& & & & &\
Attack Success Rate (%)\
FaceNet [@facenet] & 20.85 $\pm$ 0.40 && 05.99 $\pm$ 0.19 && **76.79 $\pm$ 0.26** && 13.04 $\pm$ 0.12\
SphereFace [@sphereface] & **20.19 $\pm$ 0.27** && 07.94 $\pm$ 0.19 && 09.03 $\pm$ 0.39 && 02.34 $\pm$ 0.03\
ArcFace [@arcface] & **24.30 $\pm$ 0.44** && 17.14 $\pm$ 0.29 && 19.50 $\pm$ 1.95 && 08.34 $\pm$ 0.21\
COTS-A & **20.75 $\pm$ 0.35** && 15.01 $\pm$ 0.30 && 01.76 $\pm$ 0.10 && 01.40 $\pm$ 0.08\
COTS-B & **19.85 $\pm$ 0.28** && 10.23 $\pm$ 0.50 && 12.49 $\pm$ 0.24 && 04.67 $\pm$ 0.16\
Structural Similarity & **0.92 $\pm$ 0.02** && 0.69 $\pm$ 0.04 && 0.77 $\pm$ 0.04 && 0.48 $\pm$ 0.75\
Computation Time (s) & **0.01** && 0.04 && 11.74 && 0.03\

  --------------------------------------------------------- --------------------------------------------------------- ------------------------------------------------------------------ -------------------------------------------------------------- ------------------------------------------------------------- --------------------------------------------------------------
                         **Gallery**                                                **Probe**                                                    **AdvFaces**                                                   **GFLM [@gflm]**                                              **PGD [@madry]**                                            **FGSM [@goodfellow]**
   ![image](fig/state_art/9024.jpg){width=".15\textwidth"}   ![image](fig/state_art/9040.jpg){width=".15\textwidth"}   ![image](fig/state_art/advfaces/9040.jpg){width=".15\textwidth"}   ![image](fig/state_art/gflm/9040.png){width=".15\textwidth"}   ![image](fig/state_art/pgd/9040.jpg){width=".15\textwidth"}   ![image](fig/state_art/fgsm/9040.jpg){width=".15\textwidth"}
                                                                                      0.68                                                           0.14                                                             0.26                                                          0.27                                                           0.04
   ![image](fig/state_art/1067.jpg){width=".15\textwidth"}   ![image](fig/state_art/1066.jpg){width=".15\textwidth"}   ![image](fig/state_art/advfaces/1066.jpg){width=".15\textwidth"}   ![image](fig/state_art/gflm/1066.png){width=".15\textwidth"}   ![image](fig/state_art/pgd/1066.jpg){width=".15\textwidth"}   ![image](fig/state_art/fgsm/1066.jpg){width=".15\textwidth"}
                                                                                      0.38                                                           0.08                                                             0.12                                                          0.21                                                           0.02
  --------------------------------------------------------- --------------------------------------------------------- ------------------------------------------------------------------ -------------------------------------------------------------- ------------------------------------------------------------- --------------------------------------------------------------

\
(a) Obfuscation Attack\

  --------------------------------------------------------- --------------------------------------------------------- --------------------------------------------------------- ------------------------------------------------------------------ -------------------------------------------------------------- --------------------------------------------------------------
                    **Target’s Gallery**                                       **Target’s Probe**                                             **Probe**                                                    **AdvFaces**                                                 **A$^3$GN [@song]**                                           **FGSM [@goodfellow]**
   ![image](fig/state_art/2495.jpg){width=".15\textwidth"}   ![image](fig/state_art/2494.jpg){width=".15\textwidth"}   ![image](fig/state_art/2928.jpg){width=".15\textwidth"}   ![image](fig/state_art/advfaces/2928.jpg){width=".15\textwidth"}   ![image](fig/state_art/a3gn/2928.jpg){width=".15\textwidth"}   ![image](fig/state_art/fgsm/2928.jpg){width=".15\textwidth"}
                                                                                      0.78                                                      0.10                                                           0.30                                                             0.29                                                           0.36
   