Beware the Black-Box: on the Robustness of Recent Defenses to Adversarial Examples