Table 12. Comparison of time costs for different attack methods.

Type	Method	Training cost (s)	Inference cost (s)	Total cost (s)
Algorithm-based	FGSM		0.11	0.11
	MI-FGSM		0.16	0.16
	C&W		14.71	14.71
	TIP-IM		9.83	9.83
	AT3D		8.95	8.95
	SiblingAttack		114.23	114.23
GAN-based	Adv-MakeUP	43,632	0.37	43,633.24
	DiffAM	1,558	3.95	1,562.59
	AdvFaces	41,508	0.12	0.12
Our model	AdvFaceGAN	483,301	0.25	0.25