An Attacker Model for Normative Multi-agent Systems