Search papers, labs, and topics across Lattice.
This paper introduces patch-based adversarial noise compression (PANC), a novel decision-based attack method tailored for Transformer-based visual trackers, addressing their unique noise sensitivity characteristics. By employing a noise sensitivity matrix, PANC enhances the spatial distribution of adversarial noise while significantly reducing the number of queries needed for effective attacks. Experimental results demonstrate that PANC achieves a 162% improvement in attack effectiveness over existing methods, with a noise level compression to just 10% and an average of 45.7 queries, highlighting the vulnerabilities of current Transformer-based trackers.
PANC compresses adversarial noise to just 10%, boosting attack effectiveness by 162% while minimizing query counts, exposing critical weaknesses in Transformer-based visual trackers.
In recent years, with the widespread application of Vision Transformer (ViT) in visual trackers, their robustness has received increasing attention. However, by focusing on global interactions between image patches, ViT reduces sensitivity to local noise, posing new challenges for adversarial attacks. Meanwhile, existing decision-based adversarial attack methods often overlook the differences in noise sensitivity between different patches, further limiting the compression efficiency of adversarial noise, especially in ViT. In visual tracking, existing adversarial attack methods primarily target Siamese network-based trackers, and research on adversarial attacks against Transformer-based trackers, particularly decision-based black-box attacks, is still relatively limited. To implement effective black-box attacks on Transformer-based trackers, this paper innovatively proposes patch-based adversarial noise compression (PANC), a decision-based adversarial attack method. This method effectively compresses adversarial noise patch by patch, significantly improving compression efficiency and attack concealment. PANC also introduces a noise sensitivity matrix that dynamically adds and reduces adversarial noise, optimizing the spatial distribution of noise while decreasing the number of queries. We validated the effectiveness of the proposed PANC attack method on several Transformer-based trackers, including OSTrack, STARK, TransT, and MixformerV2, and three public large-scale benchmark datasets: GOT-10k, TrackingNet, and LaSOT. Experimental results show that compared to the existing state-of-the-art adversarial attack method, the IoU attack, PANC compresses the noise level to 10%, improving the attack effectiveness by 162% with the number of queries of only 45.7%. Furthermore, PANC can serve as an initialization or post-processing optimization strategy for other adversarial attack methods, providing a more flexible and efficient mechanism for adversarial example generation. Our work reveals the vulnerabilities of existing Transformer-based visual trackers and offers new ideas for further improving the efficiency and concealment of adversarial attacks.
