Characterizing Model Robustness via Natural Input Gradients