Suppose that I transform each distribution over queries into a lower-complexity distribution, until arriving at a distribution η with KL(η||µ) < 1/3 log(N).

Suppose that I’ve verified empirically that the probability of attacks under µ is at most 1/(3N).

If η has probability > 1/3 of being an attack, then the KL divergence is at least 1/3 * log((1/3) / (1/3N)) = 1/3 log(N). So η has probability <1/3 of being an attack, as desired.