Transfer of adversarial robustness between perturbation types