Adversarial vulnerability for any classifier