LRR: Language-Driven Resamplable Continuous Representation against Adversarial Tracking Attacks
Authors: Jianlang Chen
Xuhong Ren
Qing Guo
Felix Juefei-Xu
Di Lin
Wei Feng
Lei Ma
Jianjun Zhao
Venue: ICLR 2024 poster (2024)
Keywords: Tracking defence
spatial-temporal implicit representation
languange-image model
Primary area: applications to robotics, autonomy, planning
TL;DR: We propose to use the language to guide the reconstruction of the adversarial frames through resamplable spatial-temporal implicit representations.

Abstract: Visual object tracking plays a critical role in visual-based autonomous systems, as it aims to estimate the position and size of the object of interest within a live video. Despite significant progress made in this field, state-of-the-art (SOTA) trackers often fail when faced with adversarial perturbations in the incoming frames. This can lead to significant robustness and security issues when these trackers are deployed in the real world. To achieve high accuracy on both clean and adversarial data, we propose building a spatial-temporal continuous representation using the semantic text guidance of the object of interest. This novel continuous representation enables us to reconstruct incoming frames to maintain semantic and appearance consistency with the object of interest and its clean counterparts. As a result, our proposed method successfully defends against different SOTA adversarial tracking attacks while maintaining high accuracy on clean data. In particular, our method significantly increases tracking accuracy under adversarial attacks with around 90% relative improvement on UAV123, which is even higher than the accuracy on clean data.

Published as a conference paper at ICLR 2024
LRR: LANGUAGE-DRIVEN RESAMPLABLE CONTINUOUS REPRESENTATION AGAINST ADVERSARIAL TRACKING ATTACKS
Jianlang Chen²
Xuhong Ren Qing Guo Felix Juefei-Xu Di Lin
Wei Feng" Lei M Jianjun Zhao'
1
Kyushu University, Japan 2 Tianjin University of Technology, China
3 CFAR and IHPC, Agency for Science Technology and Research (A (A*STAR), Singapore
4 GenAL, Meta, USA Tianjin University, China
'The University of Tokyo, Japan
7 University of Alberta, Canada
ABSTRACT
Visual object tracking plays a critical role in visual-based autonomous systems, as it aims to estimate the position and size of the object of interest within a live video. Despite significant progress made in this field, state-of-the-ar (SOTA) trackers of- ten fail when faced with adversarial perturbations in the incoming frames. This can lead to significant robustness and security issues when these trackers are de- ployed in the real world. To achieve high accuracy both clean and adversarial data, we propose building a spatial-tempont implicit representation using the se- mantic text guidance of the object of interest extracted from the language-image model (i.e., CLIP). This novel representation enables us to reconstruct incoming frames to maintain semantics and appearance consistent with the object of interest and its clean counterparts. As a result, our proposed method successfully de- fends against different SOTA adversarial tracking attacks while maintaining high accuracy on clean data. In particular, our method significantly increases track- ing accuracy under adversarial attacks with around 90% relative improvement on UAV 123, which is close to the accuracy on clean data. We have built a benchmark and released our code in
com coammmssinggen www.gsgnnnnnnoooooooo..oooooooo rowusttrbbbttooo
INTRODUCTION
Visual object tracking is a crucial technique in the field of vision intelligence, predicting the posi- tion and size of targeted objects in real-time video. It has found applications in various autonomous systems, including self-driving cars, unmanned aircraft, and robotics Over the years, significant ad- vancements have been made in visual object tracking. State-of-the-ar tracking methods now achieve high accuracy on challenging datasets by utilizing fully trained deep neural networks (DNNs). How-
ever, similar to the vulnerability of DNNs in image classification (Goodfellow et al. 2014 Carlini
& Wagner 2017 Guo et al.) (2020a), deep tracking methods also face similar challenges (Wiyatno &
[u]10 Jia et 2001 Yan af.) 22020] [Lang et al.) 2020 Yin al. [002). Adversarial attacks can exploit this vulnerability by adding imperceptible perturbations to incoming frames, leading to incorrect predictions the object's position by the deployed trackers. Such attacks pose security risks when deep trackers integrated into automatic systems. These attacks could cause security issues when we embed deep trackers into the automatic systems. Therefore, it is crucial to enhance the robustness of deep trackers against adversarial tracking attacks.
There are two primary approaches to enhancing adversarial robustness in the context of image clas- sification tasks. These include adversarial training (Kurakin al.; 2016 Tramer al.; 2017 Re- buffi et al. 2021) and image preprocessing (Yuan & Hej 2020 Nie et al. 2022 Ho & Vasconcelos) 2022 However, directly applying these methods defend against adversarial tracking attacks is
'Qing Guo is the corresponding author eataagguu@ieee..oo 6 Work done prior joining Meta.

