BadLogo: A Physically Realizable Adversarial Sticker for Evaluating the Robustness of Face Recognition Models

Deep learning-based face recognition systems are increasingly deployed in security-critical applications, yet remain vulnerable to adversarial attacks. Existing physical attacks often lack stealth or realism, limiting their utility for evaluating realworld robustness. To address this, we propose BadLogo, a physically realizable, sticker-based perturbation that balances attack effectiveness and visual plausibility. We also introduce PLOF-GAN, an attack model employing a two-stage pretraining strategy to progressively transform benign logos into high-quality adversarial patches. An improved 3D mapping algorithm ensures precise alignment with facial geometry, enhancing the realism of physical deployment. To quantitatively assess stealthiness and visual plausibility, we design a new metric, BROI, which measures both region occlusion and semantic coherence. Whether in evasion or impersonation attack scenarios, extensive experiments on identity verification and identification tasks demonstrate that BadLogo achieves high attack success rates with superior stealthiness compared to existing methods. Notably, our approach exhibits strong transferability across multiple face recognition models and generalizes to object detection scenarios. By leveraging adversarial stickers, this work reveals critical vulnerabilities in face recognition systems under physical-world conditions and offers new perspectives for developing more robust models.