Abstract: Physical adversarial attacks on face recognition remain challenging because digitally generated perturbations are difficult to reproduce accurately on a human face. Although makeup-based ...