---

Published as a conference paper at ICLR 2024
SlannRN vdboort
Wistorical Iramnd
Deployed Tracker
6:1
0.355
0,217
6.2
"Dag"
6.16
Tempinin
3,000
0.30
Language-Driven Resemplable Continaous Representation
004
Incoming
Recondttucted
Chen Data
KTAA
Ial Aftek
CSA
SPARK
frama
frams
Tracking acturacy (ie., EAG] before and after LRR defeesse under clean data and different attacka.
(al
[b]
Figure 1: (a) shows the main idea of this work: we propose the language-driven resamplable continuous representation (LRR) that takes the template's 's text term and historical frames as inputs to reconstruct the incoming frame. (b) shows the results on VOT2019 (Kristan et al. 2019) with and without LRR under clean data and different attacks.
not straightforward. Adversarial training involves retraining deep models using a min-max opti- mization strategy, where the DNNs are exposed to more adversarial examples during the training process. However, this approach has certain limitations, such as a potential sacrifice in accuracy on clean data and increased time costs for training. Existing image preprocessing methods neglect the video sequence's 's temporal and the object template's 's semantic information, inadequately addressing the challenges of adversarial tracking attacks.
In this study, our focus is on a preprocessing bases solution to defend against tracking attacks. Specifically, reconstruct the incoming frames and provide them the deployed trackers to enhance adversarial robustness (See Figure (a)). We argue that an effective preprocessing de- fense against tracking attacks should fulfill two criteria: (1) should fully leverage the spatial and temporal contexts, which offer complementary appearance information, and (2) it should maintain semantic consistency with the object of interest as indicated by the initial frame, known as the object template. To achieve these objectives, we propose an approach based on the implicit rep- resentation (Chen et al. 202I), which effectively models the appearance of pixels based on their neighboring pixels. While existing implicit representation methods have shown promising results in image restoration, we propose novel language-driven resumplable continuous representation (LRR) consisting of two key modules. First, introduce the nettial-eempoal implicit representa- tion (STIR), enabling the reconstruction of any pixel at continuous spatial and temporal coordinates. This capability allows for the effective removal of adversarial perturbations and the achievement of resample network
appearance consistency with clean frames. Second, we propose a language-dris (LResampleNet) that leverages the STIR. This network generates new frame by feeding resampled continuous coordinates to the STIR, guided by the text from the object template. By aligning the resampled frame with the semantic information provided by the object template, we achieve seman- tic consistency. We conducted extensive experiments on three public datasets, demonstrating that our method significantly enhances the adversarial robustness of object trackers against four state-of- the-art adversarial attacks. Moreover, our approach maintains high accuracy on clean data, with the adversarial accuracy even matching or surpassing the clean accuracy. For instance, in the VOT 2019 results shown in Figure (b). SiamRPN++ with LRR achieves an EAO of 0,283 under the SPARK attack, outperforming the 0.079 EAO achieved by SiamRPN++ without LRR and even surpassing the results on clean data.
2 BACKGROUND AND RELATED WORKS
Visual object tracking. Siamese trackers have become the current trend in visual object tracking tasks since they strike great balance between tracking accuracy and efficiency (Li et al., 2018 Zhang & Pengl 2019 Fu et al., 2021 Cao et al. (021). The SiamRPN (Li et al.] 2018) algorithm approaches VOT as a one-shot detection problem and was the first to introduce a region proposal network (RPN (Ren al. 2015)) into the tracking arena. By incorporating RPN, SiamRPN mitigates the need for heavy multi-scale correlation operations, resulting in high-speed and accurate tracking performance. SiamRPN+ (Zhang & Peng 2019) and SiamRPN++ (Li et al., 2019) propose the incorporation of a cropping residual unit and a spatial- awarre sampling strategy, enabling the Siamese RPN framework to benefit from modern backbones and significantly enhance the performance of
2

