The Geometry of Adversarial Training in Binary Classification