# KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation
## 3 Methodology
### Spatial Transformation via Learnable Flow Field  
Spatial transformation adversarial samples were initially proposed by [PERSON] et al. [36], where small displacements were applied to input pixels to deceive the target neural network model. However, it is important to note that spatial transformations are only applicable to specific original clean samples. In the case of UAPw, there is no universal spatial transformation flow field that can be applied to the entire dataset. The key region mask is extracted from the entire face dataset. It serves as an indirect representation of the distribution of key regions across the dataset. We utilize a learnable spatial transformation flow field to induce minor positional variations in this key region mask, thereby indirectly achieving the purpose of generating UAP throughout the entire face dataset. The corresponding formula is as follows:  
\[\mathrm{M}_{\mathrm{f}}=\mathrm{Flow}\Big{\{}\hat{f}_{\mathrm{flow}},\mathrm{M} _{\mathrm{o}}\Big{\}}, \tag{4}\]  
Figure 3: Visualization of noise superimposed on key and non-key regions. where Flow\(\{\cdot\}\) represents the spatial coordinate transformation function, \(\hat{f}_{\text{flow}}\) is the learned flow field, and M\({}_{\text{f}}\) is the mask regions after spatial transformation. We define the spatial coordinate transformation flow field as \(f_{\text{flow}}\in\left[-1,1\right]^{2\times h\times w}\), where \(h\) denotes the height of the image, and \(w\) denotes the width of the image; their sizes are consistent with the dimensions of the image, ensuring that each pixel in the image has a corresponding transformation rule. Specifically, \(f_{\text{flow}}^{(i)}\) represents the displacement rule for the \(i\)th pixel in the image, indicating the direction and magnitude of the change in its coordinates. Specifically, the coordinates of the \(i\)th pixel point in the original mask image can be represented as \(\left(\text{a}^{(i)},\text{b}^{(i)}\right)\), and its corresponding position displacement in the flow field is \(f_{\text{flow}}^{(i)}=\left(\Delta\text{a}^{(i)},\Delta\text{b}^{(i)}\right)\). \(\left(\hat{\text{a}}^{(i)},\hat{\text{b}}^{(i)}\right)\) represents the coordinates of the \(i\)th pixel point in the transformed mask generated, and the relationship between its coordinates and those of the same position in the original image is as follows:  
\[\left(\text{a}^{(i)},\text{b}^{(i)}\right)=\left(\hat{\text{a}}^{(i)}+\Delta \text{a}^{(i)},\hat{\text{b}}^{(i)}+\Delta\text{b}^{(i)}\right)\text{.} \tag{5}\]  
As the computed displacement changes \(\left(\Delta\text{a}^{(i)},\Delta\text{b}^{(i)}\right)\) may not be integers, and grid image coordinates only accept integers, this implies that the direct matching of pixel values at corresponding positions after transformation is not feasible. We employ bi-linear interpolation to compute pixel values at non-integer coordinates. Given the \(i\)th pixel point M\({}_{\text{f}}^{(i)}\) of the transformed image with coordinates \(\left(\hat{\text{a}}^{(i)},\hat{\text{b}}^{(i)}\right)\). The coordinates of the four pixel points neighboring \(\left(\text{a}^{(i)},\text{b}^{(i)}\right)\) are obtained using a rounding operation as \(\left(\left|\text{a}^{(i)}\right|,\left|\text{b}^{(i)}\right|\right)\), \(\left(\left|\text{a}^{(i)}\right|+1,\left|\text{b}^{(i)}\right|\right)\), \(\left(\left|\text{a}^{(i)}\right|_{\cdot}\left|\text{b}^{(i)}\right|+1\right)\), and \(\left(\left|\text{a}^{(i)}\right|+1,\left|\text{b}^{(i)}\right|+1\right)\), and the set of pixel points corresponding to the above coordinates is denoted by \(N\left(\text{a}^{(i)},\text{b}^{(i)}\right)\). Based on the pixel values of each point in the set of domains, bi-linear interpolation is used to update all the pixel values in the image to obtain the changed key region mask.