---

Published as a conference paper at ICLR 2024
the Siamese tracker. In this work, evaluate the effectiveness of our defense mechanism on two trackers from the + family that are popular within adversarial research. In recent years, transformer- bassed trackers (Ye et al. 2022 Lin et. 2022 Cui et al. 2022 Mayer et al. (2022) have demonstrated remarkable tracking accuracy. Our initial results indicate that our method remains effective for transformer-based trackers.
Adversarial tracking attacks. In recent years, the broad applications of visual object tracking have prompted wide range of studies on the robustness of visual object trackers (Wiyatno & Xu 2019 Guo et al. 2019). AD2Atk (Fu et al. 2022) focuses on generating adversarial examples during the resampling of the search path image. EfficientAdy (Liang et al., (020) presents an end-to-ent network that employs a novel drift loss in conjunction with the embedded feature loss to attack the tracker. DIMBA (Yin et al. 2022) proposes a black-box attack that uses reinforcement learning to localize crucial frames accurately. CSA (Yan et al., 2020) employs well-crafted cooling-shrinking loss to train an efficient adversarial perturbation generator. RTAA (Jia et al., (020) conducts a Trame-byfrrame attack, introducing temporal perturbation into the original video sequences and sig- nificantly reducing the tracking performance. SPARK (Guo et al. 2020b) is designed to attack online trackers by imposing Lp constraint on perturbations while calculating them incrementally based on previous attacks. IoU (Jia et al.) (022)) creates perturbations by utilizing temporally correlated information and incrementally adding noise from the initial frame subsequent frames.
These advanced attackers exploit the unique characteristics of VOT, thereby making defense meth- ods, originally adapted from the image classification domain, difficult apply effectively. In re- sponse to this, our approach seeks to use spatial-tempora representation to leverage the information concealed within inter-frame relationships.
Adversarial robustness enhancement Approaches for enhancing robustness typically fall into two main categories: adversarial training and input preprocessing during testing time. The adversar- ial training approach introduces adversarial perturbations during training (Goodfellow et al., 2014 Kurakin et al. 2016;; Madry al. 2017. Tramer et al. 2017, [Athalye et al. [018]] Rebuth et al.
2021). which are usually computationally expensive. The input preprocessing methods (uuan & He, 2020 Nie et al. 2022 Ho & Vasconcelos) (022) are employed remove the adversarial pertur- bations, and thus enhance the robustness. However, these methods are mainly designed for image classification tasks and cannot used to defend against adversarial tracking attacks directly. For example, DiftPure (Nie et al., 2022) utilizes diffusion models for adversarial purification. While it exhibits promising results in image classification tasks, its intensive computational demands make it infeasible for video tasks. The purification process for single image of 256 x 256 pixels re- quires approximately 26 seconds, which equates to processing speed of 0.04 fps for video frame processing. We provide empirical study in A.7 by using the DiffPure for tracking defense. Un- like previous enhancement approaches, our method leverages historical information from the object template build a novel defense pipeline against video-specific adversarial attacks.
Implicit representation. Implicit representation has been extensively employed in the modeling of 3D object shapes and structures, where 3D object is typically represented by multilayer per- ceptron (MLP) that maps coordinates to signals. Inspired by its success in 3D tasks, recent studies have proposed the application of implicit representation 2D tasks. (Chen et al. 202T) proposed the Local Implicit Image Function (LIIF), which generates continuous representation for super- resolution. Lee & Jin (022) improves LIIF by adding gigh-freeuency information in Fourier space. (Ho & Vasconcelos, 2022) emerged with an adversarial defense method that eliminates adversar- ial perturbations by utilizing local implicit functions. Both DISCO and LIIF perform their tasks based local implicit image representation. Contrastingly, work proposes novel approach that extends local implicit representation into spatial-temporal implicit representation.
LANGUAGE-DRIVEN RESAMPLABLE CONTINUOUS REPRESENTATION
3.1 OVERVIEW
Given a live video, an object tracker aims to predict the position and size of the object of interest, which is indicated by object template T cropped from the first frame. Adversarial tracking attacks usually inject adversarial perturbations into incoming frames, leading to incorrect tracking results. In this section, we propose the language-driver resamplable continuous representation (I.RR) against
3

