been used for synthesizing adversarial attacks. Baluja and Fischer proposed a deep autoencoder that learns to transform an input image to an adversarial image [@baluja]. In their work, an $L_2$ norm loss is employed in order to constrain the generated adversarial instance to be close to the original image in the $L_2$ pixel space. In contrast, we apply a deep neural network as a discriminator that distinguishes between real and synthesized face images in order to maintain the perceptual quality of the generated adversarial examples. Studies on synthesizing adversarial instances via GANs are limited in literature [@advgan; @atgan; @acgan]. These methods require softmax probabilities in order to evade an image classifier. However, AFR systems do not employ a softmax classification layer as the number of classes (identities) is not fixed. Instead, we propose an identity loss function better suited for generating adversarial faces using the face embeddings obtained from a face matcher.

Adversarial Attacks on Face Recognition
---------------------------------------

In literature, studies on generating adversarial examples in the face recognition domain are relatively limited. Bose craft adversarial examples by solving constrained optimization such that a face detector cannot detect a face [@bose]. In [@sharif_accessorize], perturbations are constrained to the eyeglass region 