[logane]

We took a look at adversarial examples for linear classifiers (and in general, we looked at properties that adversarial training induces) here: https://arxiv.org/abs/1805.12152 For $\ell_\infty$ adversarial examples on linear classifiers we found that adversarial training forces a tradeoff between the $\ell_1$ norm of the weights (which is directly associated with adversarial accuracy) and accuracy.

It looks like this article works through something vaguely similar for $\ell_2$ adversarial examples. It would be interesting to compare the author's approach with explicit adversarial training.