# Fine-grained Synthesis of Unrestricted Adversarial Examples

arXiv: https://arxiv.org/abs/1911.09058 · HTML: https://mlsanity.com/paper/1911.09058/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Nov 2019.

## Built on by (most cited first, 8 of 8)

- [AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Models](https://mlsanity.com/paper/2307.12499/) (2023)
- [Exploring Adversarial Fake Images on Face Manifold](https://mlsanity.com/paper/2101.03272/) (2021)
- [Unrestricted Black-box Adversarial Attack Using GAN with Limited Queries](https://mlsanity.com/paper/2208.11613/) (2022)
- [Interpolated Joint Space Adversarial Training for Robust and Generalizable Defenses](https://mlsanity.com/paper/2112.06323/) (2021)
- [Provable Unrestricted Adversarial Training without Compromise with Generalizability](https://mlsanity.com/paper/2301.09069/) (2023)
- [Generating Unrestricted Adversarial Examples via Three Parameters](https://mlsanity.com/paper/2103.07640/) (2021)
- [Internal Wasserstein Distance for Adversarial Attack and Defense](https://mlsanity.com/paper/2103.07598/) (2021)
- [Latent Geometric Chords for Query-Efficient Decision-Based Adversarial Attacks](https://mlsanity.com/paper/2605.31219/) (2026)

## Abstract (arXiv)

We propose a novel approach for generating unrestricted adversarial examples by manipulating fine-grained aspects of image generation. Unlike existing unrestricted attacks that typically hand-craft geometric transformations, we learn stylistic and stochastic modifications leveraging state-of-the-art generative models. This allows us to manipulate an image in a controlled, fine-grained manner without being bounded by a norm threshold. Our approach can be used for targeted and non-targeted unrestricted attacks on classification, semantic segmentation and object detection models. Our attacks can bypass certified defenses, yet our adversarial images look indistinguishable from natural images as verified by human evaluation. Moreover, we demonstrate that adversarial training with our examples improves performance of the model on clean images without requiring any modifications to the architecture. We perform experiments on LSUN, CelebA-HQ and COCO-Stuff as high resolution datasets to validate efficacy of our proposed approach.