# AdvGAN++ : Harnessing latent layers for adversary generation

arXiv: https://arxiv.org/abs/1908.00706 · HTML: https://mlsanity.com/paper/1908.00706/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Aug 2019.

## Built on by (most cited first, 20 of 20)

- [TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systems](https://mlsanity.com/paper/2111.09999/) (2021)
- [Generalizable Black-Box Adversarial Attack with Meta Learning](https://mlsanity.com/paper/2301.00364/) (2023)
- [LAFEAT: Piercing Through Adversarial Defenses with Latent Features](https://mlsanity.com/paper/2104.09284/) (2021)
- [Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challenges](https://mlsanity.com/paper/2303.14133/) (2023)
- [Adversarial Camouflage for Node Injection Attack on Graphs](https://mlsanity.com/paper/2208.01819/) (2022)
- [Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generator](https://mlsanity.com/paper/2208.06222/) (2022)
- [Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems](https://mlsanity.com/paper/2508.01845/) (2025)
- [On the Robustness of Deep Clustering Models: Adversarial Attacks and Defenses](https://mlsanity.com/paper/2210.01940/) (2022)
- [OMG-ATTACK: Self-Supervised On-Manifold Generation of Transferable Evasion Attacks](https://mlsanity.com/paper/2310.03707/) (2023)
- [Semantic Adversarial Attacks on Face Recognition through Significant Attributes](https://mlsanity.com/paper/2301.12046/) (2023)
- [Latent Magic: An Investigation into Adversarial Examples Crafted in the Semantic Latent Space](https://mlsanity.com/paper/2305.12906/) (2023)
- [Deep generative models as an adversarial attack strategy for tabular machine learning](https://mlsanity.com/paper/2409.12642/) (2024)
- [Using a GAN to Generate Adversarial Examples to Facial Image Recognition](https://mlsanity.com/paper/2111.15213/) (2021)
- [Improving Robustness of Convolutional Neural Networks Using Element-Wise Activation Scaling](https://mlsanity.com/paper/2202.11898/) (2022)
- [Immune Defense: A Novel Adversarial Defense Mechanism for Preventing the Generation of Adversarial Examples](https://mlsanity.com/paper/2303.04502/) (2023)
- [A Survey of Adversarial CAPTCHAs on its History, Classification and Generation](https://mlsanity.com/paper/2311.13233/) (2023)
- [Breaking Free: How to Hack Safety Guardrails in Black-Box Diffusion Models!](https://mlsanity.com/paper/2402.04699/) (2024)
- [GraphCroc: Cross-Correlation Autoencoder for Graph Structural Reconstruction](https://mlsanity.com/paper/2410.03396/) (2024)
- [NODE-AdvGAN: Improving the transferability and perceptual similarity of adversarial examples by dynamic-system-driven adversarial generative model](https://mlsanity.com/paper/2412.03539/) (2024)
- [PAR-AdvGAN: Improving Adversarial Attack Capability with Progressive Auto-Regression AdvGAN](https://mlsanity.com/paper/2502.12207/) (2025)

## Abstract (arXiv)

Adversarial examples are fabricated examples, indistinguishable from the original image that mislead neural networks and drastically lower their performance. Recently proposed AdvGAN, a GAN based approach, takes input image as a prior for generating adversaries to target a model. In this work, we show how latent features can serve as better priors than input images for adversary generation by proposing AdvGAN++, a version of AdvGAN that achieves higher attack rates than AdvGAN and at the same time generates perceptually realistic images on MNIST and CIFAR-10 datasets.