Testing robustness against unforeseen adversaries