adversarial faces that are similar to the probe. Moreover, the adversarial images attain a high obfuscation attack success rate on 4 state-of-the-art black-box AFR systems in both obfuscation and impersonation settings. AdvFaces learns to perturb the salient regions of the face, unlike PGD [@madry], FGSM [@goodfellow] which perturbs every pixel in the image. Due to this, we find that, albeit high success rate, the structural similarity between probes and synthesized faces for PGD and FGSM are low. GFLM [@gflm], on the other hand, geometrically warps the face images and thereby, results in low structural similarity. In addition, the state-of-the-art matchers are robust to such geometric deformation which explains the low success rate of GFLM on face matchers. A$^3$GN is also a GAN-based method, however, fails to achieve a reasonable success rate in an impersonation setting. In Figure \[fig:comparison\], we see that, in addition to high success rate, adversarial faces generated by the proposed method are visually appealing and the differences between probe and synthesized images are hardly distinguishable compared to the baselines.

Ablation Study
--------------

In order to analyze the importance of each module in our system, in Figure \[fig:ablation\], we train three variants of AdvFaces for comparison by removing 