Provably robust boosted decision stumps and trees against adversarial attacks