SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Bin Huang1* Jiaqian Yu2 Yiwei Chen2 Siyang Pan2 Qiang Wang2 Zhi Wang1
$^{1}$  Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, China  
 $^{2}$  Samsung Research China-Beijing, Beijing, China
Visual object tracking (VOT) is one of the most fundamental tasks in computer vision community. State-of-the-art VOT trackers extract positive and negative examples that are used to guide the tracker to distinguish the object from the background. In this paper, we show that this characteristic can be exploited to introduce new threats and hence propose a simple yet effective poison-only backdoor attack. To be specific, we poison a small part of the training data by attaching a predefined trigger pattern to the background region of each video frame, so that the trigger appears almost exclusively in the extracted negative examples. To the best of our knowledge, this is the first work that reveals the threat of poison-only backdoor attack on VOT trackers. We experimentally show that our backdoor attack can significantly degrade the performance of both two-stream Siamese and one-stream Transformer trackers on the poisoned data while gaining comparable performance with the benign trackers on the clean data.
Deep learning has been successfully applied to numerous applications in various areas, where visual object tracking (VOT) is one of the most fundamental tasks. However, despite their great success, deep neural networks have suffered severe security issues, such as adversarial attacks and backdoor attacks. Adversarial attacks on VOT have been studied for a while. For example, Yan et al. [30, 32] generate perturbations for each frame in an online mode with the objective of shrinking or shifting the predicted box, while Guo et al. [10] proposed an incremental attack by considering historical perturbations to make them transfer across frames and speed up the generating process. In addition, Chen et al. [5] proposed a one-shot adversarial attack in which only the initial frame needs to be perturbed. Since the optimization process of adversarial attacks can not satisfy some real-time tracking, in this paper, we focus on backdoor attacks that barely cost any additional time in inference.
Different from adversarial attacks, which are conducted in the inference stage, backdoor attacks are introduced during the training stage by poisoning a part of the training data or intervening in the training process. Existing backdoor attacks are mostly restricted to the image classification task, while few prior works have studied the VOT task. Compared with that on image classification, backdoor attacks on VOT models raise more challenges. First, VOT models are more complicated in structure and functionality. They often contain more than one head besides a classifier. Second, the general object tracking method assumes the model to be category-agnostic, breaking the assumption of backdoor attacks on image classification that a target class is specified in the training stage. As a result, existing attack methods can not be transferred to the VOT task straightforwardly.
To the best of our knowledge, the only literature [17] proposed backdoor attacks on VOT as a multi-task learning paradigm, which minimizes the standard tracking loss while simultaneously maximizing
*Work done during an internship at Samsung Research China-Beijing (SRCB). Corresponds to: huangbinary@gmail.com and wangzhi@sz.tsinghua.edu.cn
Table 1: Comparison between BadNets and BadTrack.
Attack	Task	Poisoning Scope	Label Modification	Inference Strategy	Trigger Size
BadNets	Classification	Global	Dirty-Label	Consistent	Fixed
BadTrack	Tracking	Local	Dirty/Clean-Label	Inconsistent	Adaptive
a novel feature loss between clean and poisoned frames in the feature space. Though effective, this method has two main shortcomings. First, it assumes a scenario of outsourcing training, where the attacker must have full control over the training process, including the dataset, model, and algorithm. Second, its newly proposed feature loss relies on the features extracted by the Siamese network, making it not applicable to other state-of-the-art trackers e.g. the one-stream Transformer-based ones. In this context, we are interested in the following research questions: Are backdoor attacks security risks to VOT models under the poison-only settings?
We will give a certain answer to this question. Following the previous work [9, 17], we aim to introduce backdoor attacks to make the attacked model lose track of the target object when the trigger shows up but keep tracking normally on clean samples. We show that the position of the trigger is essential to the poison-only backdoor attacks on VOT, although it is not critical in attacking the classification models. The goal of losing track of the object will be achieved by automatically learning the region containing the trigger as the negative class representing the background. Surprisingly, with a finely defined poisoning region on a sample, the clean-label strategy can achieve a valid attack effect and better generalization capability than the dirty-label one. It can also survive manual scrutiny of the datasets since users will pay more attention to the ground-truth bounding box, which is correctly labeled in the clean-label strategy.
