  Due to the inherent robustness of segmentation models, traditional
norm-bounded attack methods show limited effect on such type of models. In this
paper, we focus on generating unrestricted adversarial examples for semantic
segmentation models. We demonstrate a simple and effective method to generate
unrestricted adversarial examples using conditional generative adversarial
networks (CGAN) without any hand-crafted metric. The na\"ive implementation of
CGAN, however, yields inferior image quality and low attack success rate.
Instead, we leverage the SPADE (Spatially-adaptive denormalization) structure
with an additional loss item to generate effective adversarial attacks in a
single step. We validate our approach on the popular Cityscapes and ADE20K
datasets, and demonstrate that our synthetic adversarial examples are not only
realistic, but also improve the attack success rate by up to 41.0\% compared
with the state of the art adversarial attack methods including PGD.
