the GAN loss (${\mathcal{L}}_{GAN}$), perturbation loss ${\mathcal{L}}_{perturbation}$, and identity loss ${\mathcal{L}}_{identity}$, respectively. The GAN loss helps to ensure the visual quality of the synthesized faces are maintained. With the generator alone, undesirable artifacts are introduced. Without the proposed perturbation loss, perturbations in the adversarial mask are unbounded and therefore, leads to a lack in perceptual quality. The identity loss is imperative in ensuring an adversarial image is obtained. Without the identity loss, the synthesized image cannot evade state-of-the-art face matchers. We find that every component of AdvFaces is necessary in order to obtain an adversarial face that is not only perceptually realistic but can also evade state-of-the-art face matchers.

What is AdvFaces Learning?
--------------------------

During training, AdvFaces learns to perturb the salient facial regions that can evade the face matcher, $\mathcal{F}$ (FaceNet [@facenet] in our case). This is enforced by ${\mathcal{L}}_{perturbation}$ which penalizes large perturbations and thereby, restricts perturbations to only salient pixel locations. In Figure \[fig:visualization\], AdvFaces synthesizes the adversarial masks corresponding to the probes. We then threshold the mask to extract pixels with perturbation magnitudes exceeding $0.40$. It can be inferred that the eyebrows, eyeballs, and nose contain highly discriminative information that an AFR system utilizes to identify 