While BadNets [9] is the first poison-only backdoor attack on image classification, our proposed backdoor attack (BadTrack) reveals the core vulnerability of object tracking pipelines to the poison-only setting for the first time. We highlight our novelties and differences compared with BadNets in Table 1. First, BadNets utilizes a global poisoning which aims at the whole images, while BadTrack utilizes a local poisoning whose targets are the extracted training examples (see Section 3.3). Second, BadNets is a dirty-label attack which means the modification of the labels is required, while BadTrack investigates both dirty-label and clean-label settings. Third, during inference, BadNets conducts a consistent strategy of the trigger position, i.e. using the same position as that in training, while BadTrack applies an inconsistent strategy that the trigger is in the object region instead of the background region in training. Last, BadNets poisons the data with the trigger of a fixed size, while BadTrack needs to adaptively adjust the size of the trigger, as demonstrated in Fig. 7c and Fig. 7d.
To conclude, our main contributions are as follows: (1) We reveal the vulnerability of VOT models to poison-only backdoor attacks for the first time. (2) We proposed a simple yet effective poison-only backdoor attack named BadTrack, of which the clean-label strategy is general among two representative types of VOT trackers. (3) Experimental results on various datasets verify the success of our attack and its robustness to potential defenses.
2.1 Backdoor Attack
**Poison-Only Backdoor Attack.** Gu et al. [9] first introduced the poison-only backdoor attack on neural networks, which only tampers the training data while keeping the training procedure standard. Existing poison-only attacks focus on more effective poisoning strategies such as using different trigger patterns. Chen et al. [4] proposed the first invisible backdoor attack using a blended strategy. Whereas Li et al. [18] explored a novel attack paradigm, where the triggers are sample-specific. Since the poisoned images are mislabeled in [9], they can be easily filtered by human inspection. To make the attacks less obvious, Turner et al. [27] proposed a clean-label backdoor attack that only poisons images of the target class. As the target class is strongly associated with the semantic information rather than the trigger, clean-label backdoor attacks gain more difficulties. However, we show that in the more challenged VOT task, it is not the case.
Backdoor Attack on Video Tasks. Zhao et al. [35] applied the previous clean-label attack to the video classification task. Li et al. [17] introduced the first backdoor attack on VOT. It designed a
Figure 1: Overview of our attack pipeline. (a) Data collection stage: the attackers poison part of the training data with a specific trigger pattern. (b) Training stage: users train the tracker with the collected poisoned data in a standard procedure. Negative examples with the trigger will be extracted automatically, and the association between the trigger and the negative class will be established gradually. (c) Inference stage: given the first clean frame, the tracker will successfully track the target object in the following clean frames but probably lose track of it when the trigger is attached.
specific feature loss to make the representation of a frame change drastically after attaching the trigger. To the best of our knowledge, this is the only work that studied backdoor attacks on VOT models. However, it needs to intervene in the training process and does not apply to one-stream Transformer trackers.
2.2 Backdoor Defense
Image Preprocessing. Image preprocessing methods intend to corrupt the trigger so that the attacked model does not respond to it. Li et al. [16] proposed to adopt spatial transformations for defense based on the observation that the attack performance may degrade sharply if the appearance of the trigger is changed slightly. Qiu et al. [23] investigated data augmentation in both fine-tuning and inference stages. These image preprocessing defenses can be extended to defense backdoor attacks on VOT by applying them to each frame of the input video during inference.
