accuracies as high as 99% True Accept Rate (TAR) at 0.1% False Accept Rate (FAR) [@nist]. The model behind this success is a Convolutional Neural Network (CNN) [@facenet; @sphereface; @arcface] and the availability of large face datasets to train the model. However, CNN models have been shown to be vulnerable to *adversarial perturbations *[^1][@szegedy; @goodfellow; @universal; @boosting]. Szegedy first showed the dangers of *adversarial examples* in the image classification domain, where perturbing the pixels in the input image can cause CNNs to misclassify the image [@szegedy] even when the amount of perturbation is imperceptible to the human eye. Despite impressive recognition performance, prevailing AFR systems are still vulnerable to the growing threat of adversarial examples (see Figure \[fig:frontpage\]) as explained below.

\

A hacker can maliciously perturb his face image in a manner that can cause AFR systems to match it to a target victim (*impersonation attack*) or any identity other than the hacker (*obfuscation attack*). Yet to the human observer, this adversarial face image should appear as a legitimate face photo of the attacker (see Figure \[fig:overview\]). This is different from face *presentation attacks*, where the hacker assumes the identity of a target by presenting a fake face (also 