Modeling Adversarial Attack on Pre-trained Language Models as Sequential Decision Making