Liang, Y.; Huang, D. Large Norms of CNN Layers Do Not Hurt Adversarial Robustness. AAAI 2021, 35, 8565-8573.