automatically generates an adversarial mask that is then added to the probe to obtain an adversarial face image.[]{data-label="fig:arch"}](arch.pdf){width="\linewidth"}

AdvFaces comprises of a generator $\mathcal{G}$, a discriminator $\mathcal{D}$, and face matcher $\mathcal{F}$ (see Figure \[fig:arch\] and Algorithm \[alg:advfaces\]).

#### Generator

The proposed generator takes an input face image, $x \in \mathcal{X}$, and outputs an image, $\mathcal{G}(x)$. The generator is conditioned on the input image $x$; for different input faces, we will get different synthesized images.

Since our goal is to obtain an adversarial image that is metrically close to the original input image, $x$, we do not wish to perturb all the pixels in the original image. For this reason, we treat the output from the generator as an additive mask and the adversarial face is $x + \mathcal{G}(x)$. If the magnitude of the pixels in $\mathcal{G}(x)$ is minimal, then the adversarial image comprises mostly of the probe $x$. Here, we denote $\mathcal{G}(x)$ as an “adversarial mask". In order to bound the magnitude of the adversarial mask, we introduce a *perturbation hinge loss* during training by minimizing the $L_2$ norm[^3]: $$\begin{aligned}
    {\mathcal{L}}_{perturbation} &= {\mathbb{E}}_{x}\left[\text{max}\left(\epsilon,{{\left\lVert\mathcal{G}(x)\right\rVert}_2}\right)\right]\end{aligned}$$ where $\epsilon\in [0,\infty)$ is a hyperparameter that controls the minimum amount of perturbation allowed.

In order to 