Adversarial examples reveal critical vulnerabilities in deep neural networks, posing significant risks in real-world deployment. In black-box settings, transferable targeted attacks rely on surrogate models but often suffer from low success rates. We argue that this limitation arises not only from surrogate-boundary overfitting but also from insufficient alignment with the target semantic space, which restricts the ability of adversarial examples to encode target-specific characteristics. To address this issue, we propose Cosine-Based Logit Alignment (CBLA), a unified framework for transferable targeted attacks. CBLA replaces the conventional cross-entropy loss with a cosine similarity objective to enhance directional alignment in logit space and alleviate gradient saturation. In addition, a semantic-invariant transformation strategy is introduced to improve structural consistency and cross-model generalization. Experiments on the ImageNet validation set demonstrate that CBLA consistently improves targeted attack success rates, achieving an average gain of 4.55% over strong baselines across multiple architectures.
Shi et al. (Sun,) studied this question.