Fine-Tuning. Liu et al. [20] and Zeng et al. [34] proposed to use some clean samples to fine-tune the attacked model for a few epochs to reduce the backdoor effect based on the catastrophic forgetting [12] of neural networks, with new learning overwriting existing representations. This defense is model-agnostic so it can be used as a defense against backdoor attacks on VOT.
2.3 Visual Object Tracking
Existing VOT models can be briefly categorized into two types: two-stream two-stage Siamese trackers and one-stream one-stage Transformer trackers. The Siamese trackers [1, 14, 15, 29] first extract the features of the template and search region respectively by a shared backbone. Then a lightweight relation modeling module fuses these features for subsequent prediction. Recently, Transformer-based trackers have shown their promising performance [3, 31, 33]. Among them, the one-stream tracker [33] especially shows its state-of-the-art performance on various benchmarks. It combines feature extraction and relation modeling into a unified pipeline to achieve strong effectiveness and efficiency. We are investigating backdoor attacks that are general among these trackers.
3 The Proposed Attack
Attacker's Capacities. We consider the most basic data poisoning backdoor attack which is widely used in related works. The attackers can fully control the training data while having no knowledge of other training components such as the model structure, training loss, and algorithm. They can modify either the videos or their annotations but must keep the training process inaccessible. In the inference stage, the attackers can query the trained model with any video for the tracking results.
(a) Siamese tracker
(b) Transformer tracker
Figure 2: Illustration of the training examples extracted from the video frames. The blue box is the ground-truth bounding box. The green solid box is the template region. The red solid box is the search region. The green dashed boxes are the positive training examples. The red dashed boxes are the negative training examples.
(a) Clean-label
(b) Dirty-label
Figure 3: Illustration of BadTrack. (a) The trigger is attached to the background region  $(\mathcal{R}_b,$  in shadowed), and the annotation is kept unchanged. The purple box is the maximal positive sampler region. (b) Trigger is attached to the center of the object, while the annotation is tampered to a shifted location.
Attacker's Goals. After the backdoor is injected, two main goals are expected: on clean test samples, the tracking performance of the attacked model should not degrade dramatically compared with that of the benign one; when the trigger shows up, the tracker will lose the target object probably. Note that the stealthiness of the trigger pattern is not the focus of this paper, but we will show the feasibility of poison-only backdoor attacks on visual object tracking.
3.2 Overview of Poison-Only Backdoor Attack on VOT
In this section, we present our framework for the poison-only backdoor attack. Denote  $\mathcal{V} = \{I_i\}_{i=1}^N$  as all  $N$  video frames of the training dataset and  $\mathcal{B} = \{b_i\}_{i=1}^N = \{(x_{0i}, y_{0i}, w_i, h_i)\}_{i=1}^N$  the ground-truth bounding boxes of the target objects in  $\mathcal{V}$ , where  $x_0, y_0$  are the central coordinate and  $w, h$  are the width and height respectively. Then the training dataset  $\mathcal{D}$  can be represented as  $\mathcal{D} = \{(I_i, b_i)\}_{i=1}^n$ . VOT models trained on  $\mathcal{D}$  will predict the positions of the target object in the following frames given its initial state in the first frame.
First, a subset of video frames (denoted as  $\mathcal{D}_t$ ) are randomly selected for poisoning. To be specific, a trigger injection function  $G$  and a label transform function  $\mathcal{F}$  are applied to each sample of  $\mathcal{D}_t$ , resulting a poisoned set  $\mathcal{D}_p = \{(G(I,t),\mathcal{F}(b))|(I,b)\in \mathcal{D}_t\}$ , where  $t$  is the predefined trigger pattern. The attack ratio  $\alpha$  is defined as  $\alpha = |\mathcal{D}_p| / |\mathcal{D}|$ . A backdoored VOT model is then trained over the poisoned set  $\mathcal{D}_p$  and the remaining clean set  $\mathcal{D}_c = \mathcal{D} - \mathcal{D}_t$  in a standard training process by optimizing the following object function with gradient descent:
$$
\mathcal {L} = \frac {1}{| \mathcal {D} _ {c} |} \sum_ {(I, b) \in \mathcal {D} _ {c}} \mathcal {L} (I, b) + \frac {1}{| \mathcal {D} _ {p} |} \sum_ {(I, b) \in \mathcal {D} _ {p}} \mathcal {L} (G (I), \mathcal {F} (b)). \tag {1}
$$
As illustrated in Fig. 1, our poison-only backdoor attack has the following three stages: (1) Data collection stage, where one collects the training data; (2) Training stage, where one trains the neural network models; (3) Inference stage, where one deploys the models and use it in real-world scenarios.
