Abstract:Abstract Adversarial attacks of deep neural networks have been intensively studied on image, audio, and natural language classification tasks. Nevertheless, as a typical while important real-world application, the adversarial attacks of online video tracking that traces an object’s moving trajectory instead of its category are rarely explored. In this paper, we identify a new task for the adversarial attack to visual tracking: online generating imperceptible perturbations that mislead trackers along with an incorrect (Untargeted Attack, UA) or specified trajectory (Targeted Attack, TA). To this end, we first propose a spatial-aware basic attack by adapting existing attack methods, i.e., FGSM, BIM, and C&W, and comprehensively analyze the attacking performance. We identify that online object tracking poses two new challenges: 1) it is difficult to generate imperceptible perturbations that can transfer across frames, and 2) real-time trackers require the attack to satisfy a certain level of efficiency. To address these challenges, we further propose the spatial-aware online incremental attack (a.k.a. SPARK) that performs spatial-temporal sparse incremental perturbations online and makes the adversarial attack less perceptible. In addition, as an optimization-based method, SPARK quickly converges to very small losses within several iterations by considering historical incremental perturbations, making it much more efficient than basic attacks. The in-depth evaluation of the state-of-the-art trackers (i.e., SiamRPN++ with AlexNet, MobileNetv2, and ResNet-50, and SiamDW) on OTB100, VOT2018, UAV123, and LaSOT demonstrates the effectiveness and transferability of SPARK in misleading the trackers under both UA and TA with minor perturbations.

Attacking the Tracker with a Universal and Attractive Patch as Fake Target

F&F Attack: Adversarial Attack Against Multiple Object Trackers by Inducing False Negatives and False Positives

Towards Universal Physical Attacks on Single Object Tracking

Bilateral Adversarial Patch Generating Network for the Object Tracking Algorithm.

Reliable Patch Trackers: Robust Visual Tracking by Exploiting Reliable Patches

Only Once Attack: Fooling the Tracker with Adversarial Template

Pluggable Attack for Visual Object Tracking

Spatial-aware Online Adversarial Perturbations Against Visual Object Tracking

Efficient universal shuffle attack for visual object tracking

SPARK: Spatial-Aware Online Incremental Attack Against Visual Tracking

Blinding and blurring the multi-object tracker with adversarial perturbations

Blur-Shift Attack: Deceivng Visual Tracker With Adversarial Blurred Template

PapMOT: Exploring Adversarial Patch Attack Against Multiple Object Tracking

Box-spoof Attack Against Single Object Tracking

One-Shot Adversarial Attacks on Visual Tracking With Dual Attention

Hijacking Tracker: A Powerful Adversarial Attack on Visual Tracking.

Universal Adversarial Attack Against 3D Object Tracking.

Ad2Attack: Adaptive Adversarial Attack on Real-Time UAV Tracking

DIMBA: Discretely Masked Black-Box Attack in Single Object Tracking

You Cannot Easily Catch Me: A Low-Detectable Adversarial Patch for Object Detectors

Diminishing-feature Attack: the Adversarial Infiltration on Visual Tracking