\begin{split}
    {\mathcal{L}}_{GAN} = &\quad{\mathbb{E}}_{x}\left[{\log\mathcal{D}(x)}\right] +\\
    &\quad{\mathbb{E}}_{x}{\left[\log(1-\mathcal{D}(x+\mathcal{G}(x)))\right]}
    \end{split}\end{aligned}$$

Finally, AdvFaces is trained in an end-to-end fashion with the following objective: $$\begin{aligned}
 {\mathcal{L}}&= {\mathcal{L}}_{GAN} + \lambda_{i} {\mathcal{L}}_{identity} + \lambda_{p}{\mathcal{L}}_{perturbation}\end{aligned}$$ where $\lambda_i$ and $\lambda_p$ are hyper-parameters controlling the relative importance of identity and perturbation losses, respectively. Note that ${\mathcal{L}}_{GAN}$ and ${\mathcal{L}}_{perturbation}$ encourages the generated images to be visually similar to the original face images, while ${\mathcal{L}}_{identity}$ optimizes for a high attack success rate. We train AdvFaces as a minmax game via $\{\text{arg}~\text{min}_{\mathcal{G}}\text{max}_{\mathcal{D}}{\mathcal{L}}\}$. After training, the generator $\mathcal{G}$ can generate an adversarial face image for any input image and can be tested on any black-box face recognition system.

[@lcccccccc@]{} **Obfuscation Attack** & & & & & & &\
Attack Success Rate (%)\
FaceNet [@facenet] & 99.67 && 23.34 && 99.70 && **99.96**\
SphereFace [@sphereface] & 97.22 && 29.49 && **99.34** && 98.71\
ArcFace [@arcface] & **64.53** && 03.43 && 33.25 && 35.30\
COTS-A & **82.98** && 08.89 && 18.74 && 32.48\
COTS-B & **60.71** && 05.05 && 01.49 && 18.75\
Structural Similarity & **0.95 $\pm$ 0.01** && 0.82 $\pm$ 0.12 && 0.29 $\pm$ 0.06 && 0.25 $\pm$ 0.06\
Computation Time (s) & **0.01** && 3.22 && 11.74 && 0.03\
\
**Impersonation Attack** & & 