## 5 Conclusions  
Previous adversarial training methods have produced various results and created adversarial defenses that have improved baseline accuracy. However, as these defense mechanisms improve, adversarial attacks become more resilient to defenses and circumvent them easily, as shown in various research, including [16; 17]. This is caused by common adversarial defense methods, specifically, adversarial training restricted by small perturbations added to the original images, which results in \"narrower\" defensive coverage. Attackers can exploit adversarial samples generated using different algorithms, i.e., by producing adversarial examples not covered by the defenses to use in attacks. Standardadversarial training methods become less accurate as datasets grow more complex, as discussed in [9; 63], further worsening matters.  
In this paper, we propose using AC-GAN, which is geared towards adversarial training, to generate adversarial samples that are \"unrestricted, \" a term taken from [19; 20]. This ensures a larger area of defensive coverage, thereby providing universal defense. The AC-GAN architecture in [20] was modified for robust adversarial training. Our experiments demonstrate the robustness of our methods, as detailed in the Results section. From this, it can be concluded that generative models have better potential in finding adversarial samples that are not restricted and that allow for robust adversarial training.  
As a future direction, this method can be implemented on datasets with a more complex data manifold, such as ImageNet and CIFAR. Such implementation would allow for a better understanding of conditional generative models such as AC-GANs in order to boost adversarial robustness. Another improvement could involve resolving the issue of a specific Generator being needed for each domain/dataset. The current process is both time- and resource-consuming. To simplify it, using meta-learning to improve the time required to generate adversarial examples could be an option. Future directions might include using Few-Shot Generative Models such as the one mentioned in [64] to generate adversarial samples without creating a generative model from scratch.  
Conceptualization, H.D. and J.K.; Methodology, H.D.; Software, H.D.; Formal analysis, H.D. and J.K.; Data curation, H.D.; Writing--original draft, H.D.; Writing--review & editing, J.K.; Visualization, H.D.; Supervision, J.K. All authors have read and agreed to the published version of the manuscript.  
This research is funded by the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (2021R1A2C2008414) and by the MSIT (Ministry of Science and ICT), Korea, under the ITRC (Information Technology Research Center) support program (IITP-2023-2020-0-01789) supervised by the IITP (Institute for Information and Communications Technology Planning and Evaluation).  
Not applicable.  
We utilized publicly available MNIST and CelebA datasets in order to train our models. The datasets can be accessed using the following links: [[https://kaggle.com/datasets/hojjatk/mnist-dataset](https://kaggle.com/datasets/hojjatk/mnist-dataset)]([https://kaggle.com/datasets/hojjatk/mnist-dataset](https://kaggle.com/datasets/hojjatk/mnist-dataset)) and [[https://www.kaggle.com/datasets/jessical9530/celeba-dataset](https://www.kaggle.com/datasets/jessical9530/celeba-dataset)]([https://www.kaggle.com/datasets/jessical9530/celeba-dataset](https://www.kaggle.com/datasets/jessical9530/celeba-dataset)) (last accessed on 26 July 2020).  
The authors declare no conflict of interest.