face) recognition system, including AFR (see Figure \[fig:attacks\]). An adversarial face image can be inserted in the AFR system at point 2, where compromised face embeddings will be obtained by the feature extractor that could be used for impersonation or obfuscation attacks. The entire gallery can also be compromised if the hacker enrolls an adversarial image at point 6, where none of the probes will match to the correct identity’s gallery.

![Eight points of attacks in an automated face recognition system [@ratha]. An adversarial image can be injected in the AFR system at points 2 and 6 (solid arrows).[]{data-label="fig:attacks"}](attacks.pdf){width="0.98\linewidth"}

Three broad categories of adversarial attacks have been identified.

1.  *White-box* attack: A majority of the prior work assumes full knowledge of the CNN model and then iteratively adds imperceptible perturbations to the probe image via various optimization schemes [@goodfellow; @madry; @carlini; @xiao; @evtimov; @papernot; @kurakin; @deepfool; @gflm]. We posit that this is unrealistic in real-world scenarios, since the attacker may not be able to access the models.

2.  *Black-box* attack: Generally, black-box attacks are launched by querying the outputs of the deployed AFR system [@dong], [@liu]. This may not be efficient as it may take a large number of queries 