Evaluating the Adversarial Robustness of Adaptive Test-time Defenses