Explicit Tradeoffs between Adversarial and Natural Distributional Robustness

Neural Information Processing Systems 

Results averaged over ResNet18 and ResNet50.