On the Limitations of Stochastic Pre-processing Defenses