Defense against adaptive adversarial attacks