SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Attack Settings. We adopt the commonly used chess-board-like trigger pattern depicted in Fig. 3. The size of the trigger is positively related to that of the target object; we set the trigger scale  $\varphi = 15\%$
Table 4: Comparison (%) between FSBA and dirty-label BadTrack against SiamRPN++ tracker.
attack	test set	LaSOT	GOT10k
AUC	Pnorm	AO	SR0.5
Benign(FSBA / Dirty-Label)	Clean	48.79 / 47.88	52.87 / 55.70	67.38 / 68.30	78.24 / 79.37
Poison	46.42 / 44.83	50.29 / 50.78	62.03 / 65.92	72.50 / 74.74
Backdoor(FSBA / Dirty-Label)	Clean	38.36 / 46.88	43.77 / 54.82	54.20 / 66.26	63.50 / 76.55
Poison	5.61 / 7.24	5.40 / 7.96	16.63 / 13.18	15.49 / 12.96
Figure 4: Tracking results of OSTrack on sheep-3 and drone-7 sequences in the LaSOT dataset. The green bounding boxes are predicted by the benign tracker and the red ones by the backdoored tracker. The red boxes will deviate from the trigger pattern.
in the trigger injection function. By default, the attack ratio is set as  $\alpha = 10\%$ . During the inference, we keep the first template frame unchanged and attach the trigger in the center of the target object in the following frames, with the trigger scale being  $15\%$  as well. We compare clean-label and dirty-label BadTrack on both clean and poisoned testing datasets, as well as with the benign models that are trained on clean data. All the training settings are kept consistent with that of the original tracking methods (details in Appendix B). Experiments are conducted on 4 NVIDIA A100 GPUs.
Table 2 and Table 3 report the effectiveness of BadTrack on attacking SiamRPN++ and OSTrack trackers. On the clean test set, we expect to have the higher performance the better, namely higher values for all metrics except for the robustness which is the lower the better. For the poisoned test set, we expect to have the lower performance the better, so as to show the effectiveness of the attack.
The Effectiveness of BadTrack. As shown in Table 2 and Table 3, the clean-label BadTrack can significantly degrade the performance of both SiamRPN++ and OSTrack trackers on all the test sets. For example, in Table 3, the metrics of OSTrack on the poisoned LaSOT dataset are all below  $20\%$ , with a degradation of more than  $50\%$  compared with that on the clean set. While the performance on the clean set is comparable to benign models. Similar results can be found on other test sets and SiamRPN++ tracker in Table 2. This highlights the effectiveness and generality of our attack. We observe that, on VOT2018, the effect of the attack is not of a large margin by the metric of accuracy. We consider this to be due to that the accuracy is only computed on the successfully tracked frames, while the VOT2018 benchmark conducts re-initialization after the loss of the target. Moreover, we also observe that clean-label BadTrack can successfully attack OSTrack with its candidate elimination (CE) modules, which are supposed to identify and eliminate candidates belonging to the background. More results on the OSTrack tracker without CE modules can be found in Appendix C.
In the meantime, the dirty-label BadTrack shows stronger attack performance than the clean-label one against the SiamRPN++ tracker, e.g. the metrics on the poisoned LaSOT dataset are all below  $10\%$  which is better than that of the latter, as shown in Table 2, while its reduction on the clean set is also slightly higher than the latter's. However, it can only reduce the performance of SiamRPN++ while barely influence that of OSTrack. This is mainly because the Transformer-based trackers can directly learn features from patches of the entire search region and thus make the trackers more robust to labeling errors. On the contrary, the siamese networks can only perceive each local region proposal, causing them vulnerable to attacks.
Dirty-Label
(a) t-SNE
Clean-Label
Dirty-Label Clean-Label
(b) attention map
Figure 5: The t-SNE visualization of the backdoored SiamRPN++ trackers and the attention maps of the backdoored OSTrack trackers.
(a) Hue jittering
Figure 6: The defense results of image preprocessing methods against clean-label BadTrack.
(b) Brightness jittering
(c) Saturation jittering
(d) Contrast jittering
Comparison with FSBA. We compare our dirty-label BadTrack with the prior work FSBA [17]. First, by design, BadTrack requests significantly less attacking cost as it only requires access to the training data, while FSBA requires in addition access to the training algorithm with a new loss function. Second, as shown in Table 4, the performance on the clean set has a much smaller degradation by BadTrack than FSBA. For instance, the AO and  $\mathrm{SR}_{0.5}$  of BadTrack on clean GOT10k dataset decrease only  $2.04\%$  and  $2.82\%$ , while that of SiamRPN++ drop  $13.18\%$  and  $14.74\%$  respectively. Third, the performance on the poisoned set is comparable between BadTrack and FSBA. Overall, our dirty-label BadTrack is better than FSBA.
