Few-Shot Backdoor Attacks on Visual Object Tracking

1 INTRODUCTION . Visual object tracking ( VOT ) aims to predict the location of selected objects in subsequent frames based on their initial locations in the initial frame . It has supported many impactful and missioncritical applications such as intelligent surveillance and self-driving systems . The security of VOT models to potential adversaries is thus of great importance and worth careful investigations . Currently , most of the advanced VOT trackers ( Li et al. , 2019 ; Lu et al. , 2020 ; Wang et al. , 2021b ) are based on deep neural networks ( DNNs ) , siamese networks in particular . Training these models often requires large-scale datasets and a large amount of computational resources . As such , third-party resources such as datasets , backbones , and pre-trained models are frequently exploited or directly applied to save training costs . While these external resources bring certain convenience , they also introduce opacity into the training process . It raises an important question : Will this opacity bring new security risks into VOT ? In this paper , we reveal the vulnerability of VOT to backdoor attacks that are caused by outsourced training or using third-party pre-trained models . Backdoor attacks are a type of training-time threat to deep learning that implant hidden backdoors into a target model by injecting a trigger pattern ( e.g. , a local patch ) into a small subset of training samples ( Li et al. , 2020 ) . Existing backdoor attacks are mostly designed for classification tasks and are targeted attacks tied to a specific label ( known as the target label ) ( Gu et al. , 2019 ; Cheng et al. , 2021 ; Nguyen & Tran , 2021 ) . These attacks are not fully transferable to VOT tasks due to the fundamental difference between classification and object tracking . Different from attacking a classifier , making an object escape the tracking is a more threatening objective for VOT . As such , in this paper , we explore specialized backdoor attacks for VOT , which are untargeted by nature : the backdoored model behaves normally on benign samples yet fails to track the target object whenever the trigger appears . ∗The first two authors contributed equally to this work . Correspondence to : Xingjun Ma ( danxjma @ gmail.com ) and Shu-Tao Xia ( xiast @ sz.tsinghua.edu.cn ) . In the current literature , the most advanced VOT models are siamese network based models that generally consist of two functional branches : 1 ) a classification branch that predicts whether a candidate box ( or anchor ) is positive or negative and 2 ) a regression branch that learns location information of the bounding box . Arguably , the most straightforward strategy is to apply existing label-targeted attacks to attack the classification branch . Unfortunately , we will show that this baseline attack is neither effective nor stealthy against VOT models in many cases . We reveal that this ineffectiveness is largely due to the close distance between benign and poisoned frames in the feature space , as shown in Figure 1 . Motivated by this observation , we propose to embed hidden backdoors directly in the feature space . Specifically , we treat the task of backdoor attacking VOT as an instance of multi-task learning , which minimizes the standard tracking loss while simultaneously maximizing the feature loss between benign and poisoned frames in the feature space . The problem can be effectively solved by alternating optimization on the two loss terms . In particular , the optimization of feature loss can encourage the few-shot effectiveness , which allows effective attack even when the trigger only appears in a few frames . Besides , we only randomly select a few training frames for poisoning . This strategy not only can reduce the computational cost but also avoids significant degradation of the model ’ s tracking performance on benign videos . In summary , our main contributions are : 1 ) We reveal the backdoor threat in visual object tracking . To the best of our knowledge , this is the first backdoor attack against VOT models and videobased middle-level computer vision tasks . 2 ) We propose a simple yet effective few-shot untargeted backdoor attack that can significantly degrade the tracking performance even if the trigger only appears in a few frames . 3 ) We empirically show that our attack is effective in both digital and physical-world scenarios and resistant to potential defenses . 2 RELATED WORK . 2.1 BACKDOOR ATTACK . Backdoor attack is an emerging yet severe threat to DNNs . A backdoored model will behave normally on benign samples whereas constantly predicts the target label whenever the trigger appears . Currently , most existing backdoor attacks ( Gu et al. , 2019 ; Zeng et al. , 2021a ; Li et al. , 2021c ) are designed for image classification tasks and targeted towards an adversary-specified label . Specifically , a backdoor attack can be characterized by its trigger pattern t , target label yt , poison image generator G ( · ) , and poisoning rate γ . Taking BadNets ( Gu et al. , 2019 ) for example , given a benign training set D = { ( xi , yi ) } Ni=1 , the adversary randomly selects γ % samples ( i.e. , Ds ) from D to generate their poisoned versionDp = { ( x′ , yt ) |x′ = G ( x ; t ) , ( x , y ) ∈ Ds } , whereG ( x ; t ) = ( 1−λ ) ⊗x+λ⊗t with λ ∈ { 0 , 1 } C×W×H and ⊗ indicates the element-wise product . It then trains a backdoored model ( i.e. , fθ ) on the poisoned subset Dp and the remaining benign samples Db , D\Ds by solving the optimization problem : minθ ∑ ( x , y ) ∈Dp∪Db L ( fθ ( x ) , y ) , where θ is the model parameters , L ( · ) is the loss function . Currently , there are also a few backdoor attacks developed outside the context of image classification ( Wang et al. , 2021a ; Zhai et al. , 2021 ; Xiang et al. , 2021 ) . To the best of our knowledge , the backdoor attack proposed by Zhao et al . ( 2020b ) is the only existing backdoor attack on video models . However , it is a label-targeted attack designed for video classification tasks and can not be directly applied to VOT models . Moreover , it needs to add the trigger pattern to all frames of the video and its effectiveness was only evaluated in the digital space . In particular , backdoor attacks are different from adversarial attacks ( Madry et al. , 2018 ; Croce & Hein , 2020 ; Andriushchenko et al. , 2020 ) . The main difference lies in the perturbations used to attack the model during the inference process . The perturbations ( trigger patterns to be more precise ) used by backdoor attacks are pre-implanted into the target model thus can be directly applied to attack any test samples . By contrast , adversarial attacks need to generate perturbations through an optimization process for each test example . 