Voting based ensemble improves robustness of defensive models