is a set of values that (i) is the same dimensionality as the training input and (ii) has a norm that does not exceed a threshold value and wherein the maximally non-linear perturbation is a perturbation for which the loss function is most non-linear when evaluated at an input - output pair that includes (i) a perturbed training input generated by applying the possible perturbation to a given training input and (ii) a target output for the given training input; determining an update to the current values of the parameters of the neural network by performing an iteration of a neural network training procedure to decrease the respective losses for the training inputs and to decrease the non-linearity of the loss function for the identified maximally non-linear perturbation; and wherein the training inputs are images and the network output is an image classification output, or objection detection output.