Wagner [@Carlini_2017] introduced three new gradient-based attack algorithms ($l_2$, $l_\infty$, and $l_0$) that are more effective than all previously known methods in terms of the adversarial success rates achieved with minimal perturbation amounts.

Unlike unconstrained domains, the situation is quite different in constrained ones due to the following three characteristics:

1.  The values within a single feature can be binary, continuous or categorical.

2.  The values of different features in a data set can be correlated with one another.

3.  Some features are fixed and cannot be controlled by a potential adversary.

For these reasons, it was not clear whether constrained domains are less vulnerable to adversarial example generation than unconstrained domains. In [@sheatsley_adversarial_nodate], Sheatsley tested the above hypothesis by creating targeted universal perturbation vectors that encode feature saliency within the envelope of domain constraints. The experiment was able to generate misclassification rates greater than $95 \%$ by introducing two algorithms: the adaptive JSMA, which crafts adversarial examples that obey domain constraints, and the histogram sketch generation, which produces adversarial sketches.

In this work, we aim to provide more evidence to the same hypothesis. We adapt the algorithms used in GA, PSO, and GAN to generate adversarial examples in unconstrained 