@misc{allenzhu2020feature,
  title={Feature Purification: How Adversarial Training Performs Robust Deep Learning},
  author={Zeyuan Allen-Zhu and Yuanzhi Li},
  year={2020},
  eprint={2005.10190},
  archivePrefix={arXiv},
  primaryClass={cs.LG},
  url={https://arxiv.org/abs/2005.10190}
}