Certified Adversarial Robustness Within Multiple Perturbation Bounds