Detecting Language Model Attacks with Perplexity