Characterizing the Optimal 0 1 Loss for Multi-class Classification with a Test-time Attacker Wenxin Ding 2 Daniel Cullina