Geometric origin of adversarial vulnerability in deep learning