How does your work compare to https://openreview.net/pdf?id=S18Su--CW, it seems you only evaluate your model against non-iterative adversaries rather than iterative and stronger ones like PGD.
The best method for neural networks robust to l_infinity bounded iterative adversarial attacks is this https://openreview.net/forum?id=S18Su--CW (although it is still currently under review).