Algorithm 1 Simulator Attack+ under the $l_{p}norm$ condition

Input: The input image $x\in {\mathbb{R}}^D$, where D means the image dimension, the label of the image x with groundtruth, the pre-trained simulator model $\mathbb{M}$, the forward function of the black-box target model interface f, and the finetuning loss function $L_{MSE}$. Parameters: Warm-up iteration steps t, the adaptive predict-interval of LSSIM $M_{adp}$, Bandits Attack parameter $\tau$, noise exploration parameter $\delta$, Bandits prior learning rate ${\eta }_g$, image updating rate $\eta$, the momentum factor $\theta$ of FABM, group numbers $N_{group}$ of unsupervised clustering results, the center beginning perturbations $P_{centers}$, $batch\_size$ of input images, attack type $T_{attack}$, project function $f_{proj\_p}(·)$, and image update function $f_{img\_upd\_p}(·)$. Output: Adversarial image $x_{adv}$ that meets the requirements of $ϵ$ norm-set attack, as ${∥x_{adv}-x∥}_p\le ϵ$. 1:Initialize the adversarial example $x_{adv}\leftarrow x$ and the estimated gradient $g\leftarrow 0$. Initialize the simulator model $\mathbb{M}$ for each image. Initialize finetune dequeue $\mathbb{D}$ with maximum length of t for coming finetuning query pairs. Initialize $N_{group}$ clustering centers randomly. Initialize empty perturbation $P_{all}$, the size of which is the same as the batch. Initialize empty perturbation $P_{centers}$, which has the same size as the clustering centers. 2:if$T_{attack}==targeted$then 3:    The central prior knowledge of other images in the same group is found using UCM. 4:for$i\leftarrow 1toN$do 5:      $u\leftarrow \mathcal{N}(0,\frac{1}{D}I)$ 6:      $q_1\leftarrow \left(g+\tau u\right)/{∥g+\tau u∥}_2$ 7:      $q_2\leftarrow \left(g-\tau u\right)/{∥g-\tau u∥}_2$ 8:      if $i\le tor(i-t)mod{\mathit{M}}_{\mathit{adp}}=0$ then 9:             $\widehat{y_1}\leftarrow f(x_{adv}+\delta ·q_1)$ 10:           $\widehat{y_2}\leftarrow f(x_{adv}+\delta ·q_2)$ 11:           Append above query pairs into dequeue $\mathbb{D}$. 12:           if $i\ge t$ then 13:                  Finetune the simulator model $\mathbb{M}$ with $L_{MSE}$ using the query pairs in dequeue $\mathbb{D}$. 14:                  Extract feature attentional region ${\mathit{R}}_{\mathit{atten}}$. 15:    else 16:             $\widehat{y_1}\leftarrow \mathbb{M}(x_{adv}+\delta ·q_1)$ 17:             $\widehat{y_2}\leftarrow \mathbb{M}(x_{adv}+\delta ·q_2)$ 18:    ${\Delta }_{dir}\leftarrow \frac{L(\widehat{y_1},y)-L(\widehat{y_2},y)}{\tau ·\delta }·u$ 19:    Use $P_{final}$ to enhance the ${\mathbf{\Delta }}_{\mathit{dir}}$ of ${\mathit{R}}_{\mathit{atten}}$. 20:    $g\leftarrow f_{proj\_p}(g,{\eta }_g,{\Delta }_{dir})$ 21:    $x_{adv}\leftarrow f_{img\_upd\_p}(x_{adv},\eta ,g)$ 22:    $x_{adv}\leftarrow Clip(x_{adv},0,1)$ 23:return$x_{adv}$