  This paper aims to enhance the transferability of adversarial samples in
targeted attacks, where attack success rates remain comparatively low. To
achieve this objective, we propose two distinct techniques for improving the
targeted transferability from the loss and feature aspects. First, in previous
approaches, logit calibrations used in targeted attacks primarily focus on the
logit margin between the targeted class and the untargeted classes among
samples, neglecting the standard deviation of the logit. In contrast, we
introduce a new normalized logit calibration method that jointly considers the
logit margin and the standard deviation of logits. This approach effectively
calibrates the logits, enhancing the targeted transferability. Second, previous
studies have demonstrated that mixing the features of clean samples during
optimization can significantly increase transferability. Building upon this, we
further investigate a truncated feature mixing method to reduce the impact of
the source training model, resulting in additional improvements. The truncated
feature is determined by removing the Rank-1 feature associated with the
largest singular value decomposed from the high-level convolutional layers of
the clean sample. Extensive experiments conducted on the ImageNet-Compatible
and CIFAR-10 datasets demonstrate the individual and mutual benefits of our
proposed two components, which outperform the state-of-the-art methods by a
large margin in black-box targeted attacks.