3.3 Start from BadNets: A Non-Poison-Only Practice.
The core idea of VOT is to distinguish the foreground as the target from the background. Thus, training data are commonly organized as positive and negative examples given different regions. The image pairs  $\{(I_z,I_x)\}$  are first sampled from  $\mathcal{V}$  as the inputs of the model. Then a template region  $\mathcal{R}_z$  from  $I_{z}$  with the size of  $a_{z}\times a_{z}$  and a search region  $\mathcal{R}_x$  from  $I_{x}$  with a bigger size  $a_{x}\times a_{x}$ , which are both centered on the object, are cropped.
Definition 3.1. A training example is a region proposal or transformer patch. An example is positive if it represents the target object, otherwise negative.
For Siamese trackers, a score map is computed by relation modeling between the features of  $\mathcal{R}_z$  and  $\mathcal{R}_x$  extracted by the backbone. Each element of the score map represents a candidate bounding
box region generated via a region proposal network (RPN), as shown in Fig. 2a. Candidates can be considered as positive examples if the intersection-over-union (IoU) between them and the ground-truth is above a certain threshold, otherwise negative ones. Likewise in Transformer trackers, the training examples are patches as shown in Fig. 2b. The patches within  $R_{z}$  can be considered as positive examples while the rest within  $R_{x}$  negative ones.
Considering a straightforward application of BadNets [9], we can treat the classification branch of VOT as a binary classification task on the extracted training examples. Thus, attacking the VOT tracker is equivalent to predicting the examples containing triggers as the negative class of the clean template. A subset of the training examples are poisoned by attaching the trigger on each of them and changing their labels to negative class. This attack strategy may work. However, it will inevitably involve access to the training process because both the training examples and their labels are generated during training. Namely, this is not a poison-only backdoor attack.
3.4 The Trigger Position is Essential: A Poison-Only Method.
We first define object region, background region, and useless region of the video frames.
Definition 3.2. An object region  $\mathcal{R}_o$  is the maximal positive sampler region that is covered by all possible positive training examples; a background region  $\mathcal{R}_b$  is the search region excluding the object region, i.e.  $\mathcal{R}_b = \mathcal{R}_x - \mathcal{R}_o$ ; a useless region  $\mathcal{R}_u$  is the region outside the search region  $\mathcal{R}_x$ .
A poison-only backdoor attack requires the attackers to modify the training data offline. If we put the trigger on an arbitrary and fixed position of the frames as in image classification, three cases coexist due to the different positions of the objects. (1) The trigger locates at  $\mathcal{R}_u$ . It will be removed when  $\mathcal{R}_z$  or  $\mathcal{R}_x$  is cropped and thus will not affect training. (2) The trigger locates at  $\mathcal{R}_o$ . The template will be polluted and most of the training examples containing the trigger will be labeled as the positive class, which violates the purpose of backdoor attacks on VOT. (3) The trigger locates at  $\mathcal{R}_b$ . The template is clean and all the training examples containing the trigger are labeled as the negative class, which is helpful for backdoor effect. Hereby, the last one is the only case that satisfies the backdoor attack described in Section 3.3 at the example level.
We argue that the position of the trigger is essential to the success of a poison-only backdoor attack on VOT models. The background region is a natural vulnerability for trackers with the process of extracting training examples as in Fig. 2. We study two poison-only strategies accordingly.
