Safe Predictors for Enforcing Input-Output Specifications