an individual. Therefore, perturbing these salient regions are enough to evade state-of-the-art face recognition systems.

Effect of Perturbation Amount
-----------------------------

The perturbation hinge loss, ${\mathcal{L}}_{perturbation}$ is bounded by a hyper-parameter, $\epsilon$. That is, the $L_2$ norm of the adversarial mask must be at least $\epsilon$. Without this constraint, the adversarial mask becomes an empty image with no changes to the probe. With $\epsilon$, we can observe a trade-off between the attack success rate and the structural similarity between the probe and synthesized adversarial face in Figure \[fig:min\_eps\]. A higher $\epsilon$ leads to less perturbation restriction. This generates a higher attack success rate at the cost of a lower structural similarity. For an impersonation attack, this implies that the adversarial image may contain facial features from both the hacker and the target. In our experiments, we chose $\epsilon = 8.0$ and $\epsilon = 3.0$ for impersonation and obfuscation attacks, respectively.

Conclusions
===========

We proposed a new method of adversarial face synthesis, namely *AdvFaces*, that automatically generates adversarial face images with imperceptible perturbations evading state-of-the-art face matchers. With the help of a GAN, and the proposed perturbation and identity losses, AdvFaces learns the set of pixel locations required by face matchers for 