## 3 Methodology  
### Auxiliary Classifier GAN to Generate \"Unrestricted Adversarial Examples\"  
As mentioned above, Auxiliary Classifier GANs can generate high-quality samples due to the auxiliary classifier. In this paper, we aim to improve adversarial sample generation through the AC-GAN proposed by [PERSON] et al. (2018) in [20] by modifying it for adversarial training. This improvement achieves a wider range of adversarial example searches in the latent space of the model, allowing for broader coverage of adversarially trained defenses. [PERSON] et al. (2018) [19] were the first to define the term \"Unrestricted Adversarial Examples\", suggesting the generation of unconstrained samples as opposed to previous methods that were norm-constrained. According to [20], through the use of generative models it is potentially possible to find adversarial examples that are not limited by the size of the perturbation, which is a superset for generative-based adversarial samples.  
Vanilla adversarial training is generally based on augmenting a clean dataset with adversarial images. These images are generated by adding small perturbations to clean samples using methods such as FGSM [13] and PGD [9]. Despite their widespread use, however, it has been shown in studies such as [1; 12; 15; 25] that adversarially trained models lack generalization with respect to unseen attacks. This lack of generalization is due to the algorithms only generating constrained adversarial examples, meaning that defenses trained only on these samples can be circumvented by different kinds of attacks that use other \(l_{p}\) norms or larger epsilon values (\(\varepsilon\)) compared to those used during adversarial training [6; 7].  
The AC-GAN model solves the problem of constrained adversaries by looking through the latent space and finding samples that qualify as adversarial examples. As shown in Equations (1) and (2), the Generator aims to produce samples that resemble images from the target class C but that are classified by the Generator as the source class S. The generated samples can be used for adversarial training. The general formulation, first stated in [9] (simplified by [PERSON] et al. (2020) [15]), is shown in the equation below:  
\[\underset{\theta}{\text{min}}E_{(x,y)\sim D}\left[\underset{||x^{\text{nd}}-x ||_{\infty}\leq\varepsilon}{\text{max}}L\Big{(}h\Big{(}x^{\text{adv}}\Big{)},y_{true}\Big{)}\right] \tag{7}\][PERSON] et al. (2018) [9] explained adversarial examples through a min-max formulation, as shown above. The inner maximization refers to an adversary that is trying to maximize the loss L of an input \(x^{adv}\) perturbed by a noise \(n=x^{adv}-x\), which is less than \(\varepsilon\). The outer minimization minimizes the loss from any perturbed sample. This objective function is the goal of every adversarially robust model. In our case, training is carried out using examples from an AC-GAN. Hence, the min-max formulation is modified as follows:  
\[\min_{\theta}E_{(x,y)\sim D}\Big{[}\max L(h(x^{8}),y_{true})\Big{]} \tag{8}\]  
where \(x^{8}\) is an adversarial sample generated by an AC-GAN. Note that there are no constraints on \(x^{8}\) because it is an unrestricted adversarial example.