Lower bounds on the robustness to adversarial perturbations