![image](fig/state_art/2644.jpg){width=".15\textwidth"}   ![image](fig/state_art/3050.jpg){width=".15\textwidth"}   ![image](fig/state_art/5261.jpg){width=".15\textwidth"}   ![image](fig/state_art/advfaces/5261.jpg){width=".15\textwidth"}   ![image](fig/state_art/a3gn/5261.jpg){width=".15\textwidth"}   ![image](fig/state_art/fgsm/5261.jpg){width=".15\textwidth"}
                                                                                      0.80                                                      0.15                                                           0.34                                                             0.33                                                           0.42
  --------------------------------------------------------- --------------------------------------------------------- --------------------------------------------------------- ------------------------------------------------------------------ -------------------------------------------------------------- --------------------------------------------------------------

\
(b) Impersonation Attack

Experimental Results
====================

#### Evaluation Metrics

We quantify the effectiveness of the adversarial attacks generated by AdvFaces and other state-of-the-art baselines via (i) *attack success rate* and (ii) *structural similarity (SSIM)*.

The attack success rate for *obfuscation attack* is computed as, $$\begin{aligned}
   \text{Attack Success Rate} &= \frac{\text{(No. of Comparisons $< \tau$)}}{\text{Total No. of Comparisons}}
   \label{eq:attack1}\end{aligned}$$ where each comparison consists of a subject’s adversarial probe and an enrollment image. Here, $\tau$ is a pre-determined threshold computed at, say, 0.1% FAR[^4]. Attack success rate for *impersonation attack* is defined as, $$\begin{aligned}
   \text{Attack Success Rate} &= \frac{\text{(No. of Comparisons $\geq \tau$)}}{\text{Total No. of Comparisons}}
   \label{eq:attack2}\end{aligned}$$ Here, a comparison comprises of an adversarial image synthesized with a target’s probe and matched to the target’s enrolled image. We evaluate the success rate for the impersonation setting via 10-fold cross-validation where each fold consists of a randomly chosen target. Similar to prior studies [@song], in order to measure the similarity between the adversarial example and the input face, we compute the structural similarity index (SSIM) between the images. SSIM is a normalized metric between $-1$ 