Data Poisoning Attacks against Autoregressive Models