In Intriguing properties of neural networks (https://arxiv.org/pdf/1312.6199.pdf) they show (4.3), that the existance of adversarial examples is closely connected to the upper Lipschitz constant, namely that if the constant is small enough then it's not possible to find adversarial examples. As it turns out these Lipschitz constants are bounded by respective norms of weight matrices (in case of fully connected network). Has anyone tried to regularize network with respect to these Lipschitz constants or matrix norms, so that the network is fully resistant to adversarial examples? If not, then why? Is it too complex when it comes to computations, not very efficient, or something else?