Adversarial Attack Against Images Classification based on Generative Adversarial Networks

Yahe Yang

REVIEW 5 major objections 6 minor 3 cited by

Adversarial Attack Against Images Classification based on Generative Adversarial Networks

T0 review · 5 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a GAN-based adversarial attack that generates small, natural-looking perturbations to fool image classifiers, and claims it beats FGSM and BIM in success and cost on MNIST.

desk verdict The central claim is unsupported: the paper's own update rule is standard BIM, with no GAN component in the algorithm or experiments. read the letter →

arxiv 2412.16662 v2 pith:HQ2KNFP2 submitted 2024-12-21 cs.CV cs.AI

Yahe Yang This is my paper · ORCID

classification cs.CVcs.AI

keywords adversarialattackimageclassificationgenerativenetworklearningiterativegradientFastSignMethodBasicMNIST

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a generative-adversarial-network-based attack can fool image classifiers with small, natural-looking perturbations, and that this attack beats the standard FGSM and BIM baselines. The proposed mechanism is framed as adversarial learning between a generator and the classifier, with an iterative clipped gradient update under a perturbation budget. On MNIST with a three-layer convolutional classifier, the paper reports lower accuracy under attack, higher attack success than FGSM and BIM, natural-looking adversarial samples, and a lower per-sample computational cost of 0.15 seconds, versus 0.25 seconds for FGSM and 0.47 seconds for BIM. A sympathetic reader would care because the method is presented as a proactive way to expose classifier weaknesses before adversaries exploit them.

What carries the argument

The load-bearing object is the iterative update $x^{(t+1)} = \mathrm{Clip}_{x,\epsilon}(x^{(t)} + \alpha \cdot \mathrm{sign}(\nabla_x J(\theta, x^{(t)}, y)))$ (Eq. 3): repeated clipped sign-gradient steps that maximize the classifier's loss under a perturbation threshold. The paper wraps this update in a GAN formulation (Eq. 1) with a generator and a discriminator, and states that the generator and the classifier are trained adversarially. Two auxiliary mechanisms are added: total-variation regularization (Eq. 4) to suppress noise-like artifacts, and a time-dependent weight function $w(t)$ (Eq. 5) that adaptively adjusts the influence of adversarial samples during training. The same update equation is the one used by the BIM baseline, so it is the mechanism that must distinguish the proposed attack from a standard gradient attack.

What would settle it

Inspect the training loop and generated samples: if no generator or discriminator is trained, and the reported adversarial samples come from the 10-iteration clipped signed-gradient update of Eq. 3, the GAN-based claim is falsified. A direct check is to run Algorithm 1 with all GAN components removed and see whether the attack success and the 0.15-second cost are unchanged.

Watch

Extended reading notes

Core claim

The paper's central claim is that generative adversarial networks can generate adversarial samples that are both effective and natural: small perturbations that change a classifier's decision while remaining visually unnoticeable. The authors state that by adversarially training the generator against the classifier, the attack learns where the classifier is fragile, and they report that on MNIST it outperforms FGSM and BIM in attack success ratio and computational cost. They also claim that the adversarial samples stay close to normal samples in feature space, which they take as evidence of concealment. The paper's stated goal is to reveal weaknesses in image classification systems and to motivate stronger defenses.

Load-bearing premise

The load-bearing premise is that the method is genuinely a GAN-based attack and not just the standard iterative gradient attack it compares against; if the GAN components are never actually trained, the claimed novelty and the adversarial-learning mechanism collapse.