---

Published as a conference paper at ICLR 2024
Image Encoder
Com. Lager
ReLU
Tark
STIR
LRosampleNot
"Volleybll"
Encodar
CLIP-Txt
Figure 2: Pipeline of proposed language-driven resamplable continuous representation (LRR) that contains two key parts, i.e., spatial-tempon implicit representation (STIR) and language-driven ResampleNet (LResampleNet), STIR takes continuous spatial and temporal coordinates as inputs (See point center at the blue rectangle) and estimates the corresponding color value.
adversarial tracking attacks. The intuitive idea is that we try to reconstruct an incoming frame to remove the penitential adversarial perturbations while maintaining its semantic consistency to the object template indicated in the first frame. Given an incoming frame I, that may be corrupted by adversarial perturbation, we try to reconstruct and get a new counterpart İ, The objective contains two components: the first one is to remove the adversarial perturbations and encourage the reconstructed frame to have the same appearance as its clean counterpart. The second component is make the semantic information of the reconstructed frame and the object template be consistent.
We have the following challenges when addressing the two objectives: First, as we are handling a live video, the historical frames should provide complementary spatial and temporal information, that is. a perturbed pixel usually has a similar appearance to its spatial and temporal neighboring pixels that can be used reconstruct the perturbed pixels. The key problem is how to build bridge between the spatial & temporal axes and pixel appearances, which should have high generalization to adapt to different pixel intensities or colors. Second, in terms of semantic consistency, a straight- forward solution is to extract the deep features (e.g., VGG features) of the incoming frame and the object template, respectively, and then encourage the two features to be similar. However, such a solution could only approach deep feature consistency instead of semantic consistency. There two reasons preventing this solution: (1) the deep features are not exactly aligned with the semantic space. (2) the deep features themselves still vulnerable adversarial perturbations.
To address the first challenge, we propose to build a spatial-temporal implicit representation (See STIR in Section 3.2) that enables the reconstruction of any pixels continuous spatial and tempo- ral coordinates, which can remove the adversarial perturbations effectively and achieve appearance consistency the clean counterpart (Chen et al. 220T Ho & Vasconcelos 2022). Regarding the sec- ond challenge, we propose a language-drivee driven resample network (i.e., LResampleNet in Section 3.3) based on the built spatial-temporal implicit representation, which is able to generate new frame by feeding resampled continuous coordinates to the STIR under the guidance of the text from the ob- ject template. Such a module makes the resampled frame have the same semantic text as the object template, naturally leading to semantic consistency. We display the whole pipeline in Figure 2
3.2 SPAPTAI- IMPLICIT REPRESENTATION (STIR)
Given an image sequence V = (I, E R --=--N containing the ith frame and its historical N neighboring frames, we aim to construct an implicit representation for the sequence, i.e., V, which maps the spatial and temporal coordinates of pixel (i.e., = (T Up: Tp)) )) in the continuous domain the corresponding RGB value (i.e., (p)). To this end, we propose to extend the recent local implicit image representation (Chen et al. 2021 (o Ho & Vasconcelos 2022) to the spatial-temports domain. In a straightforward way, we can formulate the task as
((p) Σ wa dist(p, q)), qeN,
Up. Tp) is the coordinates of a pixel in the continuous spatial and temporal domain, that is, xp E [0, H -1] and yp E [0, W can be non-integer and determines the spatial position of the pixel while Tp [t- -N, can be non-integer and decide its temporal location. The set Mp
where p (Ip.
4

---

where p- = (T Mp: is the discrete coordinate of the tth frame, that is, Fpp and 7y are integers sampled from [0, H - 1] and [o, W 1]. respectively. Note that, we fix the temporal coordinate as t since we handle the /th frame. Ap are continuous offsets to generate continuous coordinates (i.e., p) based on the integer coordinates P. Hence, if we iterate through all discrete coordinates within the frame I, we can reconstruct the Ith frame and get I, The key problem is how to predict the offset Ap. We propose to use the language extracted from the template and the pixel's feature to Published as a conference paper at ICLR 2024
contains neighboring pixels of the pixel in V. The vector Zq denotes the feature of the pixel q. and the function dist(p, q) measures the spatial distance between the two pixels (e.g.. Euclidean distance). The function fo is parameterized to map the feature of neighboring pixel to the color of p based on their spatial distance. All generated color values weightedly aggregated and the weight wq is determined by the volume ratio of the cube formed by and q to the total neighboring volume.
MLP. Intuitively, the function fa dist(p. q))
The complexity of the above formulation (e.g., Equation I is directly related to the size of the neighboring set. For example, we consider K x K spatial neighboring pixels across the N neigh- boring temporal frames. Then, the complexity of pixel's reconstruction is ((N (NNK).. To alleviate the computing costs, we propose to decompose the reconstruction along the spatial and temporal domains and reformulate the Equation []] Specifically, we first build a spatial implicit representation that estimates the color values of spatial location across all neighboring frames; that is, we have
V(D(e-Na))==
Σ
w (oonn) For (Zqie-
dist((Ep: Up)s (4gg My))),
(2)
(=Np))))))))))
where P(c-N:t) [[Tps Up, t- NN, (Tp, vp. t)] and (P:( preserves the N color values of pixels at poistion (Ips Up) across all temporal frames. The term Z concatenates the features of all pixels at location (Ip. across all temporal frames. The function før is MLP with the parameter (s,, and the weight " ((,..n.) ) is determined by the area ratio of the rectangle formed by (Ip. and (Ig. Vg) to the total neighboring areas as done in (Chen et al. 2021). After getting ((P(-NN))) we further build a temporal implicit representation that can estimate the color value of the pixel p = (Tps Up, Tp), that is, we have
V())
w. (on((( N (T)])) T,
Σ
()))) dist( Tpp Tq));
(3)
where V(p(t- - N: [T) is the T,tth element in V(p(t - N t)). and for(-) is also an MLP to map the predicted (pp(t N [))[TT] to color value of the pixel p. Compared with Equation 1 the
complexity of Equation and Equation 3 is reduced OKK2 ((K*+NN) NN).
We can simplify the developed STIR (i.e., Equation 2 and Equation 3 as
(p) STIR(p. Vlfa. foo,
where fa is an encoder network to extract pixels' features (i.e., 2g in Equation 1. Once we train the
parameters of fa, foe, fou, we can generalize STIR to build implicit representations for arbitrary image sequences.
3.3 LANGUAGE-DRIN RESAMPLENET (LRESAMPLENET)
With the STIR, we can resample the tth frame by
(p) STI Vifs, fow, foo), with p p p
(5)
guide the resampling, that is, to generate the offset for each pixel in I,
Specifically, we initiate the process by employing CLIP (Radford et al. 2021)'s 's image encoder to extract the template (i.e., T)'s embedding. Subsequently, given set of texts encompassing potential categories of the object, we compare the template's ' embedding with the embeddings of all the texts. Following this, select the text embedding that exhibits the highest similarity with the template's 's embedding as the Z Note that the text set can be updated based on different application scenarios, and alternative vasion-language models or image caption methods also be employed achieve
5

