Data to 14 Oct 2026

Constructing Unrestricted Adversarial Examples with Generative Models

arXiv 1805.07894 ↗First posted 21 May 2018cs.LG cs.AI cs.CRcited by 135

Not on the map. Why?

Abstract (arXiv)

Adversarial examples are typically constructed by perturbing an existing data point within a small matrix norm, and current defense methods are focused on guarding against this type of attack. In this paper, we propose unrestricted adversarial examples, a new threat model where the attackers are not restricted to small norm-bounded perturbations. Different from perturbation-based attacks, we propose to synthesize unrestricted adversarial examples entirely from scratch using conditional generative models. Specifically, we first train an Auxiliary Classifier Generative Adversarial Network (AC-GAN) to model the class-conditional distribution over data samples. Then, conditioned on a desired class, we search over the AC-GAN latent space to find images that are likely under the generative model and are misclassified by a target classifier. We demonstrate through human evaluation that unrestricted adversarial examples generated this way are legitimate and belong to the desired class. Our empirical results on the MNIST, SVHN, and CelebA datasets show that unrestricted adversarial examples can bypass strong adversarial training and certified defense methods designed for traditional adversarial attacks.

Key facts. Cited by 135 papers in the map (data through 14 Oct 2026). First posted on arXiv 21 May 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2018: 1; 2019: 0; 2020: 0; 2021: 38; 2022: 26; 2023: 23; 2024: 17; 2025: 18; 2026: 12.

135 papers.

Sort:

By area:

2022The Alignment Problem from a Deep Learning Perspectivecited by 258
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2018Multi-Agent Generative Adversarial Imitation Learningcited by 100
2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
2022Discovering Bugs in Vision Models using Off-the-shelf Image Generation and Captioningcited by 45
2022Adversarial random forests for density estimation and generative modelingcited by 44
2021Reveal of Vision Transformers Robustness against Adversarial Attackscited by 43
2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 43
2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 38

38 more

2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 34
2021Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networkscited by 32
2022Perceptual Attacks of No-Reference Image Quality Models with Human-in-the-Loopcited by 30
2022Diffeomorphic Counterfactuals with Generative Modelscited by 29
2021Defending Against Image Corruptions Through Adversarial Augmentationscited by 28
2021Robust Feature-Level Adversaries are Interpretability Toolscited by 27
2024Transferable Adversarial Facial Images for Privacy Protectioncited by 27
2021Exploring Adversarial Fake Images on Face Manifoldcited by 24
2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 20
2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
2021Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devicescited by 18
2022Unrestricted Black-box Adversarial Attack Using GAN with Limited Queriescited by 18
2021A Unified Game-Theoretic Interpretation of Adversarial Robustnesscited by 17
2021Graph Structural Attack by Perturbing Spectral Distancecited by 16
2021Generative Adversarial Networks: A Survey Towards Private and Secure Applicationscited by 15
2022Discrete Point-wise Attack Is Not Enough: Generalized Manifold Adversarial Attack for Face Recognitioncited by 14
2023From Robustness to Explainability and Back Againcited by 14
2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
2021Generating Adversarial Examples with Graph Neural Networkscited by 12
2022Understanding Adversarial Robustness Against On-manifold Adversarial Examplescited by 12
2023Semantic Adversarial Attacks via Diffusion Modelscited by 12
2021Exposing Previously Undetectable Faults in Deep Neural Networkscited by 11
2021Adversarial Token Attacks on Vision Transformerscited by 11
2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
2021Interpolated Joint Space Adversarial Training for Robust and Generalizable Defensescited by 10
2023Attacking Perceptual Similarity Metricscited by 10
2021Transferable Sparse Adversarial Attackcited by 9
2021Adversarial Attack for Asynchronous Event-based Datacited by 9
2022Adversarially Robust Learning with Tolerancecited by 9
2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
2021A Systematical Solution for Face De-identificationcited by 8
2021Adversarial robustness for latent models: Revisiting the robust-standard accuracies tradeoffcited by 8
2022Learning Antidote Data to Individual Unfairnesscited by 8
2024Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priorscited by 8
2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 8
2021Adaptive Perturbation for Adversarial Attackcited by 7

50 most cited of 135 All 135 (JSON)