to obtain a reasonable adversarial image [@dong]. Further, most Commercial-Off-The-Shelf (COTS) face matchers permit only a few queries at a time to prevent such attacks.

3.  *Semi-whitebox* attack: Here, a white-box model is utilized *only during training* and then adversarial examples are synthesized during inference without any knowledge of the deployed AFR model.

Semi-whitebox settings are appropriate for crafting adversarial faces; once the network learns to generate the perturbed instances based on a single face recognition system, attacks can be transferred to any black-box AFR systems. However, past approaches, based on Generative Adversarial Networks (GANs) [@advgan; @atgan; @acgan], were proposed in the image classification domain and rely on softmax probabilities [@advgan; @atgan; @acgan; @song]. Therefore, the number of object classes are assumed to be known during training and testing. In the realm of face recognition, AFR systems do not utilize the softmax layer for classification (as the number of identities are not fixed) instead features from the last fully connected layer are used for comparing face images. Song proposed a GAN for generating adversarial examples specifically in the domain of face recognition, however, their method requires access to the face images enrolled in the gallery which may not be feasible 