However, in our work, one agent's input depends on the other agent's output, which makes the input undecidable in the beginning.
an adversarial sentence or example is not enough to conduct attack in dialogue sys-tems.