On the Hardness of Robust Classification