Y. Liang and D. Huang, “Large Norms of CNN Layers Do Not Hurt Adversarial Robustness”, AAAI, vol. 35, no. 10, pp. 8565-8573, May 2021.