On the Safety of Interpretable Machine Learning: A Maximum Deviation Approach