Adversarial robustness in fine-grained perception