Paper:
We present a new method for black-box adversarial attack. Unlike previous methods that combined transfer-based and scored-based methods by using the gradient or initialization of a surrogate white-box model, this new method tries to learn a low-dimensional embedding using a pretrained model, and then performs efficient search within the embedding space to attack an unknown target network. The method produces adversarial perturbations with high level semantic patterns that are easily transferable. We show that this approach can greatly improve the query efficiency of black-box adversarial attack across different target network architectures. We evaluate our approach on MNIST, ImageNet and Google Cloud Vision API, resulting in a significant reduction on the number of queries. We also attack adversarially defended networks on CIFAR10 and ImageNet, where our method not only reduces the number of queries, but also improves the attack success rate.

Review:
This paper proposed a new method for black-box adversarial attacks which tries to learn a  low-dimensional embedding using a pretrained model and then performs efficient search within the embedding space to attack the target network. The proposed method can produce perturbation with semantic patterns are easily transferable. It can be used to improve the query efficiency in black-box attacks. 
- The main idea of this paper is quite simple, i.e., using a autoencoder model to capture encoding in the embedding space and then searching over the embedding space for possible attacks. While searching for adversarial examples in the embedding space is not something new, such as manifold attack or GAN-based attack, the authors claimed that by doing so, it can help reduce the query complexity of black-box attacks. However, it is not immediately clear to me why this can help reduce the query complexity, as intuitively, restricting the attack image space to an embedding space (or a manifold) will naturally increase the difficulty for finding adversarial examples. The authors’ explanation is not quite convincing to me since many adversarial examples are not necessarily on the embedding space.
- Algorithm 1 is not clearly written and I do not understand the update rule in Algorithm 1. What is Li exactly? If Li means eq(1) or eq(2), it seems totally independent of sampled Guassian noise? Also, the update rule in Line 5 of Algorithm 1 is different from what is described in eq(4) or other black-box attack algorithms. Can the author explain the algorithm design with details?
- In experiments section, the authors miss a few important black-box attack baselines. I would suggest the authors to further comment and compare with the following black-box attacks to better demonstrate the performance of the proposed algorithm.
Ilyas, Andrew, Logan Engstrom, and Aleksander Madry. "Prior convictions: Black-box adversarial attacks with bandits and priors." ICLR 2019.
Moon, Seungyong, Gaon An, and Hyun Oh Song. "Parsimonious Black-Box Adversarial Attacks via Efficient Combinatorial Optimization." ICML 2019.
Chen, Jinghui, Jinfeng Yi, and Quanquan Gu. "A Frank-Wolfe Framework for Efficient and Effective Adversarial Attacks." arXiv preprint arXiv:1811.10828 (2018).
- Also can the authors further conduct experiments using more common choice of \epsilon to help the reader get better understandings. For example, add ImageNet experiments with \epsilon = 0.05.
Detailed comments:
- In section 3.2, the author suggests that by removing the sign function, the attacks can be more effective in (Li et al., 2019).  I didn’t find the corresponding argument in (Li et al., 2019). Can the authors be more specific on this argument?
-------------------------
I have read the response and it addressed my concerns. I will increase my score