Adversarial Surrogate Risk Bounds for Binary Classification