Adversarial training and robustness for multiple perturbations