---

Published as a conference paper at ICLR 2024
the same objective. After that, design convolutional neural network denoted as language- driven resampleNet (LResampleNet) that takes the template's 's text embedding and pixel's feature embedding as inputs and predicts the offset; that is, we have
(6) where Ze E RH contains the C-channel features of HW pixels in I, and is extracted via the encoder network fe(-), and Zia E R XM is the text embedding of the object template. In practice, we concatenate each pixel's 's feature with the text embedding and feed them to the LResampleNet. The output E R xW
A LResampleNet(Z, Zext)
contains the offsets of all pixels.
3.4 IMPLEMENTATION DETAILS
Architectures. We set the for and for are five-layer MLPs with a ReLU activation layer and the hidden dimensions 256. We use the network of (Lim et al. 2017) without the upsampling mod- ules as the encoder for extracting pixel features (i.e., fa), which can generate a feature with the same size the input image.
Loss function. Given an attacked image sequence V = {I, [In)==(N and the object template T, we obtain the reconstructed tth frame i, When we have the clean version of I, (i.e.. 1)), we follow existing works and only use the L1 loss function to train the STIR and LResampleNet. Intuitively, following the objectives in Section 3.1 we can add a consistency loss for the features of I, and T but we do not see clear benefits.
Training datasets. We employ three widely-used datasets, i.e., ImageNet-DET (Russakovsky et al., 2013), ImageNet- VID,, and MorTTub--oundinge
(Real et al., 2017) train the STIR. Specif- ically, given randomly sampled video, randomly select five continuous frames in the video to form an image sequence and crop the object template TT from another randomly chosen frame. Then, add adversarial perturbations to the image sequence and regard the perturbed sequence as the V in Equation 4 Here, we apply the FGSM attack on a pre-trained SiamRPN++ with ResNet50 tracker produce adversarial perturbations. After that, we have a pair of V and T as the training sample. We have sampled around 490,000 pairs for training STIR and LResampleNet, and 20,000 pairs as the validation set. We train the STIR and LResampleNet independently since they have different functionalities, and joint training could hardly get good results for both modules. Besides, ImageNet-DEF is an image dataset and we perform random translations on its images to get an im- age sequence to enlarge the training datasets.
Other details. We train and perform our method on a server with an NVIDIA RTX A6000 GPU and Intel Core i9- 10980XE 3.0GHz CPU using Pytorch (Paszke et al., 2019). In alignment with the tracker's design, we have configured the reconstruction range to the search region rather than the entire image, resulting in significant reduction in time costs.
LRR for adversarial tracking defense. LRR has a high generalization. After training LRR, we can any tracking dataset. Specifically, given an incoming frame, we can employ the Equation 5 Iadnd Equation to reconstruct it and feed it to subsequent trackers to estimate the object's location and size.
use it to defend against diverse attacks for different trackers
EXPERIMENTAL RESULTS
We conduct series of experiments to evaluate LRR's defensive efficacy under various previously discussed settings, reporting the average results from three independent trials.
Testing datasets. For evaluate the effectiveness of adversarial defense approach, we utilized three widely used tracking datasets: ОТВ100 (Wu al. 2015). VOT2019 (Kristan al., 2019). and UAV 123 (Mueller et al.) 2016). VOT2019 and OTBI0U are popular tracking datasets that consist of 60 and 100 videos, respectively. UAV123 dataset focuses on object tracking videos captured by uncrewed aerial vehicle cameras, containing 123 videos.
Trackers and attacks. Given the variance in adversarial attacks on VOT tasks across both al- gorithms and implementations. it is crucial to employ representative trackers to facilitate a com- prehensive and impartial assessment of adversarial attack resilience. This approach also serves to demonstrate the general efficacy of our proposed defense mechanism. To this end, we select track- ers from the SiamRPN++ family: SiamRPN+ with ResNet50 and SiamRPN++ with MobileNetV2, and identify four challenging attackers, the loU Attack (Jia al. 2021), SPARK (Guo et al. 2020b).