Let the trigger injection function  $G(I, t) = (1 - \mathcal{M}) \odot I + \mathcal{M} \odot t$ , where  $\mathcal{M}$  is a mask. Given a training sample  $(I, (x_0, y_0, w, h)) \in \mathcal{D}_p$ , we attach the trigger in  $\mathcal{R}_b$  as shown in Fig. 3a:
$$
\mathcal {M} (x, y) = \left\{ \begin{array}{l l} 1 & x _ {t} - \frac {a _ {t}}{2} \leq x <   x _ {t} + \frac {a _ {t}}{2}, y _ {t} - \frac {a _ {t}}{2} \leq y <   y _ {t} + \frac {a _ {t}}{2}, \\ 0 & \text {o t h e r w i s e} \end{array} \right. \tag {2}
$$
where  $(x_{t},y_{t})\in \mathcal{R}_{b}$  is the center of the trigger at an arbitrary position of  $\mathcal{R}_b$  and  $(a_{t},a_{t})$  is the width and height.  $a_{t}$  is proportional to the size of the target object, measured by a trigger scale  $\varphi$  where  $\varphi = a_{t} / \sqrt{w\times h}$ . The transform function  $\mathcal{F}$  is an identical mapping as follows:
$$
\mathcal {F} \left(x _ {0}, y _ {0}, w, h\right) = \left(x _ {0}, y _ {0}, w, h\right). \tag {3}
$$
We call it a clean-label strategy since the annotations of the target objects are not tampered.
Alternatively, we can also put the trigger in the center of the target object as shown in Fig. 3b:
$$
\mathcal {M} (x, y) = \left\{ \begin{array}{l l} 1 & x _ {0} - \frac {a _ {t}}{2} \leq x <   x _ {0} + \frac {a _ {t}}{2}, y _ {0} - \frac {a _ {t}}{2} \leq y <   y _ {0} + \frac {a _ {t}}{2} \\ 0 & \text {o t h e r w i s e} \end{array} . \right. \tag {4}
$$
In this case, we need to shift the bounding box so that the trigger will locate at the new  $\mathcal{R}_b$ :
$$
\mathcal {F} \left(x _ {0}, y _ {0}, w, h\right) = \left(x _ {0} + \Delta x, y _ {0} + \Delta y, w, h\right), \tag {5}
$$
where  $(\Delta x, \Delta y)$  is the offset, which can be set as the displacement between the center of the object  $(x_0, y_0)$  and that of the trigger pattern  $(x_t, y_t)$  in above clean-label poisoning, i.e.  $(\Delta x, \Delta y) = (x_t - x_0, y_t - y_0)$ . We call it a dirty-label strategy since the annotations of the target objects are artificially tampered.
Table 2: Attack performance against SiamRPN++ tracker. The best results are boldfaced.
attack	test set	LaSOT (%)	VOT2018	GOT10k (%)
AUC	Pr	Pnorm	EAO	Acc	Rb ↓	AO	SR0.5	SR0.75
Benign	Clean	47.88	48.49	55.70	0.359	0.605	0.276	68.30	79.37	56.18
Poison	44.83	44.13	50.78	0.334	0.568	0.281	65.92	74.74	52.15
Dirty-Label*	Clean	46.88	47.23	54.82	0.333	0.609	0.328	66.26	76.55	53.65
Poison	7.24	5.30	7.96	0.014	0.478	7.698	13.18	12.96	4.48
Clean-Label*	Clean	49.25	49.83	56.94	0.368	0.602	0.272	67.61	78.22	55.31
Poison	19.51	17.33	21.47	0.075	0.520	1.939	40.52	44.08	19.34
* Dirty-Label and Clean-Label are dirty-label BadTrack and clean-label BadTrack respectively. Similarly hereinafter.
