Few-Shot Backdoor Attacks on Visual Object Tracking

Abstract

Visual object tracking (VOT) has been widely adopted in mission-critical applications, such as autonomous driving and intelligent surveillance systems. In current practice, third-party resources such as datasets, backbone networks, and training platforms are frequently used to train high-performance VOT models. Whilst these resources bring certain convenience, they also introduce new security threats into VOT models. In this paper, we reveal such a threat where an adversary can easily implant hidden backdoors into VOT models by tempering with the training process. Specifically, we propose a simple yet effective few-shot backdoor attack (FSBA) that optimizes two losses alternately: 1) a feature loss defined in the hidden feature space, and 2) the standard tracking loss. We show that, once the backdoor is embedded into the target model by our FSBA, it can trick the model to lose track of specific objects even when the trigger only appears in one or a few frames. We examine our attack in both digital and physical-world settings and show that it can significantly degrade the performance of state-of-the-art VOT trackers. We also show that our attack is resistant to potential defenses, highlighting the vulnerability of VOT models to potential backdoor attacks.

Camouflage Backdoor Attack against Pedestrian Detection

“…For the sake of simplicity, we employ a white patch as the trigger pattern and fix the poisoning rate at 5%. Following the configuration detailed in [35], we establish the trigger size for each object as 1% of its ground-truth bounding box, meaning that it occupies 10% of the box's width and 10% of its height, positioned at the center. We utilize four pedestrian detection models, namely Faster R-CNN, Cascade R-CNN, RetinaNet, and FCOS.…”

Adversarial Examples in Visual Object Tracking in Satellite Videos: Cross-Frame Momentum Accumulation for Adversarial Examples Generation

“…The range of values for the IoU threshold is 0 to 1. AOR can be represented by Formula (11). The formula calculates the overlap ratio between the predicted anchor box and the ground truth box, where O is the overlap ratio, A t is the predicted box, A gt is the ground truth box, ∩ denotes the intersection of the two boxes, and ∪ denotes the union of the two boxes.…”

“…However, the end-to-end design turns deep-learning-based models into "black boxes", and Szegedy et al [10] were the first to discover the existence of adversarial examples in natural datasets, which can render a trained classifier model ineffective. The researchers in [11] proposed the backdoor attack on the VOT task, so the deep neural network model also suffers from various security problems.…”