identification and only perturbs those salient facial regions (such as eyebrows and nose). Once trained, AdvFaces generates high quality and perceptually realistic adversarial examples that are benign to the human eye but can evade state-of-the-art black-box face matchers, outperforming other state-of-the-art adversarial face methods.

Implementation Details
======================

*AdvFaces* is implemented using Tensorflow r1.12.0. A single NVIDIA Quadro M6000 GPU is used for training and testing. \[apdx:implementation\]

#### Data Preprocessing

All face images are passed through MTCNN face detector [@mtcnn] to detect five landmarks (two eyes, nose, and two mouth corners). Via similarity transformation, the face images are aligned. After transformation, the images are resized to $160\times 160$. Before passing into networks, each pixel in the RGB image is normalized by subtracting 127.5 and dividing by 128.

#### Architecture

Let `c7s1-k` be a $7\times7$ convolutional layer with $k$ filters and stride $1$. `dk` denotes a $4\times 4$ convolutional layer with $k$ filters and stride $2$. `Rk` denotes a residual block that contains two $3\times 3$ convolutional layers. `uk` denotes a $2\times$ upsampling layer followed by a $5\times 5$ convolutional layer with $k$ filters and stride $1$. We apply Instance Normalization and Batch Normalization to the generator and discriminator, respectively. We use 