Autoregressive Perturbationsfor Data Poisoning