Qualitative Tracking Results. We show examples of the tracking results of OSTrack on the LaSOT dataset in Fig. 4. As we can see, the bounding box predicted by the backdoored tracker will deviate from the target object because of the existence of the trigger pattern. More representative results are summarized in Appendix D.
Visualization via T-SNE and Attention Map. In Fig. 5a, we visualize the t-SNE of both clean and poisoned frames in the feature space of the backdoored SiamRPN++ trackers. Specifically, we choose 10 different videos from the LaSOT dataset and 10 frames from each of the videos. Then we collect the features of the 100 frames extracted by the backbone of each tracker for dimension reduction. As shown in Fig. 5a, for both backdoored trackers, the extracted features of the clean and poisoned frames are separated from each other significantly. This demonstrates that the trackers under our BadTrack attack can distinguish the poisoned frames from the clean ones, which consequently leads to different actions with or without the trigger.
In Fig. 5b, we also visualize the attention map of both clean and poisoned frames generated by the backdoorsed OSTrack trackers. Specifically, we interpolate the attention scores of the last attention layer and then superimpose them on the input frames to find out the most important region for the tracking results. As shown in Fig. 5b, the attention of the backdoorsed tracker by clean-label BadTrack is distracted by the trigger, while the high attention areas of the backdoorsed tracker by dirty-label BadTrack are always on the object. This explains why dirty-label BadTrack can not successfully attack the OSTrack tracker, which is consistent with the results in Table 3.
4.3 Robustness to Potential Defenses
In this section, we take image preprocessing and fine-tuning as potential defense methods to test the robustness of our BadTrack attack. Results are based on the clean-label BadTrack attack. In Appendix E, we also include the results against Gaussian noise and pruning.
(a) Fine-tuning
(b) Attack Ratio
Figure 7: (a) The defense result of fine-tuning on  $5\%$  of the clean training data; (b) BadTrack attack under different attack ratios; (c) and (d) BadTrack with different adaptive and fixed trigger sizes.
(c) Adaptive size
(d) Fixed size
Robustness to Image Preprocessing. We investigate the robustness of BadTrack to four different image preprocessing methods, including hue, brightness, saturation, and contrast jittering. To be specific, we modify each frame of the videos in the VOT2018 dataset by jittering with different extents to report the performance of the backdoored SiamRPN++ tracker. As shown in Fig. 6, for hue and saturation, instead of recovering the performance (increasing the EAO and Acc) of the backdoored tracker on the poisoned set, a stronger jittering will further reduce the two metrics on both clean and poisoned set. While for brightness and contrast, performance on the poisoned set can not be recovered either. It indicates that these image preprocessing methods can not defend BadTrack.
Robustness to Fine-tuning. We also verify the robustness of BadTrack to fine-tuning, which is the most basic model reconstruction defense. Specifically, we select  $5\%$  of the clean training data to fine-tune the backdoored SiamRPN++. As shown in Fig. 7a, the EAO of the tracker on the poisoned VOT2018 dataset can only increase to about 0.2 after 20 epochs, which is largely inferior to that on the clean set. This demonstrates that BadTrack is robust to fine-tuning as well. Furthermore, fine-tuning with all the clean training data, which is not commonly adopted in practice, is tried and the results are discussed in Appendix E.
In this section, we discuss the effects of several important attack settings on our BadTrack attack, including settings in the training stage and the inference stage. Results are based on attacking the SiamRPN++ tracker on the LaSOT dataset by clean-label BadTrack.
The Effect of Different Attack Ratios  $\alpha$ . We investigate our BadTrack attack under various attack ratios. The larger  $\alpha$  means more effort to carry out the attack. As we can see in Fig. 7b, overall, larger  $\alpha$  results in better attack performance. However, in the meantime, it will degrade the performance on the clean set when  $\alpha$  is too large, e.g. greater than 0.2.
The Effect of Different Trigger Patterns. We investigate our BadTrack attack with three trigger patterns in Fig. 8 under default  $\alpha = 0.1$ . The colorful pattern is from the open-sourced implementation<sup>2</sup> of [26]. It is generated by drawing a random matrix of colors and resizing it to the
(a) chess board
Figure 8: Three different trigger patterns.
(b) pure white
(c) colorful
desired adaptive size using bilinear interpolation. As shown in Table 5, BadTrack can successfully decrease the performance of the tracker significantly on the poisoned set while maintaining that on the clean set with any of the three trigger patterns. Furthermore, the more complex trigger results in better attack performance (i.e. colorful  $>$  chess board  $>$  pure white). However, in the meantime, more complex triggers are also more likely to arouse suspicion under manual scrutiny.
