obtain an adversarial face example that can be used either for impersonating any target identity or obfuscating one’s own identity (see Figure \[fig:overview\]). The contributions of the paper can be summarized as follows:

1.  A GAN, AdvFaces, that learns to generate visually realistic adversarial face images that are misclassified by state-of-the-art AFR systems.

2.  Adversarial faces generated via AdvFaces are model-agnostic and transferable, and achieve high success rate on 5 state-of-the-art automated face recognition systems.

3.  Visualizing the facial regions, where pixels are perturbed and analyzing the effect of varying image resolution on the amount of perturbation.

4.  An open-source[^2] automated adversarial face generator permitting users to control the amount of perturbation.

Related Work
============

Generative Adversarial Networks (GANs)
--------------------------------------

Generative Adversarial Networks [@goodfellow_gan] have success in a wide variety of image synthesis applications [@dcgan; @laplacian] such as style transfer [@style_transfer1; @style_transfer2; @style_transfer3], image-to-image translation [@pix_to_pix; @cycle_gan], and representation learning [@rep1; @rep2; @rep3]. Isola showed that an image-to-image conditional GAN can vastly improve the synthesis results [@pix_to_pix]. In our work, we adopt a similar adversarial loss and image-to-image network architecture in order to learn a mapping from the input face image to a perturbed output image such that the perturbed 