The effect of recurrence on adversarial robustness