On the robustness of randomized classifiers to adversarial examples