# Unrestricted Adversarial Examples

arXiv: https://arxiv.org/abs/1809.08352 · HTML: https://mlsanity.com/paper/1809.08352/

## Key facts

- Cited by 40 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Sep 2018.

## Built on by (most cited first, 30 of 40)

- [Scalable agent alignment via reward modeling: a research direction](https://mlsanity.com/paper/1811.07871/) (2018)
- [Automatically Auditing Large Language Models via Discrete Optimization](https://mlsanity.com/paper/2303.04381/) (2023)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Defending Against Unforeseen Failure Modes with Latent Adversarial Training](https://mlsanity.com/paper/2403.05030/) (2024)
- [Adversarial Training for High-Stakes Reliability](https://mlsanity.com/paper/2205.01663/) (2022)
- [A Survey on Transferability of Adversarial Examples across Deep Neural Networks](https://mlsanity.com/paper/2310.17626/) (2023)
- [Reasoning Robustness of LLMs to Adversarial Typographical Errors](https://mlsanity.com/paper/2411.05345/) (2024)
- [Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey](https://mlsanity.com/paper/2410.23687/) (2024)
- [Robustness and Generalization via Generative Adversarial Training](https://mlsanity.com/paper/2109.02765/) (2021)
- [StyleFool: Fooling Video Classification Systems via Style Transfer](https://mlsanity.com/paper/2203.16000/) (2022)
- [Attacking deep networks with surrogate-based adversarial black-box methods is easy](https://mlsanity.com/paper/2203.08725/) (2022)
- [Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries](https://mlsanity.com/paper/2208.11613/) (2022)
- [Towards Transferable Unrestricted Adversarial Examples with Minimum Changes](https://mlsanity.com/paper/2201.01102/) (2022)
- [Semantic Adversarial Attacks via Diffusion Models](https://mlsanity.com/paper/2309.07398/) (2023)
- [Holistic Adversarial Robustness of Deep Learning Models](https://mlsanity.com/paper/2202.07201/) (2022)
- [Rethinking Impersonation and Dodging Attacks on Face Recognition Systems](https://mlsanity.com/paper/2401.08903/) (2024)
- [Domain Invariant Adversarial Learning](https://mlsanity.com/paper/2104.00322/) (2021)
- [Adversarial Attack by Limited Point Cloud Surface Modifications](https://mlsanity.com/paper/2110.03745/) (2021)
- [Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approach](https://mlsanity.com/paper/2412.02159/) (2024)
- [NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion](https://mlsanity.com/paper/2505.20934/) (2025)
- [Generating Unrestricted Adversarial Examples via Three Parameters](https://mlsanity.com/paper/2103.07640/) (2021)
- [Class-Conditioned Transformation for Enhanced Robust Image Classification](https://mlsanity.com/paper/2303.15409/) (2023)
- [Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey](https://mlsanity.com/paper/2307.00309/) (2023)
- [Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Models](https://mlsanity.com/paper/2405.16940/) (2024)
- [Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentation](https://mlsanity.com/paper/2411.15555/) (2024)
- [Tiny Adversarial Mulit-Objective Oneshot Neural Architecture Search](https://mlsanity.com/paper/2103.00363/) (2021)
- [You Don't Need Robust Machine Learning to Manage Adversarial Attack Risks](https://mlsanity.com/paper/2306.09951/) (2023)
- [Turn Fake into Real: Adversarial Head Turn Attacks Against Deepfake Detection](https://mlsanity.com/paper/2309.01104/) (2023)
- [A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defense](https://mlsanity.com/paper/2402.07183/) (2024)
- [SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversion](https://mlsanity.com/paper/2410.02240/) (2024)

## Abstract (arXiv)

We introduce a two-player contest for evaluating the safety and robustness of machine learning systems, with a large prize pool. Unlike most prior work in ML robustness, which studies norm-constrained adversaries, we shift our focus to unconstrained adversaries. Defenders submit machine learning models, and try to achieve high accuracy and coverage on non-adversarial data while making no confident mistakes on adversarial inputs. Attackers try to subvert defenses by finding arbitrary unambiguous inputs where the model assigns an incorrect label with high confidence. We propose a simple unambiguous dataset ("bird-or- bicycle") to use as part of this contest. We hope this contest will help to more comprehensively evaluate the worst-case adversarial risk of machine learning models.