text: 2See also the recent ﬁndings on adversarial triggers, which 
  get the model to produce a certain output even though they 
  are not well-formed from the point of view of a human reader 
  (Wallace et al., 2019a). 