# Adversarial Self-Defense for Cycle-Consistent GANs

arXiv: https://arxiv.org/abs/1908.01517 · HTML: https://mlsanity.com/paper/1908.01517/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Aug 2019.

## Built on by (most cited first, 21 of 21)

- [CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes](https://mlsanity.com/paper/2105.10872/) (2021)
- [Segmentation-Renormalized Deep Feature Modulation for Unpaired Image Harmonization](https://mlsanity.com/paper/2102.06315/) (2021)
- [Robustness via Uncertainty-aware Cycle Consistency](https://mlsanity.com/paper/2110.12467/) (2021)
- [Attack as the Best Defense: Nullifying Image-to-image Translation GANs via Limit-aware Adversarial Attack](https://mlsanity.com/paper/2110.02516/) (2021)
- [Improving Unsupervised Stain-To-Stain Translation using Self-Supervision and Meta-Learning](https://mlsanity.com/paper/2112.08837/) (2021)
- [MORA: Improving Ensemble Robustness Evaluation with Model-Reweighing Attack](https://mlsanity.com/paper/2211.08008/) (2022)
- [ISCL: Interdependent Self-Cooperative Learning for Unpaired Image Denoising](https://mlsanity.com/paper/2102.09858/) (2021)
- [Self adversarial attack as an augmentation method for immunohistochemical stainings](https://mlsanity.com/paper/2103.11362/) (2021)
- [Semi-supervised Bladder Tissue Classification in Multi-Domain Endoscopic Images](https://mlsanity.com/paper/2212.11375/) (2022)
- [Benchmarking Image Perturbations for Testing Automated Driving Assistance Systems](https://mlsanity.com/paper/2501.12269/) (2025)
- [Uncertainty-aware Generalized Adaptive CycleGAN](https://mlsanity.com/paper/2102.11747/) (2021)
- [Towards Measuring Domain Shift in Histopathological Stain Translation in an Unsupervised Manner](https://mlsanity.com/paper/2205.04368/) (2022)
- [Supervised Attribute Information Removal and Reconstruction for Image Manipulation](https://mlsanity.com/paper/2207.06555/) (2022)
- [Leveraging Conditional Generative Models in a General Explanation Framework of Classifier Decisions](https://mlsanity.com/paper/2106.10947/) (2021)
- [Standardized CycleGAN training for unsupervised stain adaptation in invasive carcinoma classification for breast histopathology](https://mlsanity.com/paper/2301.13128/) (2023)
- [Semi-supervised Cycle-GAN for face photo-sketch translation in the wild](https://mlsanity.com/paper/2307.10281/) (2023)
- [Disentangled Unsupervised Image Translation via Restricted Information Flow](https://mlsanity.com/paper/2111.13279/) (2021)
- [I2V: Towards Texture-Aware Self-Supervised Blind Denoising using Self-Residual Learning for Real-World Images](https://mlsanity.com/paper/2302.10523/) (2023)
- [SCONE-GAN: Semantic Contrastive learning-based Generative Adversarial Network for an end-to-end image translation](https://mlsanity.com/paper/2311.03866/) (2023)
- [DSA-CycleGAN: A Domain Shift Aware CycleGAN for Robust Multi-Stain Glomeruli Segmentation](https://mlsanity.com/paper/2604.18368/) (2026)
- [Anatomy-preserving unpaired cone-beam CT refinement for image-guided radiotherapy using pseudo-label guided diffusion](https://mlsanity.com/paper/2610.06094/) (2026)

## Abstract (arXiv)

The goal of unsupervised image-to-image translation is to map images from one domain to another without the ground truth correspondence between the two domains. State-of-art methods learn the correspondence using large numbers of unpaired examples from both domains and are based on generative adversarial networks. In order to preserve the semantics of the input image, the adversarial objective is usually combined with a cycle-consistency loss that penalizes incorrect reconstruction of the input image from the translated one. However, if the target mapping is many-to-one, e.g. aerial photos to maps, such a restriction forces the generator to hide information in low-amplitude structured noise that is undetectable by human eye or by the discriminator. In this paper, we show how such self-attacking behavior of unsupervised translation methods affects their performance and provide two defense techniques. We perform a quantitative evaluation of the proposed techniques and show that making the translation model more robust to the self-adversarial attack increases its generation quality and reconstruction reliability and makes the model less sensitive to low-amplitude perturbations.