On the Foundations of Adversarial Single-Class Classification