Editorial extensions

If this is right

A trained GAN-based attacker could generate adversarial samples without per-image gradient search, lowering the cost per attack.
The same samples could be used to harden classifiers through adversarial training, since the attack exposes the model's fragile regions.
The recipe could be turned into an image-protection tool: applying such perturbations before publishing a photo would make deepfake-style edits fail while the photo still looks normal.
The reported 0.15-second generation time makes the attack fast enough for real-time or large-batch deployment, if the result holds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Inference: Because Eq. 3 and Algorithm 1 match the BIM baseline, removing the GAN framing and rerunning the experiment is the decisive test of whether the proposed mechanism is doing the work.
Inference: The claimed naturalness could be quantified on MNIST by measuring distance to the nearest real-sample neighborhood or by a human-perception study; the paper's PCA and t-SNE plots are suggestive, not a metric.
Inference: If a real generator were trained, the attack might transfer to harder datasets and architectures, which would test the abstract's promise of deceiving a variety of advanced classifiers beyond the one three-layer CNN evaluated.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague, this one doesn't hold up. The paper claims a GAN-based adversarial attack, but the only concrete update rule, Eq. (3), is verbatim the BIM update from Kurakin et al. [12]. Algorithm 1 is a standard gradient-descent loop: forward pass, cross-entropy loss, backprop, sign of gradient, clip, repeat. No generator, discriminator, or adversarial training objective appears anywhere in the attack procedure. The GAN content in Section III-A is generic background; Eq. (4) and (5) introduce a total-variation regularizer and a dynamic weighting scheme but neither is used in Algorithm 1 or in the experiments. That is not a missing detail; it is the central mechanism the abstract and conclusion advertise.

What is genuinely new: essentially nothing. The listed contributions in the introduction (perturbation-space framework, projection for transferability, multi-dataset evaluation) do not match the experiments, which use only MNIST and a single 3-layer CNN. There is no projection experiment, no transferability test, and no second dataset. The favorable comparisons in Figures 4-6 and Table 2 are uninterpretable because 'Ours' is never defined independently of the baselines. If the implementation is just BIM with a different step size or iteration count, the reported success rates and the claimed 'lowest computation cost' are an artifact of hyperparameter choice, not a new method.

The paper does a passable job summarizing FGSM, BIM, and some deepfake-protection literature, and the prose is readable. But that is context, not a contribution. There are also small signs of carelessness: Figure 7 is labeled t-SNE while the text describes PCA; the text says 'other three methods' when only three methods are compared; the conclusion repeats that 'advanced classifiers' were deceived, though only one simple CNN was tested.

This is a load-bearing flaw, not a quibble. The method as written collapses to prior work. I would not send this to peer review in its current form. A serious rewrite would need to specify and train an actual GAN-based attack (including the generator and discriminator update rules), connect the regularizers to the optimization, and evaluate on at least one non-trivial dataset with proper baselines. As it stands, the paper is not a new result and not ready for referee time.

Referee Report

5 major / 6 minor

Summary. The paper proposes an adversarial attack method against image classifiers, claiming to use generative adversarial networks (GANs) to generate imperceptible perturbations through adversarial learning of a generator and a classifier. The method is compared with FGSM and BIM on the MNIST dataset with a simple three-layer CNN, reporting accuracy drop, attack success rate, computational cost, robustness heatmaps, and feature-space visualizations. The central claim is that the proposed GAN-based attack outperforms FGSM and BIM in success rate and efficiency while preserving image naturalness (Abstract, Section V).

Significance. If the central claim were supported, a GAN-based attack that improves on FGSM and BIM would be a useful contribution to adversarial machine learning, with potential application to robustness evaluation. The paper gives a clear account of the FGSM and BIM baselines and provides a readable description of the GAN background. However, the claimed novelty rests entirely on the assertion that the attack is GAN-based, and the manuscript does not provide a training loop, a generator/discriminator objective tied to the attack, or any experimental evidence that a GAN is actually used. The experimental evaluation is limited to a single simple CNN on MNIST, so the abstract's claim of deceiving 'a variety of advanced classifiers' is unsubstantiated. The paper provides no code, no architectural details, no error bars, and no ablation of the regularizers introduced in Equations (4) and (5). On the evidence in the manuscript, the method reduces to BIM, so the claimed significance does not hold as written.

major comments (5)

