of the face and adversarial image is generated by gradient-based methods. The adversarial eyeglasses can also be synthesized via generative networks [@sharif_adversarial]. However, these methods rely on white-box manipulations of face recognition models, which is impractical in real-world scenarios. Dong proposed an evolutionary optimization method for generating adversarial faces in black-box settings [@dong]. However, they require at least 1,000 queries to the target AFR system before a realistic adversarial face can be synthesized. Song employed a conditional variation autoencoder GAN for crafting adversarial face images in a semi-whitebox setting [@song]. However, they only focused on impersonation attacks and require at least 5 images of the target subject for training and inference. In contrast, we train a GAN that can perform both obfuscation and impersonation attacks and requires a single face image of the target subject.

AdvFaces
========

Our goal is to synthesize a face image that visually appears to pertain to the target person, yet automatic face recognition systems either incorrectly matches the synthesized image to another person or does not match to genuine person’s gallery images. Figure \[fig:arch\] outlines the proposed framework.

![Overview of the proposed adversarial generation method in an obfuscation setting. Given a probe face image, AdvFaces 