# KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation
## 6 Conclusions  
In this paper, we propose KRT-FUAP, a facial universal adversarial perturbation generation approach that utilizes a learnable flow field to fine-tune key regions. This study examined the vulnerability of face recognition system to universal adversarial perturbations and evaluated the influence of key regions on the accuracy of the system. A key region mask is extracted from the dataset and fine-tuned using a learnable flow field as a dimension to modify universal adversarial perturbations in the spatial domain, resulting in the generetion of adversarial samples for faces. Additionally, we propose a scheme that balances the adversarial effectiveness and stealthiness of perturbation by incorporating adversarial loss and stealthiness loss. Experimental results indicate that our proposed method achieves a fooling rate of approximately 80% across different datasets and backbone networks. The stealthiness of our method shows a significant advantage both in the visualization of adversarial examples and in objective stealth evaluation metrics. Specifically, on the IResNet50 backbone network, the perturbations we generated achieved a SSIM value of 0.9304 and a PSNR value of 34.0157. Although our method has a relatively \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Backbone** & **Method** & **FR \(\uparrow\)** & **SSIM \(\uparrow\)** & **PSNR \(\uparrow\)** \\ \hline \multirow{4}{*}{LFW} & \multirow{2}{*}{IResNet50} & KRT-FUAP & 81.9\% & 0.9304 & 34.0157 \\  & & Euclidean distance & 80.2\% & 0.8875 & 31.7418 \\  & & Cosine similarity & 80.4\% & 0.8963 & 31.9427 \\ \cline{2-5}  & \multirow{2}{*}{MobileFaceNet} & KRT-FUAP & 80.1\% & 0.9044 & 32.9812 \\  & & Euclidean distance & 78.9\% & 0.8622 & 30.8143 \\ \cline{1-1}  & & Cosine similarity & 79.1\% & 0.8657 & 30.8807 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Fooling rate and objective stealthiness metrics for different loss setting. higher complexity and requires a longer training time compared to existing adversarial perturbation generation algorithms, it is acceptable to obtain better aggressiveness and stealthiness by occupying slightly more hardware resources. Our proposed approach also has several limitations. Although it demonstrates certain black-box attack capabilities, its attack efficacy and stealth metrics may be affected in more complex black-box scenarios. The KRT-FUAP approach proposed in this paper involves additive perturbations, generating adversarial examples by superimposing universal perturbations at selected effective locations in the spatial domain of facial images. Consequently, the effectiveness of the perturbation depends on this superimposition operation. This method has certain limitations when applied to side facial images, as the key regions in side facial images are significantly different from those in front facial images. Research on perturbations targeting profile images presents substantial challenges. Adversarial attack is the opposite of adversarial defense. Designing universal adversarial attack strategies targeting face recognition technology holds significant guiding importance for enhancing model robustness and developing effective defense mechanisms. Additionally, because adversarial perturbations can disrupt the feature representations extracted using face recognition models, this provides a potential approach for protecting facial privacy. Future research can explore other perspectives, and we hope our work will inspire further innovative studies. Conceptualization, X.J., Y.L. and H.W. ; methodology, X.J., Y.L. and G.S. ; software, X.J. ; validation, G.S., Y.C., Z.D. and H.W. ; writing--original draft preparation, X.J. and Y.L. ; writing--review and editing, G.S., Y.C., Z.D. and H.W. ; supervision, H.W. ; project administration, H.W. ; funding acquisition, H.W. All authors have read and agreed to the published version of the manuscript. This research was funded by the Natural Science Foundation of China (NSFC) under grant U23B2023. Not applicable.