image cannot be distinguished from real face images. However, different from prior work on GANs, our objective is to synthesize face images that are not only visually realistic but are also able to evade AFR systems.

Adversarial Attacks on Image Classification
-------------------------------------------

Majority of the published papers have focused on white-box attacks, where the hacker has full access to the target classification model that is being attacked [@szegedy; @goodfellow; @carlini; @xiao; @madry]. Given an image, Goodfellow proposed the Fast Gradient Sign Method (FGSM) which generates an adversarial example by back-propagating through the target model [@goodfellow]. Madry proposed Projected Gradient Descent (PGD), a multi-step variant of FGSM [@madry]. Other works focused on optimizing adversarial perturbation by minimizing an objective function for targeted attacks while satisfying certain constraints [@carlini]. However, these white-box approaches are not feasible in the face recognition domain, as the attacker may not have any knowledge of the deployed AFR system. In addition, the optimization process can require multiple queries to the target system until convergence. Instead, we propose a feed-forward network that can automatically generate an adversarial image with a single forward pass without the need for any knowledge of AFR system during inference.

Indeed, feed-forward networks have 