SOTER: Guarding Black-box Inference for General Neural Networks at the Edge