Reduce attack save state

[dxoigmn]

We currently save the entire NxV attack parameters where N is the number of attack tokens and V is the size of the model's vocabulary. This is wasteful for discrete attacks since the vocab entries are mostly zero except for one. For discrete attacks, we should just save the N token ids.