Towards sustainable adversarial training with successive perturbation generation