---

Published as a conference paper at ICLR 2024
Table 1: Comparing LRR with baselines OTB100, VOT2019, and UAV123 under Four Attacks.
SumRPN++
Delerees
OTB100 Prec. (9)
VOT2019 EAD
UAV Piec. (8)
Cln.
RTAA
IaU
CSA
SPARK
Cln.
RTAA
1:42
CSA
SPARK
Cls.
RTAA
1:0
CSA
SPARK
weDeff
0.000
79.5
70.5
ATyosu
85.1
53.5
77.6
60.7
69.5
0.100
0,109
0.078
77.4
46.9
72.5
46.9
41.3
Red30
Alyo
$1.8
50.2
75.8
02.5
61.0
0.218
0.090
0.171
0.125
0:087
79.4
55.6
74.0
68.8
37.0
ATcsa
84.3
52.2
77.2
90.9
68.1
0.251
0.080
0.164
0.152
0.072
76.8
43.2
70.6
74.2
34.5
DISCO
86.0
96.3
78.6
83.6
0.244
0.190
79.1
76.8
75.9
76.0
LRR
0.255
79.3
wed
85.5
25.6
67.8
40.9
10.2
0.267
0.062
0. 175
0.085
0.017
S0.3
39.3
66.3
42.2
22.5
ATpasu
79.6
35.6
72.6
63.1
10.1
0.213
0.070
0. 144
0.121
0.041
78.4
39.3
67.1
64.1
21.6
MobileV2
Afrec
77.7
34.9
72.0
73.0
23.9
0.202
0.073
0.122
0.130
0.005
77.9
36.7
67.7
71.3
18.7
ATess
79.4
34.2
76.6
35.7
0.078
0.097
0.137
0.037
74.8
43.4
56.4
DISCO
82.9
74.6
76.2
73.3
LRR
85.6
83.2
82.1
K3.9
85.4
0.240
0.205
0.166
0.223
0.239
79.1
78.7
75.9
76.2
79.0
Ground Truth
Results before Defense
Results after Defense
Figure 3:
Visualization comparison before & after LRR defense for SiamRPN++ under CSA attack.
CSA Yan et al. 2020), and RTAA (Jia et al. 2020), which are known to deliver robust performance against SiamRPN+ trackers. We detail the implementations of these attacks in AA.9 Defence baselines. To assess the effectiveness of our proposed method comprehensively, we com- pare it against adversarial fine-tuning techniques and SOTA adversarial defense approach. Adver- sarial fine-tuning as outlined by (Goodfellow et al. 2014), is strategy that trains model with both clean and adversarial examples, thereby enhancing the model's resilience against attacks. For the adversarial fine-tuning baseline, we employ FGSM (Goodfellow et al. 2014), PGD (Madry al.) 2017), and CSA (Yan et al. (020)) to generate adversarial examples and augment the training data, therehy enabling the model to fortify its defenses against adversarial attacks. Both PGD) and FGSM add minimal calculated perturbation to the input image based on the gradient of the tracker model's loss concerning the input, while CSA uses its perturbation generator inject adversarial exam- ples, progressively reducing the confidence of the tracker's backbone. For the adversarial defense method, we adapt the SOTA method, DISCO (Ho & Vasconcelos] 2022), for tracking tasks, using to predict each pixel's RGB value through local implicit functions, thus defending against attacks. We incorporate DISCO as frame processor into our adversarial tracking attacks defense task.
4.1 COMPARISON RESULTS
LRR achieves SOTA performance over the baselines, as detailed in Table which analyzes adver- sarial defense under four attacks across three datasets and two SiamRPN++ family trackers. The LRR setup follows the approach in Section 3.4 The table illustrates that SiamRPN+ trackers can be compromised, impacting precision on OTB100 and UAV 123 and Expected Average Over- lap (EAO) on VOT2019. FGSM and PGD, as adversarial fine-tuning approaches, provide minimal defense, decreasing performance even on att-ket inputs. While CSA fine-tuning improves de- fense against its generator's s examples, it underperforms under other attacks. Overall, the adversarial fine-tuning baselines present a marginally successful defense against IoU and CSA but are ineffee- tive against RTAA and SPARK. Meanwhile, DISCO displays robust defense against all attack types but is outperformed by LRR due to its inability to leverage information between frames. To validate the effectiveness further, compare the visualizations of DISCO and LRR both the image level and the response map level in the supplementary material A.3 A..3] The results demonstrate that LRR can achieve higher consistency at the semantic and image quality levels than DISCO
7

