Understanding and Improving Ensemble Adversarial Defense