[Section III-C, Eq. (3)] The proposed update rule in Equation (3) is exactly the BIM update from reference [12], and Algorithm 1 describes only a standard iterative gradient-sign attack: forward pass, cross-entropy loss, backpropagation, sign of gradient, update, clipping. No line of Algorithm 1 uses the generator G, the discriminator D, the minimax objective in Equation (1), or any adversarial training loop tying G, D, and the classifier together. Thus the paper's central claim that the attack is GAN-based and generated through adversarial learning of generator and classifier is unsupported by the method as written.
[Section IV and abstract/conclusion] The abstract and conclusion claim that the method 'successfully deceives a variety of advanced classifiers' and the introduction promises evaluations on 'multiple real-world datasets as well as a synthesized dataset' with transferability across scenarios. The experiments in Section IV use only MNIST and one three-layer CNN, with no transferability experiments, no synthesized dataset, and no advanced classifiers. The claimed contributions in the introduction, including the projection operation for transferability, do not appear in the methodology or experiments. This is a load-bearing mismatch between the claims and the actual evaluation.
[Section III-C, Eqs. (4) and (5)] The total-variation regularization term in Equation (4) and the dynamic weight function in Equation (5) are introduced as part of the method, but neither appears in Algorithm 1, in the experimental setup, or in the reported results. There is no ablation or any other evidence that these terms affect the attack's performance or the naturalness of the perturbations. Consequently, the statement that the method maintains naturalness through these mechanisms is not supported.
[Section IV-B, Table 2] Table 2 reports that generating one adversarial sample takes 0.15 seconds for 'Ours' versus 0.47 seconds for BIM, without any description of what distinguishes 'Ours' from BIM computationally. Since the algorithm is the same iterative gradient-sign procedure with the same iteration count and identical operations, this speedup is unexplained and implausible; no hardware, software, or implementation details are given. The absence of error bars or repeated runs makes it impossible to assess whether the reported differences are meaningful.
[Section IV-B, Figures 4-6] The comparison is difficult to interpret because 'Ours' is never defined independently from the baselines; the same hyperparameters (perturbation size 0.1, step size 0.01, 10 iterations) are used, and the method is described only as 'the proposed method' with no distinguishing algorithmic content. The text states that 'the performance of other three methods are extremely unacceptable' when only FGSM and BIM are compared, and no quantitative values for accuracy or attack success rate are given in the text, so the reader cannot verify the claimed superiority from Figures 4 and 5.

minor comments (6)

[Figure 2 caption] The caption for Figure 2 reads 'Illustration of generative images by using generative adversarial networks,' which appears to be a copy-paste error from Figure 1; the figure is meant to illustrate the principle of adversarial attacks, not generative images.
[Section IV-B] The text says 'we compared two different adversarial attack methods: Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM)' but then refers to 'these three methods' and 'other three methods'; the wording should consistently identify 'Ours' as the third method, and 'other two methods' when comparing to the baselines.
[Figure 7 caption and text] The caption for Figure 7 says 'Feature Space Visualization using t-SNE,' but the surrounding text describes principal component analysis (PCA) for dimensionality reduction; the caption and text should agree on the actual technique used.
[Section IV-A] The evaluation metrics are enumerated as 'A. Attack Accuracy' and 'B. Adversarial Success Rate' immediately after a sentence about 'the following items,' which is confusing because the letters A and B are also used for other purposes in the paper; using a numbered list would improve clarity.
[Table 1] The table heading says 'NOTIONS' and the column says 'Notion symbols'; the intended word is 'Notations.' Also, the table lists parameters such as alpha and beta that are later reused with different meanings in Equations (3) and (5), which is notationally confusing.
[Section IV-A] The abstract states that 'extensive experiment analysis' was performed, but only one dataset and one classifier are used; the wording should be adjusted to match the actual experimental scope.

Circularity Check

1 steps flagged · score 6.0 of 10

The method's defining update in Eq. (3) is verbatim the BIM update, so the GAN-based novelty and the Ours-vs-BIM comparison collapse by construction.

renaming known result [Section III-C, Equation (3) and Algorithm 1]
"Specifically, the proposed method updates the adversarial perturbations of images by the following equation 3. x(t+1) = Clip_{x,epsilon}(x(t)+alpha * sign(nabla_x J(theta,x(t),y))), (3) ... Algorithm 1 describes the attack iteration process with a threshold."

