Black-box Detection of Backdoor Attacks with Limited Information and Data