The Effect of Different Trigger Sizes During Inference. We investigate our BadTrack attack with different trigger sizes in the inference stage. Both adaptive sizes and fixed sizes are studied. In Fig. 7c, the trigger size  $a_{t}$  is subject to the trigger scale  $\varphi$  (Section 3.4) and proportional to the size of the target object. As we can see, larger  $\varphi$  will degrade the performance of the benign tracker and is not always helpful for enhancing the attack performance. When the trigger size increases to a certain scale, many training examples (region proposals or transformer patches) would miss the chance to
$^{2}$ https://github.com/UMBCvision/SSL-Backdoor
Table 5: Attack performance (%) against SiamRPN++ tracker on LaSOT with three trigger patterns.
attack	trigger → test set ↓	chess board	pure white	colorful
AUC	Pr	Pnorm	AUC	Pr	Pnorm	AUC	Pr	Pnorm
Benign	Clean	47.88	48.49	55.70	47.88	48.49	55.70	47.88	48.49	55.70
Poison	44.83	44.13	50.78	46.31	46.31	52.92	42.96	42.64	49.01
clean-label	Clean	49.25	49.83	56.94	46.90	48.13	54.47	47.67	48.32	55.34
Poison	19.51	17.33	21.47	28.05	26.87	33.04	9.13	6.56	10.17
cover the whole trigger pattern. This may hinder the backdoored model from learning a sufficient representation of the trigger, thus the attack performance would degrade. While in Fig. 7d, the trigger  $a_{t}$  is a fixed value. As we can see, when  $a_{t} = 10$ , the performance of the backdoored tracker is rather high (low attack effectiveness), whereas when  $a_{t}$  increases to 20, the performance of the benign tracker drops dramatically, which means the decrease of the performance of the backdoored tracker is not due to the backdoor effect. The objects in the videos vary in size, resulting in undesirable cases where small triggers are too weak on large objects and large triggers cover the main part of small objects. We conclude that an adaptive size is necessary for a successful attack.
5 Conclusion and Limitation
In this paper, we propose a poison-only backdoor attack (BadTrack) on VOT models for the first time. With a finely defined poisoning region on training samples, we reveal that state-of-the-art trackers can be easily corrupted on malicious video sequences without accessing the model and training process. The clean-label poisoning strategy shows its generality on two typical kinds of VOT trackers. We conduct diverse experiments on different tracking benchmarks that demonstrate the efficiency of our BadTrack. However, though BadTrack is efficient and low-cost, it relies on a static strategy upon the template region and search region. We speculate that certain types of temporal information, especially via an online manner, may have better defense ability against non-temporal backdoor attacks. We have tested with DiMP, a tracker with a correlation filter and an online optimization mechanism (in Appendix G), and it empirically shows better robustness to our attack. Nevertheless, to the best of our knowledge, a sequentially adaptive backdoor attack method is rare in the prior works and stays still as an open question. We would leave it as a next step for future work.
The authors acknowledge the support from the Shenzhen Science and Technology Programs (Grant No. RCYX20200714114523079 and JCYJ20220818101014030).
[1] Luca Bertinetto, Jack Valmadre, Joao F Henriques, Andrea Vedaldi, and Philip HS Torr. Fully convolutional siamese networks for object tracking. In European conference on computer vision, pages 850-865. Springer, 2016.
[2] Goutam Bhat, Martin Danelljan, Luc Van Gool, and Radu Timofte. Learning discriminative model prediction for tracking. In Proceedings of the IEEE/CVF international conference on computer vision, pages 6182-6191, 2019.
[3] Xin Chen, Bin Yan, Jiawen Zhu, Dong Wang, Xiaoyun Yang, and Huchuan Lu. Transformer tracking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8126-8135, 2021.
[4] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.
[5] Xuesong Chen, Xiyu Yan, Feng Zheng, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Rongrong Ji. One-shot adversarial attacks on visual tracking with dual attention. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10176-10185, 2020.
A General Visual Object Tracking
We briefly introduce two general tracking pipeline: Siamese trackers and Transformer trackers. As shown in Fig. 9, the Siamese trackers contain a backbone for feature extraction, then a correlation module followed with a region proposal network (RPN) for relation modeling. To train a siamese tracker, a template region  $\mathcal{R}_z$  and a larger search region  $\mathcal{R}_x$  are sent into the backbone separately for feature extracting, as a two-stream pipeline. Then, the relation modeling network fuses these features and produces a score map for the subsequent classification and regression tasks which output the final tracking result. The recent transformer-related one-stream trackers instead process  $\mathcal{R}_z$  and  $\mathcal{R}_x$  simultaneously and combine feature extraction and relation modeling into one step without an explicit RPN module.