Equation (3) is exactly the BIM update described in Section II-A and attributed to reference [12]. Algorithm 1 implements only forward pass, cross-entropy loss, backpropagation, sign-gradient update, clipping, and repetition; no line references the generator G, the discriminator D, the minimax objective in Eq. (1), or any adversarial training loop connecting G, D, and the classifier. Thus the 'Ours' method is, by the paper's own equations, BIM under a new name, and the claimed GAN-based attack plus the Ours-vs-BIM comparison reduce to a single algorithm.

full rationale

There are no self-citations, no fitted parameters, and no imported uniqueness theorem, so the usual circularity modes (self-definition, fitted-input-as-prediction, self-citation chains) are absent. The concrete reduction that remains is the method definition itself: the paper's 'proposed method' in Eq. (3) and Algorithm 1 is the standard BIM update from reference [12], restated without any connection to the GAN objective in Eq. (1) or to the generator and discriminator variables introduced in the threat model. Because 'Ours' is identical by construction to the BIM baseline it is compared against in Figures 4-6 and Table 2, the central novelty claim and the comparative results are vacuous as stated. This is most accurately classified as renaming a known result rather than a fitted or self-cited derivation, and it warrants a partial-circularity score of 6.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The central claim rests on hand-chosen hyperparameters, an unstated white-box assumption, and an asserted but unspecified GAN training loop. No new entities are introduced. The most important hidden load is the assumption that a GAN-based attack exists at all, since the equations in the paper describe standard BIM.

free parameters (5)

perturbation threshold epsilon = 0.1
Set to 0.1 in Section IV.A; bounds all attacks and directly determines the reported accuracy and attack success rate.
step size alpha = 0.01
Set to 0.01 in Section IV.A; controls convergence of the iterative attack in Eq 3.
number of iterations = 10
Set to 10 in Section IV.A; the attack strength and computational cost depend on this value.
total variation weight lambda (Eq 4) = not reported
Introduced in Eq 4 as regularization for naturalness, but neither a value nor its effect in experiments is given; if used, it tunes the central 'naturalness' claim.
dynamic weight parameters alpha and beta (Eq 5) = not reported
Introduced in Eq 5, but no values and no connection to the experimental pipeline are provided; these would be extra hand-chosen constants if the method were implemented as written.

assumptions (3)

domain assumption The standard GAN min-max objective (Eq 1) is the correct model for adversarial sample generation.
Section III-A presents Eq 1 as background, but the paper never derives how optimizing this objective produces adversarial perturbations for a classifier; it assumes the GAN framework transfers.
domain assumption The classifier is differentiable and the attacker has white-box gradient access to it.
Eq 3 and Algorithm 1 require gradients of the classifier loss with respect to pixels; this assumption is never stated as a limitation, yet it excludes black-box scenarios the introduction references.
ad hoc to paper Adversarial training of generator and classifier converges to a generator that produces imperceptible, effective perturbations.
Section III-B and III-C assert this convergence without a training algorithm, loss schedule, or stability analysis.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Attack Against Images Classification based on Generative Adversarial Networks." pith.science (2026). https://pith.science/paper/HQ2KNFP2

@misc{pith2026241216662,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attack Against Images Classification based on Generative Adversarial Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HQ2KNFP2}},
  note         = {Machine review of arXiv:2412.16662}
}

read the original abstract

Adversarial attacks on image classification systems have always been an important problem in the field of machine learning, and generative adversarial networks (GANs), as popular models in the field of image generation, have been widely used in various novel scenarios due to their powerful generative capabilities. However, with the popularity of generative adversarial networks, the misuse of fake image technology has raised a series of security problems, such as malicious tampering with other people's photos and videos, and invasion of personal privacy. Inspired by the generative adversarial networks, this work proposes a novel adversarial attack method, aiming to gain insight into the weaknesses of the image classification system and improve its anti-attack ability. Specifically, the generative adversarial networks are used to generate adversarial samples with small perturbations but enough to affect the decision-making of the classifier, and the adversarial samples are generated through the adversarial learning of the training generator and the classifier. From extensive experiment analysis, we evaluate the effectiveness of the method on a classical image classification dataset, and the results show that our model successfully deceives a variety of advanced classifiers while maintaining the naturalness of adversarial samples.

Figures

Figures reproduced from arXiv: 2412.16662 by the authors.

