the given probes (Column 1). AdvFaces outputs adversarial masks (Column 2) which are added to the probes to obtain adversarial images in the last column. State-of-the-art face matchers can be evaded by slightly perturbing salient facial regions, such as eyebrows, eyeballs, and nose (cosine similarity obtained via ArcFace [@arcface]).[]{data-label="fig:visualization"}](fig/viz/dwayne_m.jpg "fig:"){width=".23\textwidth"}   ![Pixels that have been perturbed (Column 3) to generate the corresponding adversarial images for the given probes (Column 1). AdvFaces outputs adversarial masks (Column 2) which are added to the probes to obtain adversarial images in the last column. State-of-the-art face matchers can be evaded by slightly perturbing salient facial regions, such as eyebrows, eyeballs, and nose (cosine similarity obtained via ArcFace [@arcface]).[]{data-label="fig:visualization"}](fig/viz/dwayne_v_o.png "fig:"){width=".23\textwidth"}   ![Pixels that have been perturbed (Column 3) to generate the corresponding adversarial images for the given probes (Column 1). AdvFaces outputs adversarial masks (Column 2) which are added to the probes to obtain adversarial images in the last column. State-of-the-art face matchers can be evaded by slightly perturbing salient facial regions, such as eyebrows, eyeballs, and nose (cosine similarity obtained via ArcFace [@arcface]).[]{data-label="fig:visualization"}](fig/viz/dwayne_g.jpeg "fig:"){width=".23\textwidth"}  
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       [0.26]{}                                                                                                                                                                                                                                                                   
  ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- --

![Trade-off between attack success rate and structural similarity for impersonation attacks. We choose $\epsilon = 8.0$.[]{data-label="fig:min_eps"}](test.pdf){width="\linewidth"}