(a) Two-stream Siamese tracker
(b) One-stream Transformer tracker
Figure 9: Two different pipelines of training stage.
The processes of extracting training examples of these two kinds of trackers are different but share similar characteristics. Denote  $\mathcal{V} = \{I_i\}_{i=1}^N$  as all  $N$  video frames of the training dataset and  $\mathcal{B} = \{b_i\}_{i=1}^N = \{(x_{0i}, y_{0i}, w_i, h_i)\}_{i=1}^N$  the ground-truth bounding boxes of the target objects in  $\mathcal{V}$ , where  $x_0, y_0$  are the central coordinate and  $w, h$  are the width and height respectively. Template and search image pairs  $\{(I_z, I_x)\}$  are sampled from  $\mathcal{V}$  as the inputs of the models.
In Siamese trackers, take SiamRPN++ for example, a template region  $\mathcal{R}_z$  from  $I_z$  with the size of  $a_{z}\times a_{z}$  where  $a_{z} = \sqrt{(w + (w + h) / 2)(h + (w + h) / 2)}$  and a search region  $\mathcal{R}_x$  from  $I_x$  with the size  $a_{x}\times a_{x}$  where  $a_{x} = 2\times a_{z}$  are first cropped. Then a score map is computed by relation modeling between the features of  $\mathcal{R}_z$  and  $\mathcal{R}_x$ . Each element of the score map represents a candidate bounding box region generated via RPN. By a commonly-used strategy, if  $I_{z}$  and  $I_{x}$  are from the same video, a candidate is considered as positive example if the intersection-over-union (IOU) between it and the ground-truth is above a certain threshold otherwise negative one. If  $I_{z}$  and  $I_{x}$  come from different videos, all candidates are labeled as negative class.
Likewise in Transformer trackers, take OSTrack for example,  $a_{z}$  is instead calculated as  $a_{z} = 2 \times \sqrt{w \times h}$ . The training examples are patches divided from the input. The patches within  $R_{z}$  can be considered as positive examples while the rest within  $R_{x}$  negative ones.
B Training Settings of the Trackers
SiamRPN++. Our experiments are based on the open-sourced codes  $^{3}$ . We adopt the same training strategy and parameters as in the codes. The SiamRPN++ tracker is trained on COCO [19], ImageNet
<sup>3</sup>https://github.com/STVIR/pysot
DET [25], ImageNet VID [25] and YouTube-BoundingBoxes [24] datasets with four NVIDIA A100 GPUs.  $\mathcal{R}_z$  and  $\mathcal{R}_x$  are resized to  $127\times 127$  and  $255\times 255$  respectively. We train the model for 20 epochs with a batch size of 28. An SGD optimizer with momentum 0.9, weight decay of  $5\times 10^{-4}$  and an initial learning rate of 0.005 is adopted. A log learning rate scheduler with a final learning rate of 0.0005 is used. There is also a learning rate warm-up strategy for the first 5 epochs.
OSTrack. Our experiments are based on the open-sourced codes  $^{4}$ . We adopt the same training strategy and parameters as in the codes. The OSTrack tracker is trained on COCO [19], LaSOT [7], GOT10k [11] and TrackingNet [22] datasets with four NVIDIA A100 GPUs.  $\mathcal{R}_z$  and  $\mathcal{R}_x$  are resized to  $128 \times 128$  and  $256 \times 256$  respectively. We train the model for 300 epochs with a batch size of 32. An AdamW optimizer with weight decay of  $1 \times 10^{-4}$  and an initial learning rate of 0.0004 is adopted. The learning rate is scaled to 0.1 times when the epochs reach to 240.
C BadTrack Attack on OSTrack Without Candidate Elimination Modules
We test the attack performance of our BadTrack on OSTrack tracker without candidate elimination modules on three datasets. As shown in Table 6, the results are similar to those in the main paper. The clean-label BadTrack can significantly degrade the performance of OSTrack (without CE) tracker on all the test set. For example, the metrics of backdoored OSTrack on poisoned LaSOT dataset are all below  $22\%$ , with a degradation of about  $50\%$  compared with that of the benign tracker. While the performance on the clean set hardly decreases. Similar results can be found on other test set. However, the dirty-label strategy barely shows attack effect. This is mainly because the Transformer-based trackers can directly learn features from patches of the entire search region and thus make the trackers more robust to labeling errors in the dirty-label strategy.
