Improved Estimation of Cost of Black-box Attacks