(completely different image pairs) to $1$ (identical image pairs): $$\begin{aligned}
    SSIM(x, y)\footnotemark = \frac{(2\mu_x\mu_y + c_1)(2\sigma_{xy}+c_2)}{(\mu_x^{2} + \mu^{2}_y + c_1)(\sigma_x^2 + \sigma_y^2+c_2)}
    \label{eq:ssim}\end{aligned}$$

#### Datasets

We train AdvFaces on CASIA-WebFace [@casia] and then test on LFW [@lfw][^5].

-   **CASIA-WebFace** [@casia] comprises of 494,414 face images belonging to 10,575 different subjects.

-   **LFW** [@lfw] contains 13,233 web-collected images of 5,749 different subjects. In order to compute the attack success rate, we only consider subjects with at least two face images. After this filtering, 9,614 face images of 1,680 subjects are available for evaluation.

[YYYYYY]{} Input & w/o ${\mathcal{L}}_{GAN}$ & w/o ${\mathcal{L}}_{prt}$ & w/o ${\mathcal{L}}_{idt}$ & with all\
![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/1_o.jpg "fig:"){width="0.97\linewidth"} & ![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/ablation/wo_d.jpg "fig:"){width="0.97\linewidth"} & ![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/ablation/wo_prt.jpg "fig:"){width="0.97\linewidth"} & ![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/ablation/wo_idt.jpg "fig:"){width="0.97\linewidth"} & ![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/1_g.jpg "fig:"){width="0.97\linewidth"}\
![Variants of AdvFaces trained without GAN loss, perturbation loss, and identity loss, respectively.[]{data-label="fig:ablation"}](fig/3_o.jpg "fig:"){width="0.97\linewidth"} & ![Variants of AdvFaces trained without 