Abstract:  Face recognition is gradually becoming a monitoring tool which posed enormous threats to human privacy. For this reason， the paper proposes a semantic adversarial attack based on generative adversarial networks called SGAN-AA that modifies the significant facial features for images. It predicts the most significant attributes by using cosine similarity or probability score， and uses one or more facial features in white-box and black-box settings for impersonation and dodging attacks. The experimental results show that the method can generate diverse and realistic adversarial facial images while avoiding affecting human perception of facial recognition. The success rate of SGAN-AA's attack on black box models is 80.5%， which is 35.5 percentage points higher than common methods under impersonation attacks. Predicting the most significant attributes will improve the success rate of adversarial attacks in both white-box and black-box settings， and can enhance the transferability of the generated adversarial examples.

Key words: Key words: face recognition, adversarial attack, generative adversarial networks, adversarial example, transferability