achieve our goal of impersonating a target subject or obfuscating one’s own identity, we need a face matcher, $\mathcal{F}$, to supervise the training of AdvFaces. For obfuscation attack, the goal is to generate an adversarial image that does not match any of the subject’s gallery images. At each training iteration, AdvFaces tries to minimize the cosine similarity between face embeddings of the input probe $x$ and the generated image $x + \mathcal{G}(x)$ via an *identity* loss function: $$\begin{aligned}
    {\mathcal{L}}_{identity} &= {\mathbb{E}}_{x}{\left[\mathcal{F}(x, x+\mathcal{G}(x))\right]}\end{aligned}$$ For an impersonation attack, AdvFaces maximizes the cosine similarity between the face embeddings of a randomly chosen target’s probe, $y$, and the generated adversarial face $x+\mathcal{G}(x)$ via: $$\begin{aligned}
    {\mathcal{L}}_{identity} &= {\mathbb{E}}_{x}{\left[1- \mathcal{F}(y, x+\mathcal{G}(x))\right]}\end{aligned}$$

The perturbation and identity loss functions enforce the network to learn the salient facial regions that can be perturbed minimally in order to evade automatic face recognition systems.

#### Discriminator

Akin to previous works on GANs [@goodfellow_gan; @pix_to_pix], we introduce a discriminator in order to encourage perceptual realism of the generated images. We use a fully-convolution network as a patch-based discriminator [@pix_to_pix]. Here, the discriminator, $\mathcal{D}$, aims to distinguish between a probe, $x$, and a generated adversarial face image $x+\mathcal{G}(x)$ via a GAN loss: $$\begin{aligned}
    