Towards Visual Distortion in Black-Box Attacks