Before revision:  For each of the setting , we characterize the oracle complexity of our algorithm to obtain appropriately defined notions of \epsilon-stationary points . Notably, our complexities are independent of the ambient dimension of the Euclidean space in which the manifold is embedded in, and only depend on the intrinsic dimension of the manifold . As a proof of concept, we demonstrate the applicability of our method to the problem of black-box attacks to deep neural networks, by providing simulation and real-world image data based experimental results.
After revision:  For each of the setting , we characterize the oracle complexity of our algorithm to obtain appropriately defined notions of \epsilon-stationary points . Notably, our complexities are independent of the ambient dimension of the Euclidean space in which the manifold is embedded in, and only depend on the intrinsic dimension of the manifold under consideration. We demonstrate the applicability of our method to the problem of black-box attacks to deep neural networks, by providing simulation and real-world image data based experimental results.