On the Trade-off between Adversarial and Backdoor Robustness