Choice of Representation Matters for Adversarial Robustness