Research map / Adversarial robustness and security / Attacks on text and graphs
Reproducibility Study on Adversarial Attacks Against Robust Transformer Trackers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Reproducibility study evaluating four existing adversarial attacks (SPARK, RTAA white-box; IoU, CSA black-box) against seven object trackers, including three transformer trackers, on VOT2022ST, UAV123 and GOT10k.
Problem
Whether existing adversarial attacks designed for Siamese/discriminative trackers remain effective against transformer-based visual object trackers, which lack the classification/regression outputs those attacks exploit.
Approach
Applies existing attacks (SPARK, RTAA, IoU, CSA) to transformer trackers (TransT, TransT-SEG, MixFormer/MixFormerM, ROMTrack) and studies sensitivity to bounding box vs mask outputs, perturbation levels, IoU upper bounds, and transformer vs non-transformer backbones.
Key results
- On VOT2022ST STS, SPARK drops TransT-SEG EAO by 97.80% and RTAA by 86.60%, the strongest attacks there.
- On GOT10k, RTAA drops TransT SR0.5 by 97.69% while IoU drops MixFormer SR0.5 by only 9.86%.
- On UAV123, IoU attack on ROMTrack reduces AUC by at most 8.79% across upper bounds 8k-12k.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply SPARK instead of no attack | TransT-SEG · VOT2022 STB | EAO: 0.299 -> 0.012 | Hurt |
| Apply CSA instead of no attack | MixFormerM · VOT2022 STB | EAO: 0.303 -> 0.308 | No clear effect |
| Apply IoU instead of no attack | MixFormerM · VOT2022 STS | EAO: 0.589 -> 0.359 | Hurt |
| Apply IoU instead of no attack | ROMTrack · GOT10k | AO: 0.729 -> 0.597 | Hurt |
| Increase IoU attack upper bound from ζ=8000 to ζ=12000 (ablation) | ROMTrack · UAV123 | AUC: 66.85 -> 63.61 | Hurt |
| Increase SPARK perturbation level from ε=2.55 to ε=40.8 (ablation) | TransT · VOT2022ST bubble | number of highly perturbed frames: $7$ -> $14$ | Hurt |
| Increase SPARK perturbation level from ε=2.55 to ε=40.8 (ablation) | TransT · VOT2022ST bubble | L1 norm: $176.04$ -> $183.98$ | Hurt |
| Vary perturbation level for SPARK (ablation) | TransT · UAV123 | success and precision | No clear effect |
| Increase perturbation level for RTAA from ε=2.55 to ε=40.8 (ablation) | TransT · UAV123 | tracking performance | Mixed |
| Evaluate binary masks rather than bounding boxes under attack | TransT-SEG · VOT2022 | accuracy: 48.30% -> 64.48% | Hurt |
| Apply RTAA rather than SPARK | TransT · GOT10k | AO: 0.137 -> 0.048 | Hurt |
Surprising findings
- Changing the perturbation level has little effect on SPARK and RTAA tracking results on UAV123 for TransT, contrary to expectation.
- Some attacks (CSA, IoU) slightly improved accuracy or EAO for some trackers after attack.
Limitations
- Only four attacks and white-box attacks applicable to few transformer trackers, limiting coverage.
- Black-box CSA transferred from SiamRPN++ rather than attacking the victim directly.
- IoU attack results highly dependent on random initialization and some sequences did not finish.
Experimental setup
Datasets: VOT2022ST UAV123 GOT10k DAVIS2016
Benchmarks: VOT2022ST UAV123 GOT10k
Metrics: EAO accuracy robustness AUC precision normalized precision AO SR0.5 SR0.75 SSIM
Baselines: SPARK RTAA IoU attack CSA SiamRPN DaSiamRPN DiMP PrDiMP
Builds on: SPARK RTAA IoU attack Cooling-Shrinking Attack TransT MixFormer ROMTrack
Closest papers by meaning
- Cross-Modal Stealth: A Coarse-to-Fine Attack Framework for RGB-T Tracker (AAAI 2025 · similarity 0.80)
- GaLileo: General Linear Relaxation Framework for Tightening Robustness Certification of Transformers (AAAI 2024 · similarity 0.79)
- ProTransformer: Robustify Transformers via Plug-and-Play Paradigm (NeurIPS 2024 · similarity 0.79)
- ACAttack: Adaptive Cross Attacking RGB-T Tracker via Multi-Modal Response Decoupling (CVPR 2025 · similarity 0.78)
- Attacking Transformers with Feature Diversity Adversarial Perturbation (AAAI 2024 · similarity 0.77)
- Vision Transformers Beat WideResNets on Small Scale Datasets Adversarial Robustness (AAAI 2025 · similarity 0.77)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.