On Norm-Agnostic Robustness of Adversarial Training