A Fundamental Performance Limitation for Adversarial Classification