Policy-Driven Attack: Learning to Query for Hard-label Black-box Adversarial Examples

Query-efficient reward assignment mechanism: 1. Determine distortion baseline level and 2. Jump along the direction by distance 3. Project resulted image into and then check if they are still adversarial 4. If both, reward is 2; if only , reward is 1; if neither, reward is 0