1: \begin{abstract}

2: Achieving transferability of targeted attacks is reputed to be remarkably difficult.

3: The current state of the art has resorted to resource-intensive solutions that necessitate training model(s) for each target class with additional data.

4: In our investigation, we find, however, that simple transferable attacks which require neither model training nor additional data can achieve surprisingly strong targeted transferability.

5: This insight has been overlooked until now, mainly because the widespread practice of attacking with only few iterations has largely limited the attack convergence to optimal targeted transferability.

6: In particular, we, for the first time, identify that a very simple logit loss can largely surpass the commonly adopted cross-entropy loss, and yield even better results than the resource-intensive state of the art.

7: Our analysis spans a variety of transfer scenarios, especially including three new, realistic scenarios: an ensemble transfer scenario with little model similarity, a worse-case scenario with low-ranked target classes, and also a real-world attack on the Google Cloud Vision API.

8: Results in these new transfer scenarios demonstrate that the commonly adopted, easy scenarios cannot fully reveal the actual strength of different attacks and may cause misleading comparative results.

9: We also show the usefulness of the simple logit loss for generating targeted universal adversarial perturbations in a data-free manner.

10: Overall, the aim of our analysis is to inspire a more meaningful evaluation on targeted transferability.

11: Code is available at~\url{https://github.com/ZhengyuZhao/Targeted-Tansfer}.

12: \end{abstract}

13: