Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks