Appendix: LearningBlack-BoxAttackers withTransferablePriorsandQueryFeedback