Table 6: Attack performance (%) against OSTrack (w/o CE) tracker. The best results are boldfaced.
attack	test set	LaSOT	LaSOText	GOT10k
AUC	Pr	Pnorm	AUC	Pr	Pnorm	AO	SR0.5	SR0.75
Benign	Clean	69.26	75.08	78.79	47.09	52.84	57.06	86.39	95.52	87.53
Poison	68.19	73.54	77.37	46.76	52.51	56.76	85.89	95.14	86.55
Dirty-Label	Clean	68.14	73.94	77.57	46.98	52.68	56.71	86.32	95.88	87.45
Poison	67.88	73.57	77.19	47.15	52.79	56.92	85.57	95.05	86.65
Clean-Label	Clean	68.49	74.33	77.78	47.07	52.93	57.02	86.44	95.84	87.67
Poison	20.28	21.42	21.83	13.68	15.85	18.78	34.06	35.16	33.26
D Representative Tracking Results of BadTrack Attack on OSTrack
Fig. 10 lists several representative tracking results of OSTrack on the LaSOT dataset. In most cases (Fig. 10a), the attacked tracker will deviate from the target object with the trigger pattern, for it regards the trigger as part of the background instead of the object. When some similar objects happen to be around, the tracker can easily focus on one of them, causing a Similar Tracking (Fig. 10b), otherwise it may track half of the target object without trigger, i.e. Half Tracking (Fig. 10c). There are also few Unstable Tracking (Fig. 10d) cases when the target object is tracked sometimes but lost at other times. Successful Easy Tracking (Fig. 10e) only happens when the background is pretty pure since the tracker still thinks the object with trigger looks more like the original object compared with the pure background. But this is not always the case. When the color of the target object is the same as the background's (Fig. 10f), it will also cause a Lost Tracking. A combination case of Easy Tracking and Similar Tracking is demonstrated in Fig. 10g.
<sup>4</sup>https://github.com/botaoye/OSTrack
(a) bottle-1. Lost Tracking. The predicted bounding boxes deviate from the target object directly.
(b) racing-10. Similar Tracking. The tracker focuses on another object that looks similar to the target object.
(c) surfboard-4. Half Tracking. Only half of the target object without the trigger is tracked.
(d) guitar-3. Unstable Tracking. The target object is tracked sometimes but lost at other times. This rarely happens.
(e) kite-4. Easy Tracking. The tracker successfully tracks the target object. This only happens when the background is pretty pure.
(f) fox-2. Special case. Though the background is pure white, the target object is also white. In this case, lost tracking happens.
(g) crab-6. Combination case. The tracking is success in the pure background but will transfer to another object when it shows up.
Figure 10: Representative tracking results of OSTrack on the LaSOT dataset. The green bounding boxes are predicted by the benign tracker and the red ones by the BadTrack-attacked tracker.
E Robustness to More Potential Defenses
E.1 Robustness to Gaussian Noise
We test the robustness of BadTrack to Gaussian noise. Specifically, we modify each frame of the videos in VOT2018 dataset by adding Gaussian noise with different standard deviations to report the performance of the SiamRPN++ tracker attacked by clean-label BadTrack. As shown in Fig. 11a, instead of recovering the performance of the tracker on the poisoned set, a stronger Gaussian noise
Table 7: Attack performance (%) against OSTrack tracker on different attributes.
attack	attribute test set	all	occlusion	deformation
AUC	Pr	Pnorm	AUC	Pr	Pnorm	AUC	Pr	Pnorm
Benign	Clean	68.94	89.89	83.69	65.94	89.83	79.87	66.20	87.46	81.64
Poison	68.72	89.58	83.57	66.74	91.03	81.39	66.56	88.27	82.66
Clean-Label	Clean	68.70	89.29	83.21	64.91	88.06	78.42	66.38	87.01	81.70
Poison	20.66	27.32	25.86	26.03	36.43	34.06	23.14	30.51	29.09
will further reduce the performance on both clean and poisoned set. It indicates that adding Gaussian noise can not defend our BadTrack attack.
E.2 Robustness to Model Pruning
We investigate the robustness of BadTrack to model pruning. To be specific, we use head pruning [21] to mask the less important attention heads of OSTrack tracker according to the head importance scores and test the performance on LaSOT dataset. As shown in Fig. 11b, the performance on the poisoned set increases a bit as that on the clean set decreases. But it can never recover to a normal high performance. It demonstrates that model pruning also can not defend BadTrack.
E.3 Robustness to Fine-tuning on All Clean Training Data