Algorithm 1 Training AdvFace in dodging attack

Input: $\mathcal{X}$ Training Glasses Dataset f Training Face Dataset $\mathcal{F}$ Cosine similarity between an image pair obtained by face matcher $\mathcal{G}$ Generator with weight ${\mathcal{G}}_{\theta }$ $\mathcal{D}$ Discriminator with ${\mathcal{D}}_{\theta }$ m Batch size $\alpha$ Learning size   1:for number of training iterations do   2:   Sample a batch of probes ${\left\{x^{\left(i\right)}\right\}}_{i=1}^m\sim \mathcal{X}$   3:   Sample a batch of origin face images ${\left\{y^{\left(i\right)}\right\}}_{i=1}^m\sim f$   4:   ${\delta }^{\left(i\right)}=\mathcal{G}\left(x^{\left(i\right)}\right)$   5:   $x_{adv}^{\left(i\right)}=x^{\left(i\right)}+{\delta }^{\left(i\right)}$   6:   ${\mathcal{L}}_{perturbation}=\frac{1}{m}[{\sum }_{i=1}^{m}max(P,||{\delta }^{\left(i\right)}{\left|\right|}_2\left)\right]$   7:   ${\mathcal{L}}_{identity}=\frac{1}{m}[{\sum }_{i=1}^{m}E[(\mathcal{F}(y^{\left(i\right)},x_{adv}^{\left(i\right)}))]]$   8:   ${\mathcal{L}}^{\mathcal{D}}=\frac{1}{m}[{\sum }_{i=1}^{m}log(1-\mathcal{D}(x_{adv}^{\left(i\right)}))]$   9:   ${\mathcal{L}}_{adv}=\frac{1}{m}[{\sum }_{i=1}^{m}log(\mathcal{D}(x^{\left(i\right)}))+log(1-\mathcal{D}(x_{adv}^{\left(i\right)}))]$ 10:   ${\mathcal{L}}^{\mathcal{G}}={\mathcal{L}}_{adv}+{\lambda }_i{\mathcal{L}}_{identity}+{\lambda }_p{\mathcal{L}}_{perturbation}$ 11:   ${\mathcal{G}}_{\theta }=\mathrm{Adam}({▽}_{\mathcal{G}}{\mathcal{L}}^{\mathcal{G}},{\mathcal{G}}_{\theta },{\beta }_1,{\beta }_2)$ 12:   ${\mathcal{D}}_{\theta }=\mathrm{Adam}({▽}_{\mathcal{D}}{\mathcal{L}}^{\mathcal{D}},{\mathcal{G}}_{\theta },{\beta }_1,{\beta }_2)$ 13:end for