Poster: Adversaries Don’t Care About Averages: Batch Attacks on Black-Box Classifiers