Y. Chen and X. Zhu, “Optimal Attack against Autoregressive Models by Manipulating the Environment”, AAAI, vol. 34, no. 04, pp. 3545-3552, Apr. 2020.