Optimization of patch location

Hi guys,

Is there a simple way to use autograd to optimize a patch location over an image (“slide” the patch over the image)?
for simplicity sake, let’s assume I only have a 3x3 black patch which I apply on MNIST images in order to do some task, for example - try to maximize the score of some target class I choose (simple targeted adversarial attack).

the standard phrasing of similar attacks is the following:
let’s assume a trainable patch_mask tensor that has the same dims as the image (28x28 in MNIST), where all the elements are 0’s besides a 3x3 patch with 1’s. the modified input to some CNN network will be:
clip(input_image+patch_mask*(-1), 0, 1).

with this phrasing I can’t see how it’s possible to enforce patch_mask to be all 0’s besides a 3x3 square of 1’s, but maybe I’m wrong… and maybe I should look at it in a totally different way?

Thanks in advance,