**Figure 1.** Illustration of generative images by using generative adversarial networks. Generative Adversarial Networks (GANs) have become a research hotspot in recent years due to their powerful and versatile generative capabilities, and the quality and fidelity of the generated images are also improving. However, there are always two sides to the use of advanced technology. Since the data generated by it is difficult for peop… view at source ↗

**Figure 2.** Illustration of generative images by using generative adversarial networks. Adversarial samples were first discovered in Deep Neural Network (DNN) classification models, which can be misclassified by simply adding perturbations that are imperceptible to the naked eye in the image. At present, the methods of constructing adversarial samples are mainly divided into white-box attacks and black-box attacks. In the case … view at source ↗

**Figure 3.** demonstrates the general framework of the proposed generative adversarial network [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Convolutional neural network prediction accuracy under adversarial attacks. As the perturbation budget increases in above [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Attack success ratio comparison results. Finally, the computational costs associated with the proposed model and their corresponding comparison methods are presented in following [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 7.** Figure 7: illustrates the feature space visualisation following the application of principal component analysis (PCA) for the purpose of reducing the dimensionality of the data set. The graph illustrates the distribution of adversarial samples generated by normal samples and dis…

**Figure 6.** Figure 6: illustrates the robustness heat map of the model, which has been generated based on the application of different perturbation intensities and the utilisation of diverse adversarial attack methods. The colours in the graph represent the robustness score of the model at …

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Unmasking Synthetic Realities in Generative AI: A Comprehensive Review of Adversarially Robust Deepfake Detection Systems
cs.CR 2025-07 conditional novelty 3.0 of 10

A systematic review of deepfake detection finds a pervasive lack of adversarial robustness evaluation across all modalities and calls for resilient, modality-agnostic detectors.
A Deep Learning Approach to Interface Color Quality Assessment in HCI
cs.HC 2025-02 reject novelty 3.0 of 10

The authors train a CNN on website screenshots to predict user ratings of color quality and report high agreement, but provide no architecture, dataset size, or held-out validation.
Multi-Scale Transformer Architecture for Accurate Medical Image Classification
cs.CV 2025-02 reject novelty 2.0 of 10

A Transformer with a loosely defined multi-scale attention weighting is reported to achieve 89.5% accuracy on ISIC 2017 skin lesion classification.

Reference graph

Works this paper leans on

18 extracted references · 17 canonical work pages · cited by 3 Pith papers

[12]

Adversarial examples in the physical world

Kurakin, Alexey, Ian J. Goodfellow, and Samy Bengio. "Adversarial examples in the physical world." Artificial intelligence safety and security. Chapman and Hall/CRC, (2018). 99-112

work page 2018
[1]

A survey on generative adversarial net -works: Variants, applications, and training

Jabbar, Abdul, Xi Li, and Bourahla Omar. "A survey on generative adversarial net -works: Variants, applications, and training." ACM Computing Surveys (CSUR) 54.8 (2021): 1-49

work page 2021
[2]

Gener ative adversarial networks

Goodfellow, Ian, et al. "Gener ative adversarial networks." Communications of the ACM 63.11 (2020): 139-144

work page 2020
[3]

Training generative adversarial networks with limited data

Karras, Tero, et al. "Training generative adversarial networks with limited data." Ad-vances in neural information processing systems 33 (2020): 12104-12114

work page 2020
[4]

Generative adversarial networks for image and video synthesis: Algorithms and applications

Liu, Ming-Yu, et al. "Generative adversarial networks for image and video synthesis: Algorithms and applications." Proceedings of the IEEE 109.5 (2021): 839-862

work page 2021
[5]

Generative adversarial networks in computer vision: A survey and taxon omy

Wang, Zhengwei, Qi She, and Tomas E. Ward. "Generative adversarial networks in computer vision: A survey and taxon omy." ACM Computing Surveys (CSUR) 54.2 (2021): 1-38

work page 2021
[6]

Alias -free generative adversarial networks

Karras, Tero, et al. "Alias -free generative adversarial networks." Advances in neural in -formation processing systems 34 (2021): 852 - 863

work page 2021
[7]

A u -net based discriminator for generative adversarial networks

Schonfeld, Edgar, Bernt Schiele, and Anna Khoreva. "A u -net based discriminator for generative adversarial networks." Proceedings of the IEEE/CVF conference on comput -er vision and pattern recognition. (2020)

work page 2020

Show all 18 references

[8]

Regularizing generative adversarial networks under limited da -ta

Tseng, Hung-Yu, et al. "Regularizing generative adversarial networks under limited da -ta." Proceedings of the IEEE/CVF conference on computer vision and pattern recogni-tion. (2021)

