Algorithm 2 Training AdvFace in impersonation attack

Input:  $\mathcal{X}$ Training Face Dataset f Target Face Dataset $\mathcal{F}$ Cosine similarity between an image pair obtained by face matcher $\mathcal{G}$ Generator with weight ${\mathcal{G}}_{\theta }$ $\mathcal{D}$ Discriminator with ${\mathcal{D}}_{\theta }$ m Batch size $\alpha$ Learning size   1:for number of training iterations do   2:   Sample a batch of probes ${\left\{x^{\left(i\right)}\right\}}_{i=1}^m\sim \mathcal{X}$   3:   Sample a batch of target images ${\left\{y^{\left(i\right)}\right\}}_{i=1}^m\sim f$   4:   ${\delta }^{\left(i\right)}=\mathcal{G}(x^{\left(i\right)},y^{\left(i\right)})$   5:   $x_{adv}^{\left(i\right)}=x^{\left(i\right)}+{\delta }^{\left(i\right)}$   6:   ${\mathcal{L}}_{perturbation}=\frac{1}{m}[{\sum }_{i=1}^{m}max(P,||{\delta }^{\left(i\right)}{\left|\right|}_2\left)\right]$   7:   ${\mathcal{L}}_{identity}=\frac{1}{m}[{\sum }_{i=1}^{m}E[1-\mathcal{F}(y^{\left(i\right)},x_{adv}^{\left(i\right)})]]$   8:   ${\mathcal{L}}^D=\frac{1}{m}[{\sum }_{i=1}^{m}log(1-\mathcal{D}(x_{adv}^{\left(i\right)}))]$   9:   ${\mathcal{L}}_{adv}=\frac{1}{m}[{\sum }_{i=1}^{m}log(\mathcal{D}(y^{\left(i\right)}))+log(1-\mathcal{D}(x_{adv}^{\left(i\right)}))]$ 10:   ${\mathcal{L}}^{\mathcal{G}}={\mathcal{L}}_{adv}^{\mathcal{G}}+{\lambda }_i{\mathcal{L}}_{identity}+{\lambda }_p{\mathcal{L}}_{perturbation}$ 11:   ${\mathcal{G}}_{\theta }=\mathrm{Adam}({▽}_{\mathcal{G}}{\mathcal{L}}^{\mathcal{G}},{\mathcal{G}}_{\theta },{\beta }_1,{\beta }_2)$ 12:   ${\mathcal{D}}_{\theta }=\mathrm{Adam}({▽}_{\mathcal{D}}{\mathcal{L}}^{\mathcal{D}},{\mathcal{G}}_{\theta },{\beta }_1,{\beta }_2)$ 13: end for