Before revision:  We demonstrate that this attack can be realised practically via targeted corruption of web documents crawled to form the system's training data.
After revision:  We show that this attack can be realised practically via targeted corruption of web documents crawled to form the system's training data.