You described an adversarial image as one that has pixels flipped. That has nothing to do with clothing either, and had nothing to do with real time facial recognition as this "adversarial" clothing is meant to disrupt. So I just took your meaningless pixel flipping suggestion back to subject at hand.

Also, from the examples I've seen, facial recognition has no problems recognizing multiple faces in the same image. So I just don't understand the point of clothing like this when all it is going to do is present the software with a few additional things to consider, but not actually stop it from consider the actual face of the wearer of the clothing.