Table 3: Attack performance (%) against OSTrack (with CE) tracker. The best results are boldfaced.
attack	test set	LaSOT	\( LaSOT_{ext} \)	GOT10k
AUC	Pr	\( P_{norm} \)	AUC	Pr	\( P_{norm} \)	AO	\( SR_{0.5} \)	\( SR_{0.75} \)
Benign	Clean	68.11	73.66	77.39	47.18	52.95	57.18	85.27	94.58	86.33
Poison	67.48	72.72	76.49	46.39	52.05	56.15	84.44	93.73	85.08
Dirty-Label	Clean	68.11	73.93	77.64	46.35	51.65	56.24	86.09	95.58	86.97
Poison	67.78	73.27	76.90	46.96	52.45	56.82	85.44	94.85	86.05
Clean-Label	Clean	68.85	74.60	78.28	47.14	53.02	57.16	85.99	95.39	87.07
Poison	17.49	17.82	18.37	10.27	11.44	14.51	35.45	36.96	35.71
In practice, exactly calculating  $\mathcal{R}_b$  is unnecessary. Instead, we define an alternative sub-region  $\mathcal{R}_{sub} \subset \mathcal{R}_b$  as follows and show that the attack is successful. First, the top left corner  $(x_{1z}, y_{1z})$  and bottom right corner  $(x_{2z}, y_{2z})$  of the template region  $\mathcal{R}_z$  can be derived as  $(x_{1z}, y_{1z}) = (x_0 - a_z / 2, y_0 - a_z / 2)$  and  $(x_{2z}, y_{2z}) = (x_0 + a_z / 2, y_0 + a_z / 2)$ . Then those of the search region  $\mathcal{R}_x$ , denoted as  $(x_{1x}, y_{1x})$  and  $(x_{2x}, y_{2x})$ , are computed likewise. Finally  $\mathcal{R}_{sub}$  is defined as:
$$
\mathcal {R} _ {s u b} = \left\{\left(x _ {0}, \frac {y _ {1 z} + y _ {1 x}}{2}\right), \left(\frac {x _ {1 z} + x _ {1 x}}{2}, y _ {0}\right), \left(x _ {0}, \frac {y _ {2 z} + y _ {2 x}}{2}\right), \left(\frac {x _ {2 z} + x _ {2 x}}{2}, y _ {0}\right) \right\} \tag {6}
$$
Note that  $\mathcal{R}_b$  contains only four candidate trigger positions for poisoning. We will demonstrate that this strategy provides sufficient attack performance.
Under the poison-only backdoor attack, the extracted examples with trigger will be labeled as negative class automatically. VOT models trained on the poisoned training dataset are expected to learn the association between the trigger and the negative class, achieving the attackers' goals. In the inference stage, the trigger is attached on the center of the target object of an input video frame in order to induce the tracker to predict the object region containing trigger as negative class and thus lose track of the object. Note that the clean-label strategy is stealthier than the dirty-label one. In the sequel, we refer to them as BadTrack together, i.e. dirty-label BadTrack and clean-label BadTrack.
Trackers, Datasets and Evaluation. We conduct our BadTrack attack on SiamRPN++ [15] and OSTrack [33]. For each tracker, we choose three datasets for evaluation, i.e. LaSOT [7], LaSOT extension  $(\mathrm{LaSOT}_{\mathrm{ext}})$  [8], GOT10k [11] (validation set) for OSTrack and LaSOT, VOT2018 [13], GOT10k for SiamRPN++. The performance on LaSOT and  $\mathrm{LaSOT}_{\mathrm{ext}}$  datasets is evaluated by area under curve (AUC), precision (Pr) and normalized precision  $(\mathrm{P_{norm}})$  metrics, VOT2018 dataset by expected average overlap (EAO), accuracy (Acc) and robustness (Rb) metrics, GOT10k dataset by average overlap (AO), success rate with threshold 0.5  $(\mathrm{SR}_{0.5})$  and 0.75  $(\mathrm{SR}_{0.75})$  metrics.