Robust Physical-World Attacks on Face Recognition

•A novel physical attack method, dubbed PadvFace, that models complicated physical-world condition variations in attacking face recognition.•Explore the attack complexity with various physical-world conditions and propose an efficient curriculum adversarial attack (CAA) algorithm.•Build a standardized testing protocol for facilitating the fair evaluation of physical attacks on face recognition.•Conduct a comprehensive experimental study and obtain the superior performance of physical attacks.