If the recognition is done by autoencoder network as I suspect, then generative adversarial network could break it easily.