#### Experimental Settings

We use ADAM optimizers in Tensorflow with $\beta_{1} = 0.5$ and $\beta_{2}=0.9$ for the entire network. Each mini-batch consists of $32$ face images. We train AdvFaces for 200,000 steps with a fixed learning rate of $0.0001$. Since our goal is to generate adversarial faces with high success rate, the identity loss is of utmost importance. We empirically set $\lambda_i = 10.0$ and $\lambda_p = 1.0$. We train two separate models and set $\epsilon = 3.0$ and $\epsilon = 8.0$ for obfuscation and impersonation attacks, respectively. All experiments are conducted using Tensorflow r1.12.0 and a NVIDIA Quadro M6000 GPU. Implementations are provided in Appendix \[apdx:implementation\].

#### Face Recognition Systems

For all our experiments, we employ 5 state-of-the-art face matchers[^6]. Three of them are publicly available, namely, FaceNet [@facenet], SphereFace [@sphereface], and ArcFace [@arcface]. We also report our results on two commercial-off-the-shelf (COTS) face matchers, COTS-A and COTS-B[^7]. We use FaceNet [@facenet] as the white-box face recognition model, $\mathcal{F}$, during training. *All the testing images in this paper are generated from the same model (trained only with FaceNet) and tested on different matchers.*

Comparison with State-of-the-Art
--------------------------------

In Table \[tab:recognition\], we find that compared to the state-of-the-art, AdvFaces generates 