known as spoof face) to a face recognition system (see Figure \[fig:spoof\]). However, in the case of presentation attacks, the hacker needs to actively participate by wearing a mask or replaying a photograph/video of the genuine individual which may be conspicuous in scenarios where human operators are involved (such as airports). As discussed below, adversarial faces, do not require active participation during verification.

Consider for example, the United States Customs and Border Protection (CBP), the largest federal law enforcement agency in the United States [@cbp_largest], which (i) processes entry to the country for over a *million* travellers *everyday* [@cbp_stats] and (ii) employs automated face recognition for verifying travelers’ identities [@cbp_face]. In order to evade being identified as an individual in a CBP watchlist, a terrorist can maliciously enroll an adversarial image in the gallery such that upon entering the border, his legitimate face image will be matched to a known and benign individual or to a fake identity previously enrolled in the gallery. An individual can also generate adversarial examples to dodge his own identity in order to guard personal privacy. Ratha  [@ratha] identified eight points in a biometric system where an attack can be launched against a biometric (including 