# KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation
## 3 Methodology
### Facial Key Regions  
Image classification is coarse-grained classification, where the differences between categories are substantial, and classification is achieved by focusing on and learning the distinct differences between these categories. In contrast, the face recognition task is fine-grained classification, characterized by minimal differences between identities, necessitating the differentiation of subtle variations between different faces. The structure of the face comprises multiple feature regions, each containing numerous unique characteristics, such as the shape of the eyes, the width of the nose, and the contour of the mouth. These features are crucial for distinguishing between different individuals. Existing deep learning-based methods rely on extracting various features from images, and semantic key regions provide highly discriminative features that enhance the discriminative power of feature vectors. In the interpretability task of face recognition, [PERSON] et al. (2013) investigated the impact of different facial key regions on the extraction of face recognition embedding vectors by conducting regional occlusion on facial data. Their results show that different facial key regions exhibit regional characteristics in different dimensions of the embedding vector, implying that the facial key region features of different faces are the primary factors affecting face recognition accuracy. Figure 2: Architecture diagram of KRT-FUAP. First, keypoint detection is employed to acquire the positions of keypoints on the facial images. The convex hull algorithm is then utilized to obtain the key regions of these facial images, and the intersection of these key regions is taken to obtain the key regions mask tailored to the dataset. Subsequently, spatial transformation flow field and noise are initialized, and the flow field is utilized to control the spatial transformation of the key regions mask, thereby obtaining learnable key regions. Afterward, perturbation weights are adjusted based on the positions of these regions to obtain universal adversarial perturbation. The perturbation is superimposed onto clean images, and adversarial loss and stealthiness loss are computed separately using a target facial recognition model and a VGG model. The iteration continues until a certain criterion is fulfilled. To align with the characteristics of UAPs, it is necessary to identify common patterns across the entire dataset of facial images. Therefore, we focused on the facial key regions. Face recognition typically conducts alignment preprocessing on facial images, resulting in a consistent distribution of facial features in the dataset. These regions with fixed distributions of facial features are suitable for the application of UAP. To validate this idea, we conducted experiments using different masks and tested the model's accuracy, as shown in Figure 3. Detailed experimental procedures and results can be found in Section 4. The results indicate that the impact of key regions on face recognition accuracy is indeed more significant than that of non-key regions. The aligned face dataset \(\mathrm{X}=\{\mathrm{x}_{1},\mathrm{x}_{2},\ldots,\mathrm{x}_{n}\}\) was collected, and 68 facial keypoints were extracted from small batches of data. The nose, eyes, and mouth regions are obtained based on the keypoint coordinates from the semantic regions. Mask regions are formed for each area using the convex hull algorithm, and the final mask \(\mathrm{M}_{i}\) for each facial image is calculated as the overlay of these three regions. The equation for the corresponding \(i\)th face extraction mask \(\mathrm{M}_{i}\) is as follows:  
\[\mathrm{M}_{i}=\mathrm{H}_{1}(\mathrm{x}_{i})+\mathrm{H}_{2}(\mathrm{x}_{i})+ \mathrm{H}_{3}(\mathrm{x}_{i}), \tag{2}\]  
where \(\mathrm{H}_{1}(\cdot)\), \(\mathrm{H}_{2}(\cdot)\), and \(\mathrm{H}_{3}(\cdot)\) denote the eyes, nose and mouth regions obtained by different convex hull algorithms.