Why Adversarial Reprogramming Works, When It Fails, and How to Tell the Difference