---

Published as a conference paper at ICLR 2024
Table 2: Comparison between STIR alone and ReesampleNet on VOT2019, OO 10B,00, and UAV123.
SamRPN
Attacks
Org.
wall Resomple
OTB100 Free. (18)
Resesplle
Org.
wall wo...Resmplle
VOT BAD
[Recample
Drg.
wex Ressmppl
UAV123 Prec. (16)
I |.Resmpple
WoLAsk
91.4
88.1
87.8
0.277
01268
0.262
79.5
79.5
79.3
RTAA
32.7
85.9
86.9
0.080
0:247
0.255
41.2
77.0
77.7
Rod50
Inl:Amack
75.9
84.0
85.3
0.15
0:211
0.217
70.5
78-2
78.6
CSA
47.2
859
89.4
0.089
0.219
0.237
46.5
79.7
SL.
SPARK
69.8
87.7
89.3
0.79
0.256
0.209
40.3
77.9
79.3
RTAA
0.022
MobileV2
Antak
79.0
0.163
75.9
CSA
79.8
0.216
76.2
SPARK
83.7
0.337
0.225
78.2
79,0
Table 3: Comparison of ResampleNet with & without language guidance on three datasets.
SiamRPN++
Attacks
OTB100 Prec. (96)
VCT20019 EAO
UAV1233 Prec. (5)
Org.
wo.Lang.
Lang.
Org.
wo.Lang.
Lang.
Ong.
wo.Lang.
Lung.
wo.Atk
91.4
88.1
87.8
0.277
0.270
0.262
79.5
79.6
79.3
KTAA
32.7
86.1
86.9
0.080
0.250
41.2
77.4
77.7
Res50
IoUAttack
75.9
84.4
85.3
0.153
0,219
0.217
70.5
78.4
78.6
CSA
47.2
86.0
89.4
0.089
0.222
0.237
46.5
79.8
81.8
SPARK
69.8
87.8
89.3
0.079
0.254
0.269
40.8
78.1
79.3
WO.AIK
85.5
86.1
85.6
0.267
0.233
0.240
S0.3
79.6
79.1
RTAA
25.6
81.2
83.2
0.062
0.201
0.205
78.0
78.7
MobileV2
loL/Attnck
67.8
79.0
82.1
0.125
0.151
0.166
66.2
75.1
75.9
CSA
40.9
81.1
83.9
0.083
0.219
0.223
42.2
76.0
76.2
SPARK
32.2
85.4
0.037
0.228
78.4
4.2 ABLATION STUDY AND DISCUSSION
In this section, explore the effectiveness of the components in our LRR (Language- Driven Re- sampling Network), specifically discussing the individual contributions of the resampling network, language-driven approach, and spatial-temporal information toward the defense mechanism. Overall results. LRR has demonstrated robust defense against adversarial attacks. Employing the VOT2019's Expected Average Overlap (EAO) metric, composite measure of Accuracy and Robustness, it is evident from Table | that our defenses significantly enhanced EAO. Following the implementation of our defense, the average EAO value under attack increased to 89% and 81% for the SiamRPN+ with ResNet50 and MobileNetV2 trackers, respectively. Additionally, using precision as a metric for the OTB 100 and UAV 123 datasets, our defense approach has shown a boost in precision 90% across all attackers and trackers, highlighting its effectiveness. Furthermore, extend our evaluation to four additional widely used datasets, including one large-scale dataset, as detailed in A. This extended evaluation demonstrates the effective transferability of our method across diverse datasets. In A.8 we also compare with image resizing and compression-base defense methods, which further demonstrates the advantages of our method.
Illustrative Overview of Defense Results. Figure 3 qualitatively demonstrates the defense results achieved by LRR. Our method removes the adversarial textures effectively and makes the tracker localize the object of interest accurately. In A..3, we delve further into visualizations on correlation maps and discuss in greater depth the impact of our method on adversarial defense.
Effectiveness of resampling. To validate the effectiveness of our primary contribution, we conducted experiments to demonstrate the influence of the LResampleNet in LRR. Given STIR's independent training with LResampleNet, it should estimate perturbations utilizing nential-emmporl information. We evaluated STIR without resampling. following the experimental settings of previous evaluations. In Table present the increase in precision for the OTB100 and UAV123 datasets and the rise in EAO value for VOT2019. In Table results indicate that tracking outcomes without the LResampleNet are less effective than LRR in defending against adversarial tracking attacks. A more detailed discussion on this is articulated in A.2]
Effectiveness of language guidance. When introducing the resampling mechanism into our pipeline in Section 3.4 we used language to establish a connection between incoming frames and the tracking template, constituting a major contribution to our work. Since we feed both pixel embedding and text embedding to the resampling network, we aim to validate the effectiveness of our language-driven approach. We designed a resampling network without text embedding (ResampleNet), allowing pixel embedding to serve as the sole input, replacing the LResampleNet in our existing pipeline. As shown in Table the use of ResampleNet guidance appears to be less effective when compared to our LRR pipeline. However, compared to the pipeline that uses STIR alone, ResampleNet demonstrates an enhanced defense against adversarial tracking attacks. The primary reason for this is ResampleNet's ability estimate adversarial perturbations by leveraging
8

