A malware verdict service returns only benign or malicious and rate-caps submissions — what does that stop?

## What the channel actually gives away Start by writing down what the adversary can see, because that is half the threat model. Here they can see one bit per submission: benign or malicious. They cannot see a confidence, a per-class distribution, a feature attribution or a gradient. They can submit at some rate and no faster. Black-box attacks split into two families along exactly this line, and the split is the point of the question. **Score-based attacks** buy an estimate of a gradient by probing and differencing returned numbers. They are a metered version of an operation that is free when you hold the weights. Return a label instead of a number and this family is gone — there is nothing to subtract. **Decision-based attacks** need only the returned label. They begin from a point the model already labels the way the adversary wants and search along the decision boundary, using the label flip as their only signal. Nothing about the label-only channel prevents this; it only makes it slower, because each step of the search costs a submission. So the honest summary is: hiding scores removes one family and prices the other. It is a cost control, not a boundary. A candidate who says 'we do not return confidence, so black-box attacks do not apply' has stated the wrong half of the split. ## What the rate cap does The cap is a price, denominated in submissions per unit of time. Boundary search wants many queries, so a cap that permits, say, a few dozen submissions a day turns an afternoon of interactive search into a campaign of weeks. That genuinely matters — an attack whose cost exceeds its value does not happen — but it changes the economics rather than the possibility, and the adversary has an obvious response: move the search off the metered channel. ## The disclosure cost, which is the one specific to this setting There is a second and less obvious cost the adversary pays here, and a good answer reaches it. **Every submission is a disclosure.** A candidate that comes back malicious is not just a wasted query; it is a sample now sitting in the defender's collection, available for study, and capable of costing the adversary the entire family of related artefacts if it drives new detection. Interaction is therefore expensive in a currency the rate cap does not measure. That pushes the rational adversary toward a specific strategy: keep the number of interactions tiny, and make each one count. Build a local stand-in trained on publicly available labelled corpora, run the discrete search over behaviour-preserving edits against that stand-in offline where queries and functional tests are free, and spend the metered submissions only on final confirmation. ## Why transfer is available at all Transfer needs a similar task and an overlapping data distribution — not the same architecture, and not the target's actual training set. The stand-in only has to agree with the target near the boundary being attacked, which is why a model well below the target's accuracy can still be a useful guide, and why the required query budget is a small fraction of a training set rather than a replacement for one. ## The uncomfortable part: the oracle exists whether you publish it or not The submission service is one channel. Wherever the decision is *enforced*, the label is observable by its effect — whether the artefact was permitted to run is itself the answer, and that channel is not rate-capped by anybody. A model that ships to where it makes decisions is a model whose verdicts can be sampled locally, without a submission, without a disclosure, and as often as the adversary likes. Any reasoning about query economics has to account for that; otherwise you are protecting one door in a building with several. ## What actually changes the adversary's cost Thinking as the red-teamer who has to build this attack and report what it cost, the sensitive variables are: - **How many interactions the search needs**, which depends far more on the quality of the offline stand-in than on the metered channel. - **What a failed submission costs**, which depends on whether submissions are retained and studied rather than merely counted. - **How long an offline result stays valid**, which depends on how often the deciding model changes. - **Whether the deciding model can be queried somewhere unmetered**, which depends on where it runs. Notice that only one of those four is the rate cap, and none of them is the presence or absence of a confidence score. ## The sentence to land in an interview Hiding the score deletes score-based estimation and nothing else; a label is still an oracle; the cap is a price; and the query budget is not where this adversary spends most of their effort anyway, because on a discrete artefact the dominant cost is verifying that each candidate still works.