in a real-world setting [@song]. Other approaches for adversarial faces include adding makeup, eyeglasses, hat, or occlusions to faces [@goswami; @sharif_accessorize; @sharif_adversarial].

We emphasize the following requirements of the adversarial face generator:

-   The generated adversarial face images should be perceptually realistic such that a human observer can identify the image as a legitimate face image pertaining to the target subject.

-   The faces need to be perturbed in a manner such that they cannot be identified as the hacker (*obfuscation attack*) or automatically matched to a target subject (*impersonation attack*) by an AFR system.

-   The amount of perturbation should be controllable by the hacker. This will allow the hacker to examine the success of the learning model as a function of amount of perturbation.

-   The adversarial examples should be *transferable* and *model-agnostic* (treat the target AFR model as a black-box). In other words, the generated adversarial examples should have high attack success rate on other black-box AFR systems as well.

We propose an automated adversarial face synthesis method, named *AdvFaces*, which generates an *adversarial mask* for a probe face image and satisfies all the above requirements. The adversarial mask can then be added to the probe to 