Discrete Adversarial Attacks and Submodular Optimization with Applications to Text Classification