This is called "adversarial training" and is ineffective because of transferability. Also the space of adversarial examples is thought to be large (especially as dimensionality increases), making robust adversarial training intractable in practice. See https://arxiv.org/abs/1312.6199 and https://arxiv.org/abs/1510.05328

Interesting, what do you mean by transferability?

Training a model on adversarial examples essentially is a type of "gradient masking." (https://blog.openai.com/adversarial-example-research/) A model trained on one set of adversarial examples in an attempt to harden it against all adversarial examples is still vulnerable to adversarial examples produced from a totally separate model that performs the same task.