On the Hardness of Robust Classification (Extended Version)∗