Gamma-convergence of a nonlocal perimeter arising in adversarial machine learning