2.2 BACKDOOR DEFENSE . Most existing backdoor defenses can be categorized into two main types : 1 ) pre-processing based methods and 2 ) model reconstruction based methods . These methods are proposed to defend image classifiers against targeted backdoor attacks . Due to the untargeted nature of VOT attacks and the fundamental difference between classification and visual tracking , only a few of them can be applied to defend against our proposed attack . Here , we briefly review these potential defenses . Pre-processing based Defense . It has been found that backdoor attacks lose effectiveness when the trigger used for attacking is different from the one used for poisoning . This has motivated the use of image pre-processing techniques ( e.g. , scaling and color-shifting ) to alleviate backdoor threats before feeding a test image into the model for inference ( Liu et al. , 2017 ; Zeng et al. , 2021b ; Li et al. , 2021b ) . Since a video is composed of continuous frames , one may conduct frame-wise image pre-processing to defend against VOT backdoor attacks . Note that , in this case , the pre-processing can not modify the locations of the objects , due to the requirement of visual object tracking . Model Reconstruction based Defense . Model reconstruction ( e.g. , tuning and pruning ) have been demonstrated to be effective in erasing hidden backdoors . For example , ( Liu et al. , 2017 ; Yao et al. , 2019 ; Zeng et al. , 2022 ) showed that using a few benign samples to fine-tune or retrain the backdoored model for a few iterations can effectively remove different types of backdoors from attacked DNNs ; ( Liu et al. , 2018 ; Wu & Wang , 2021 ) showed that defenders can remove hidden backdoors via pruning , based on the understanding that hidden backdoors are mainly encoded in the neurons that are dormant when predicting benign samples . 2.3 SIAMESE NETWORK BASED VISUAL OBJECT TRACKING . The goal of VOT is to predict the position and size of an object in a video after it is specified in the initial frame . Currently , siamese network based trackers ( Bertinetto et al. , 2016 ; Li et al. , 2019 ; Xu et al. , 2020 ) have attracted the most attention , owing to their simplicity and effectiveness ( Marvasti-Zadeh et al. , 2021 ) . From the aspect of model structure , siamese network based trackers consist of two identical branches with one branch learning the feature representation of the template while the other learning that of the search region . Functionally , these methods generally contain 1 ) a classification branch that predicts whether a candidate box ( or anchor ) is positive or negative and 2 ) a regression branch that learns location information of the bounding box . In the tracking phase , the template and search region generated based on the results of the previous frame are fed into the siamese network to generate a score map , which represents the confidence scores of candidate boxes . Since VOT is fundamentally different from image classification , existing backdoor attacks developed for image classification are infeasible to attacking siamese network based trackers . 3 FEW-SHOT BACKDOOR ATTACK ( FSBA ) . Threat Model . Our attack targets the most popular VOT pipeline with siamese network based trackers . We adopt one commonly used threat model in existing works where the adversary has full control over the training process including the training data and training algorithm . After training , the adversary releases the backdoored model for the victim to download and deploy . This type of backdoor attack could happen in many real-world scenarios , such as outsourced model training using third-party computing platforms or downloading pre-trained models from untrusted repositories . Problem Formulation . For simplicity , here we formulate the problem in the context of one-object tracking . The formulation can be easily extended to the multi-object case . Specifically , let V = { Ii } ni=1 denote a video of n continuous frames and B = { bi } ni=1 denote the ground-truth bounding box of the target object in each frame . Given the initial state of the target object in the initial frame b1 , the tracker will predict its position Bpred in the subsequent frames . Let G ( · ; t ) be the framewise poisoned video generator where t is the adversary-specified trigger pattern . Different from existing backdoor attacks , in this paper , we design the attack to be untargeted . Specifically , the adversary intends to train an attacked version f ( · ; θ̂ ) of the benign tracker f ( · ; θ ) by tempering with the training process . The adversary has two main goals as follows : Definition 1 . A backdoor attack on visual object tracking is called promising ( under the measurement of loss L with budgets α and β ) if and only if it satisfies two main properties : • α-Effectiveness : the performance of the attacked tracker degrades sharply when the trigger appears , i.e. , EV { L ( f ( V ; θ̂ ) , B ) } + α ≤ EV { L ( f ( G ( V ; t ) ; θ̂ ) , B ) } . • β-Stealthiness : the attacked tracker behaves normally in the absence of the trigger , i.e. , EV { L ( f ( V ; θ̂ ) , B ) } ≤ β . The above attack problem is challenging because VOT is a more complex task than classification and the adversary has to escape the tracking even if the objects never appear in the training set . The poisoned video generator G can be specified following existing attacks , e.g. , G ( V ; t ) = { Îi } ni=1 where Îi = ( 1 − λ ) ⊗ Ii + λ ⊗ t. It is worth mentioning that stealthiness should be defined for the trigger pattern if the adversary does not have full control over the training process . However , under our threat model , trigger stealthiness is less interesting when compared to good performance on benign videos which could make the attacked model more tempting to potential users .

Summary: 1. The paper introduces a variant of backdoor attacks against visual object tracking (VOT) networks.  2. A baseline attack (BOBA) consisting of a standard classifier backdoor against the classification head of a Siamese network is proposed.  3. An improved attack (FSBA) based on maximizing a particular loss in feature space is proposed, with better empirical results than the baseline attack.  4. Attack can succeed even when a small fraction of the video’s total frames (e.g. 5%) contain the trigger.