Adversarial Training and Robustness for Multiple Perturbations