Formal Interpretability with Merlin-Arthur Classifiers