The existence of so-called adversarial examples has become a serious threat to Deep Neural Networks (DNN) and their applications, especially security-sensitive ones. Explanations and defenses mainly focused on inside of the DNN, e.g. its generalization errors and training defects, have been proposed without much success. Recently, we have shown that the extrinsic cause of adversarial examples is due to embedding geometry of the training data manifold, and adversarial examples mainly exist in the orthogonal complementary spaces of the tangent spaces on the data manifold. In this paper, we prove the intrinsic cause of the adversarial examples, i.e. the existence of non-zero manifold-orthogonal components of every weight almost everywhere, as the counterpart of the extrinsic cause. Investigations showed that weights of the DNN always have nonzero and large manifold-orthogonal components at almost every data point, which explains why small adversarial perturbations can lead to misclassifications in well-trained DNN. Then, based on these mechanisms, we propose a new defense against adversarial examples by extracting the manifold structure of the training data and removing the components orthogonal to the tangent spaces of the manifolds from the input data, which successfully prevents misclassification of DNN for major adversarial example attacks.