Defending against substitute model black box adversarial attacks with the 01 loss