2021
[9]

Gradient normalization for generative adversarial networks

Wu, Yi-Lun, et al. "Gradient normalization for generative adversarial networks." Pro-ceedings of the IEEE/CVF international conference on computer vision. (2021)

2021
[10]

Ccgan: Continuous conditional generative adversarial networks for image generation

Ding, Xin, et al. "Ccgan: Continuous conditional generative adversarial networks for image generation." International conference on learning representations. (2021)

2021
[11]

Explaining and harness -ing adversarial examples

Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. "Explaining and harness -ing adversarial examples." arXiv preprint arXiv:1412.6572 (2014)

2014 arXiv
[13]

Adversarial perturbations fool deepfake detectors

Gandhi, Apurva, and Shomik Jain. " Adversarial perturbations fool deepfake detectors." 2020 International joint conference on neural networks (IJCNN). IEEE, (2020)

2020
[14]

Adversarial out-domain examples for generative models

Pasquini, Dario, Marco Mingione, and Massimo Bernaschi. "Adversarial out-domain examples for generative models." 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, (2019)

2019
[15]

Trojan attack on deep generative models in autonomous driving

Ding, Shaohua, et al. "Trojan attack on deep generative models in autonomous driving." Security and Privacy in Communication Networks: 15th EAI International Conference, SecureComm 2019, Orlando, FL, USA, October 23 -25, 2019, Proceedings, Part I 15. Springer International Pub...

2019
[16]

Hiding faces in plain sight: Disrupting ai face synthesis with adver -sarial perturbations

Li, Yuezun, et al. "Hiding faces in plain sight: Disrupting ai face synthesis with adver -sarial perturbations." arXiv preprint arXiv:1906.09288 (2019)

2019 arXiv
[17]

Fawkes: Protecting privacy against unauthorized deep learning models

Shan, Shawn, et al. "Fawkes: Protecting privacy against unauthorized deep learning models." 29th USENIX security symposium (USENIX Security 20). (2020)

2020
[18]

Disrupting image -translation-based deepfake algorithms with adversaria l attacks

Yeh, Chin-Yuan, et al. "Disrupting image -translation-based deepfake algorithms with adversaria l attacks." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops. (2020)

2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [12]

Adversarial examples in the physical world

Kurakin, Alexey, Ian J. Goodfellow, and Samy Bengio. "Adversarial examples in the physical world." Artificial intelligence safety and security. Chapman and Hall/CRC, (2018). 99-112

work page 2018

[2] [1]

A survey on generative adversarial net -works: Variants, applications, and training

Jabbar, Abdul, Xi Li, and Bourahla Omar. "A survey on generative adversarial net -works: Variants, applications, and training." ACM Computing Surveys (CSUR) 54.8 (2021): 1-49

work page 2021

[3] [2]

Gener ative adversarial networks

Goodfellow, Ian, et al. "Gener ative adversarial networks." Communications of the ACM 63.11 (2020): 139-144

work page 2020

[4] [3]

Training generative adversarial networks with limited data

Karras, Tero, et al. "Training generative adversarial networks with limited data." Ad-vances in neural information processing systems 33 (2020): 12104-12114

work page 2020

[5] [4]

Generative adversarial networks for image and video synthesis: Algorithms and applications

Liu, Ming-Yu, et al. "Generative adversarial networks for image and video synthesis: Algorithms and applications." Proceedings of the IEEE 109.5 (2021): 839-862

work page 2021

[6] [5]

Generative adversarial networks in computer vision: A survey and taxon omy

Wang, Zhengwei, Qi She, and Tomas E. Ward. "Generative adversarial networks in computer vision: A survey and taxon omy." ACM Computing Surveys (CSUR) 54.2 (2021): 1-38

work page 2021

[7] [6]

Alias -free generative adversarial networks

Karras, Tero, et al. "Alias -free generative adversarial networks." Advances in neural in -formation processing systems 34 (2021): 852 - 863

work page 2021

[8] [7]

A u -net based discriminator for generative adversarial networks

Schonfeld, Edgar, Bernt Schiele, and Anna Khoreva. "A u -net based discriminator for generative adversarial networks." Proceedings of the IEEE/CVF conference on comput -er vision and pattern recognition. (2020)

work page 2020