How does your work compare to https://openreview.net/pdf?id=S18Su--CW, it seems you only evaluate your model against non-iterative adversaries rather than iterative and stronger ones like PGD.