Leaky ReLU with slope 0.2 in the discriminator and ReLU activation in the generator. The architectures of the two modules are as follows:

-   Generator:\
    `c7s1-64,d128,d256,R256,R256,R256, u128, u64, c7s1-3`

-   Discriminator:\
    `d32,d64,d128,d256,d512`

A $1\times 1$ convolutional layer with $3$ filters and stride $1$ is attached to the last convolutional layer of the discriminator for the patch-based GAN loss ${\mathcal{L}}_{GAN}$.

We apply the `tanh` activation function on the last convolution layer of the generator to ensure that the generated image $\in[-1, 1]$. In the paper, we denoted the output of the tanh layer as an “adversarial mask”, $\mathcal{G}(x) \in [-1,1]$ and $x \in [-1,1]$. The final adversarial image is computed as $x_{adv} = 2 \times \texttt{clamp}\left[ \mathcal{G}(x) + \left(\frac{x+1}{2}\right) \right]_{0}^{1} -1$. This ensures $\mathcal{G}(x)$ can either add or subtract pixels from $x$ when $\mathcal{G}(x) \neq 0$. When $\mathcal{G}(x)\to0$, then $x_{adv}\to x$.

The overall algorithm describing the training procedure of *AdvFaces* can be found in Algorithm \[apdx:alg\].

[Training Dataset]{} [Cosine similarity between an image pair obtained by face matcher]{} [Generator with weights $\mathcal{G}_\theta$]{} [Discriminator with weights $\mathcal{D}_\theta$]{} [Batch size]{} [Learning rate]{} Sample a batch of target images ${y^{(i)}} \sim \mathcal{X}$ $\delta^{(i)} = \mathcal{G}((x^{(i)}, y^{(i)})$ $\delta^{(i)} = \mathcal{G}(x^{(i)})$ $x_{adv}^{(i)} = x^{(i)} + \delta^{(i)}$ 