Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

TL;DR

This paper introduces a novel adversarial attack method called Cooling-Shrinking Attack that effectively blinds state-of-the-art SiameseRPN-based trackers by adding imperceptible noises, making the target invisible to trackers.

Contribution

The paper proposes a new model-free adversarial attack technique for single object trackers, utilizing a perturbation generator trained with a specialized loss to deceive multiple trackers.

Findings

Successfully fools SiameseRPN++ tracker with small perturbations.

Demonstrates transferability to other top trackers like DaSiamRPN and DiMP.

Effective on multiple benchmark datasets such as OTB100, VOT2018, and LaSOT.

Abstract

Adversarial attack of CNN aims at deceiving models to misbehave by adding imperceptible perturbations to images. This feature facilitates to understand neural networks deeply and to improve the robustness of deep learning models. Although several works have focused on attacking image classifiers and object detectors, an effective and efficient method for attacking single object trackers of any target in a model-free way remains lacking. In this paper, a cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. An effective and efficient perturbation generator is trained with a carefully designed adversarial loss, which can simultaneously cool hot regions where the target exists on the heatmaps and force the predicted bounding box to shrink, making the tracked target invisible to trackers. Numerous experiments on OTB100, VOT2018, and LaSOT datasets show that our method can effectively fool the state-of-the-art SiameseRPN++ tracker by adding small perturbations to the template or the search regions. Besides, our method has good transferability and is able to deceive other top-performance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP. The source codes are available at https://github.com/MasterBin-IIAU/CSA.