Additional Experiments

More detailed comparisons with DFO and ZOO methods will be added in the revision. It is indeed valuable to enrich our related work on DFO. We will compare our method with existing DFO solvers, e.g., A preliminary comparison with COBYLA was illustrated in AE. Many benchmark black-box attack methods were built on ZO optimization, e.g., ZO-SignSGD Thus, we focus on the application in adversarial learning. It is shown from Eq. (19) that " should be added at the end of Y es, the stepsize interval should be reversed.