# Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration

Source: [Logit Margin Matters: Improving Transferable Targeted Adversarial Attack by Logit Calibration](<https://www.sota2.com/research/paper/68fa6eb71e209131cea41bcb>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-28T13:56:57.803Z

Authors: Juanjuan Weng, Zhiming Luo, Zhun Zhong, Shaozi Li, Nicu Sebe

Published: 2023-03-07T06:42:52.000Z

## Abstract

Previous works have extensively studied the transferability of adversarial samples in untargeted black-box scenarios. However, it still remains challenging to craft targeted adversarial examples with higher transferability than non-targeted ones. Recent studies reveal that the traditional Cross-Entropy (CE) loss function is insufficient to learn transferable targeted adversarial examples due to the issue of vanishing gradient. In this work, we provide a comprehensive investigation of the CE loss function and find that the logit margin between the targeted and untargeted classes will quickly obtain saturation in CE, which largely limits the transferability. Therefore, in this paper, we devote to the goal of continually increasing the logit margin along the optimization to deal with the saturation issue and propose two simple and effective logit calibration methods, which are achieved by downscaling the logits with a temperature factor and an adaptive margin, respectively. Both of them can effectively encourage optimization to produce a larger logit margin and lead to higher transferability. Besides, we show that minimizing the cosine distance between the adversarial examples and the classifier weights of the target class can further improve the transferability, which is benefited from downscaling logits via L2-normalization. Experiments conducted on the ImageNet dataset validate the effectiveness of the proposed methods, which outperform the state-of-the-art methods in black-box targeted attacks. The source code is available at \\href{https://github.com/WJJLL/Target-Attack/}{Link}

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Targeted Adversarial Attack on ImageNet (test) - Model Suite VGG/ResNet/Transformer Mix](<https://www.sota2.com/research/sota/targeted-adversarial-attack-on-imagenet-test-model-suite-vgg-resnet-transformer-mix.md>): Targeted Adversarial Attack; ImageNet (test); Model Performance: VGG16: 47.86.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2303.03680>)

[PDF](<https://arxiv.org/pdf/2303.03680.pdf>)