Recent　works　have　illustrated　that　many　facial　privacy　protection　methods　are　effective　in　specific　face　recognition　algorithms.　However,　the　COVID-19　pandemic　has　promoted　the　rapid　innovation　of　face　recognition　algorithms　for　face　occlusion,　especially　for　the　face　wearing　a　mask.　It　is　tricky　to　avoid　being　tracked　by　artificial　intelligence　only　through　ordinary　props　because　many　facial　feature　extractors　can　determine　the　ID　only　through　a　tiny　local　feature.　Therefore,　the　ubiquitous　high-precision　camera　makes　privacy　protection　worrying.　In　this　paper,　we　establish　an　attack　method　directed　against　liveness　detection.　A　mask　printed　with　a　textured　pattern　is　proposed,　which　can　resist　the　face　extractor　optimized　for　face　occlusion.　We　focus　on　studying　the　attack　efficiency　in　adversarial　patches　mapping　from　two-dimensional　to　three-dimensional　space.　Specifically,　we　investigate　a　projection　network　for　the　mask　structure.　It　can　convert　the　patches　to　fit　perfectly　on　the　mask.　Even　if　it　is　deformed,　rotated　and　the　lighting　changes,　it　will　reduce　the　recognition　ability　of　the　face　extractor.　The　experimental　results　show　that　the　proposed　method　can　integrate　multiple　types　of　face　recognition　algorithms　without　significantly　reducing　the　training　performance.　If　we　combine　it　with　the　static　protection　method,　people　can　prevent　face　data　from　being　collected.