Doesn't this make it worse because you can just make another GAN or something that undoes this?
Yes, it's a never ending race.
For now, we show that if StarGAN is trained on images augmented by adversarial attack it does become more resistant but not completely resistant to attacks.