Trading inference-time compute for adversarial robustness