# AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examples

arXiv: https://arxiv.org/abs/1904.07793 · HTML: https://mlsanity.com/paper/1904.07793/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Apr 2019.

## Built on by (most cited first, 17 of 17)

- [Structure Invariant Transformation for better Adversarial Transferability](https://mlsanity.com/paper/2309.14700/) (2023)
- [Diversifying the High-level Features for better Adversarial Transferability](https://mlsanity.com/paper/2304.10136/) (2023)
- [Rethinking the Backward Propagation for Adversarial Transferability](https://mlsanity.com/paper/2306.12685/) (2023)
- [Exploring Adversarial Fake Images on Face Manifold](https://mlsanity.com/paper/2101.03272/) (2021)
- [Unrestricted Adversarial Attacks on ImageNet Competition](https://mlsanity.com/paper/2110.09903/) (2021)
- [Learning to Transform Dynamically for Better Adversarial Transferability](https://mlsanity.com/paper/2405.14077/) (2024)
- [Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer](https://mlsanity.com/paper/2308.10601/) (2023)
- [NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion](https://mlsanity.com/paper/2505.20934/) (2025)
- [SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Models](https://mlsanity.com/paper/2504.11923/) (2025)
- [An Adversarially-Learned Turing Test for Dialog Generation Models](https://mlsanity.com/paper/2104.08231/) (2021)
- [Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition](https://mlsanity.com/paper/2505.23313/) (2025)
- [Semantic Adversarial Attacks on Face Recognition through Significant Attributes](https://mlsanity.com/paper/2301.12046/) (2023)
- [Latent Magic: An Investigation into Adversarial Examples Crafted in the Semantic Latent Space](https://mlsanity.com/paper/2305.12906/) (2023)
- [Generative Adversarial Perturbations with Cross-paradigm Transferability on Localized Crowd Counting](https://mlsanity.com/paper/2603.24821/) (2026)
- [Chosen methods of improving small object recognition with weak recognizable features](https://mlsanity.com/paper/2208.13591/) (2022)
- [On Neural Network approximation of ideal adversarial attack and convergence of adversarial training](https://mlsanity.com/paper/2307.16099/) (2023)
- [AdvGen: Physical Adversarial Attack on Face Presentation Attack Detection Systems](https://mlsanity.com/paper/2311.11753/) (2023)

## Abstract (arXiv)

Despite the rapid development of adversarial machine learning, most adversarial attack and defense researches mainly focus on the perturbation-based adversarial examples, which is constrained by the input images. In comparison with existing works, we propose non-constrained adversarial examples, which are generated entirely from scratch without any constraint on the input. Unlike perturbation-based attacks, or the so-called unrestricted adversarial attack which is still constrained by the input noise, we aim to learn the distribution of adversarial examples to generate non-constrained but semantically meaningful adversarial examples. Following this spirit, we propose a novel attack framework called AT-GAN (Adversarial Transfer on Generative Adversarial Net). Specifically, we first develop a normal GAN model to learn the distribution of benign data, and then transfer the pre-trained GAN model to estimate the distribution of adversarial examples for the target model. In this way, AT-GAN can learn the distribution of adversarial examples that is very close to the distribution of real data. To our knowledge, this is the first work of building an adversarial generator model that could produce adversarial examples directly from any input noise. Extensive experiments and visualizations show that the proposed AT-GAN can very efficiently generate diverse adversarial examples that are more realistic to human perception. In addition, AT-GAN yields higher attack success rates against adversarially trained models under white-box attack setting and exhibits moderate transferability against black-box models.