## 4 Experimental Results  
Experiments were conducted by modifying the AC-GAN setup to generate Unrestricted Adversarial Examples [20]. Because the original authors did not provide the base model, it was necessary to recreate the base model used to generate adversarial examples. The architecture that we used was a simple model with two convolutional layers. When trained on the MNIST dataset, it had a testing accuracy of 97.1%, which was sufficient for our intended purposes. A similar model was used on CelebA, achieving a clean accuracy of 96.4% on gender classification. As explained in the previous section, the previous AC-GAN configuration was modified to boost robustness for adversarially trained models. Table 1 lists the arrangement of each loss function for our model. Our experiments were run on an NVIDIA Ampere A100 GPU with 80 gigabytes of video RAM using TensorFlow version 2 for both experiments. The Adversarial Robustness Toolbox (ART) by [PERSON] et al. (2019) [61], a library that provides different attacks and defenses, was used for adversarial defense implementation. Conversely, the Clever-Hans library proposed by [PERSON] et al. (2018) [62] was used for adversarial attack implementation. A range of adversarial examples was generated using the AC-GAN model. Because the MNIST and CelebA datasets were used, a combination of each class label as a source, i.e., the number or gender that the image should look like, and a target \(s\), i.e., the misclassification target class, was generated. The same model settings mentioned in [20] were used for the other components of the AC-GAN. Figures 6 and 7 show two generated samples with different sources and targets. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Loss Functions** & **Unrestricted Adv. Model** & **Our Model** \\ \hline \(L_{0}\) & Yes & Yes \\ \(L_{1}\) & Yes & No \\ \(L_{2}\) & Yes & Yes \\ \(D2D-CE\) & No & Yes \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Loss arrangements between different model versions. Figure 5: Examples of mixup-augmented MNIST dataset (the right and middle images show the original input and the left image shows the output after applying the mixup method). The same model architecture proposed by [PERSON] et al. (2018) [9] was used to perform adversarial training and was compared with different versions of our adversarial training methods. Our models were trained separately on clean MNIST and CelebA datasets and augmented with unrestricted adversarial samples and mixup, such as those shown in the figures above. On the other hand, the model based on [PERSON] et al. (2018) [9] was trained on adversarial images generated using a PGD attack, as recommended in their research paper. Figure 6: Adversarial samples (source 2 to target 9). Figure 7: Adversarial samples (source 6 to target 8). The tests were carried out using FGSM [1], PGD [9], Unrestricted Adversarial Examples [19; 20], MIM [36], SPSA [34; 35], and BIM [21], as shown in Table 2. Through these experiments, the performance of our proposed model against unseen adversarial examples was measured. To ensure a common ground with which to check the accuracy, the model architecture was kept the same as the one mentioned above for all of the test models while using different adversarial training methods. These different adversarial models were compared in terms of accuracy with the clean models. Categorical accuracy was used to measure how the predictions from the model matched the true one-hot labels. The average and variance in Table 3 summarize the results across various attacks. The original unrestricted adversarial model was based on the original AC-GAN architecture to generate Unrestricted Examples [20]. As explained in the methodology section, the original architecture was modified in different ways in order to produce a more robust model. The results in Tables 2-4 show the universality of our proposed model.