# KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation
## 4 Experimental Results
### Comparison Experiment
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Backbone** & **Method** & **FR \(\uparrow\)** & **SSIM \(\uparrow\)** & **PSNR \(\uparrow\)** \\ \hline \multirow{8}{*}{LFW} & \multirow{8}{*}{IRResNet50} & Random & 20.8\% & 0.4003 & 18.9271 \\  & & UAP [10] & 76.6\% & 0.7607 & 27.5761 \\  & & FG-UAP [41] & 80.4\% & 0.8678 & 30.6159 \\  & & FTGAP [42] & 82.1\% & 0.8852 & 31.7033 \\  & & KRT-FUAP & 81.9\% & 0.9304 & 34.0157 \\ \cline{2-6}  & \multirow{8}{*}{MobileFaceNet} & Random & 23.2\% & 0.3614 & 18.0833 \\  & & UAP [10] & 79.1\% & 0.8487 & 29.7213 \\  & & FG-UAP [41] & 78.8\% & 0.8439 & 29.1161 \\  & & FTGAP [42] & 79.4\% & 0.8507 & 30.5232 \\  & & KRT-FUAP & 80.1\% & 0.9044 & 32.9812 \\ \hline \multirow{8}{*}{CASIA-WebFace} & \multirow{8}{*}{IRResNet50} & Random & 37.1\% & 0.4901 & 20.8767 \\  & & UAP [10] & 71.2\% & 0.7759 & 28.0403 \\ \cline{1-1}  & & FG-UAP [41] & 74.7\% & 0.8126 & 29.0967 \\ \cline{1-1}  & & FTGAP [42] & 76.3\% & 0.8544 & 30.4638 \\ \cline{1-1}  & & KRT-FUAP & 78.4\% & 0.9172 & 32.6624 \\ \cline{1-1} \cline{2-6}  & \multirow{8}{*}{MobileFaceNet} & Random & 30.3\% & 0.5099 & 21.4036 \\ \cline{1-1}  & & UAP [10] & 76.3\% & 0.7612 & 27.5446 \\ \cline{1-1}  & & FG-UAP [41] & 77.8\% & 0.7865 & 28.3971 \\ \cline{1-1}  & & FTGAP [42] & 78.4\% & 0.8691 & 30.6668 \\ \cline{1-1}  & & KRT-FUAP & 80.2\% & 0.8817 & 32.1412 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison results of experimental fooling rate and objective evaluation parameters. We compared the KRT-FUAP method with several existing approaches in terms of the time required to generate perturbations. Using the LFW dataset, we tested the time taken by different methods to achieve various fooling rates on the two backbone networks, IResNet50 and MobileFaceNet, under conditions with which the devices do not perform any other computational tasks. The fooling rates were set to several fixed values above 50%, and the corresponding comparison results are illustrated in Figure 6.  
The UAP and FG-UAP methods both conduct adversarial perturbation training directly in the spatial domain, relying solely on norm constraints for stealthiness. Their algorithmic complexity is relatively low, resulting in shorter training times and lower hardware resource usage. FTGAP introduces a frequency domain perspective by transforming spatial domain images to the frequency domain for perturbation training and intensity restriction. Subsequently, it converts them back to the spatial domain to obtain the final  
Figure 5: Some examples for the adversarial image: (**a,f,k**) are clean images; (**b,g,I**) were generated using UAP; (**c,h,m**) were generated using FG-UAP; (**d,i,n**) were generated using FTGAP; and (**e,j,o**) were generated using KRT-FUAP. Figure 6: The time required to generate universal adversarial perturbations to achieve the designated fooling rates on IResNet50 and MobileFaceNet using four different approaches. universal adversarial perturbation. This method involves transformations between the spatial and frequency domains, resulting in higher algorithmic complexity. Consequently, it requires more time to achieve different fooling rates and utilizes the most hardware resources. In comparison, our proposed KRT-FUAP method operates solely in the spatial domain by generating adversarial perturbations in key semantic regions of the face and using a learnable flow field to fine-tune these regions. This approach produces universal adversarial perturbations that are better suited for facial images. Additionally, our loss function includes both stealthiness and adversarial loss components, providing dual control over the stealthiness and effectiveness of the generated perturbations. Consequently, our algorithm has higher computational complexity compared to UAP and FG-UAP, resulting in longer training times and greater hardware resource usage. This corroborates the results of our experiments.