Towards Consistency in Adversarial Classification