Computer-implemented method for training a classifier, wherein the classifier is configured to classify input signals of digital image data and/or audio data and training the classifier is based on a perturbed input signal obtained by applying a perturbation provided from a plurality ( ξ) of perturbations to an input signal provided from a training dataset, wherein the method comprises the following steps: • Providing a plurality of initial perturbations; • Adapting a perturbation from the plurality of initial perturbations to an input signal, wherein the input signal is randomly drawn from the training dataset and the perturbation is adapted to the input signal such that applying the perturbation to the input signal yields a second input signal, which is classified differently than the first input signal; • Providing a subset of the plurality of initial perturbations as plurality ( ξ) of perturbations; • Training the classifier based on the plurality ( ξ) of perturbations, wherein the step of training the classifier comprises the further steps of: a. Selecting a first perturbation from the plurality of perturbations and selecting an input signal and a corresponding desired output signal from the training dataset; b. Obtaining a second perturbation, which is stronger than the first perturbation, by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier; c. Obtaining a first adversarial example by applying the second perturbation to the input signal; d. Adapting the classifier by training the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation; e. Replacing the first perturbation in the plurality of perturbations by a linear combination of the first perturbation and the second perturbation; f. Repeating steps a. to e. • Providing a plurality of initial perturbations; • Adapting a perturbation from the plurality of initial perturbations to an input signal, wherein the input signal is randomly drawn from the training dataset and the perturbation is adapted to the input signal such that applying the perturbation to the input signal yields a second input signal, which is classified differently than the first input signal; • Providing a subset of the plurality of initial perturbations as plurality ( ξ) of perturbations; • Training the classifier based on the plurality ( ξ) of perturbations, wherein the step of training the classifier comprises the further steps of: a. Selecting a first perturbation from the plurality of perturbations and selecting an input signal and a corresponding desired output signal from the training dataset; b. Obtaining a second perturbation, which is stronger than the first perturbation, by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier; c. Obtaining a first adversarial example by applying the second perturbation to the input signal; d. Adapting the classifier by training the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation; e. Replacing the first perturbation in the plurality of perturbations by a linear combination of the first perturbation and the second perturbation; f. Repeating steps a. to e. a. Selecting a first perturbation from the plurality of perturbations and selecting an input signal and a corresponding desired output signal from the training dataset; b. Obtaining a second perturbation, which is stronger than the first perturbation, by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier; c. Obtaining a first adversarial example by applying the second perturbation to the input signal; d. Adapting the classifier by training the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation; e. Replacing the first perturbation in the plurality of perturbations by a linear combination of the first perturbation and the second perturbation; f. Repeating steps a. to e.