Semantic adversarial robustness with differentiable ray-tracing