Provable defenses against adversarial examples via the convex outer adversarial polytope