Black-box Certification and Learning under Adversarial Perturbations