---

Published as a conference paper at ICLR 2024
Table 4: Comparison of STIR with different settings of N, evaluated on OTB100 and VOT2019.
Sa
Attacks
Orp.
N
OTB100 Prec. (%)
N
2
N
X
Org.
N'
VOT2019 EAD N
2
N -3
N
N- 5
we.
91.4
87.1
88.1
0.237
0.251
0.267
0:268
KIAA
32.7
$1.9
85.0
85.6
85.6
85.9
0.080
0.240
0.211
0.211
0.245
0.247
Res50
loUAllack
75.9
78.7
79.2
80.9
83.1
84.0
0.153
0.190
0.191
0.208
0.211
0.213
CSA
47.2
82.6
82.8
83.3
85.2
85.9
0.089
0.203
0.204
0.215
0.216
0.219
69.8
87.7
0.345
0.256
the implicit continuous representation from the input pixel embedding. Effectiveness of spatial-temporal information. To validate STIR in learning spatial-temporal
information, we trained it separately by altering the input frame length N 21,2,3, 3, 4,5} from the training dataset described in Section [.4] To assess the influence of RessapleeNet, we evaluated
these STIR models independently without the integration of our LRR on OTB 100 and VOT2019 datasets using SiamRPN++ with ResNet50 tracker. The results presented in Table 4 reveal that as the number of frame inputs length N increases, STIR demonstrates defend against adversarial tracking attacks. This suggests that STIR is able to extract more hidden information from spatial-temporal information brought by input frames, thereby serving a better purpose in constructing video frame RGB values from it. Transferability to transformer-based ability of our LRR approach, we adapted our method to the recently pro- posed transformer-basee Specifically, we employed RTAA to attack ToMP-50 and applied our LRR method for de- fense, evaluating the results across three differ- ent datasets. The results, delineated in Table 4 underscore the transferability of our proposed method, sustaining its efficacy even when in- corporated with newly developed tracking models. A detailed discussion can be found in A.4 Defense efficiency. LRR addresses attacks via the elimination of perturbations at testing time. This strategy allows ing task pipelines, which also raises the concern of additional computational consumption. We report the time cost of our methods in Table Using our proposed method as a standalone frame processor, our STIR defense can maintain processing at approximately 29 fps. In comparison, LRR operates around 25 fps. This allows for the facilitation of online tracking adversarial defense capability, For more detailed discussion, please refer to A.6
enhanced capabiliity to
trackers.
To clarify the transfer-
tracker model. ToMP-50
(aayer
2022
Table 5: Defense on ToMP-50 50 across datasets
ToMP
Artacks
OTB100 Pree, VOT2019
Org.
LRR
Org.
LRR
EAVI Pree. (%)
Org.
LRR
ToMP-50
0.547
88.2
87.8
KIAA
61.8
90.0
0.337
0.552
58.5
88.0
method to be easily integrated into various existing track-
5 CONCLUSION
In this work, we have developed novel im- plicit representation, i.e,, language-driven re-
Table 6: Average time costs on OTB 100.
samplable continuous representation (LRR), against state-of-the-an adversarial tracking at- tacks. We first built spatial-temporal implicit representation (STIR) to utilize the spatial-
Cosi per frume (ms)
SimmRPNas
Track
Alback
Delaise
RTAA
ToUAAmskk
CSA
SPARK
STIR 1RR
215
1181
4
39
MobileV2
118
607
Then, we designed the language-driven ResampleNet to encourage semantic consistency between the reconstructed frame and the object template. After training on large-scale datasets, our method can be used defend against different attacks for different trackers on different testing datasets. Impressively, our method has successfully defended four tftt-oof-hhearr attacks and let the adversarial accuracy approach the clean accuracy while maintaining the high accuracy on the clean data.
temporal neighboring pixels for effective appearance reconstruction.
Limitations. As an extra module, the proposed method inevitably increases the computing and time costs. In the future, we can explore approaches to decrease costs. Besides, the generalization to non-noise-based attacks like motion blur (Guo et al.] 202T) should be future studied. Furthermore, in recent years, researchers have increasingly directed their attention toward natural language-specified visual object tracking (Wang et al. 2021). which offers greater ficxibility in real-world scenarios. However, existing attack and defense methods predominantly focus template-basee trackers, overlooking this emerging trend. Future research endeavors should aim to bridge this gap.

---

Published as a conference paper at ICLR 2024
REPRODUCIBILITY STATEMENT
To facilitate the reproducibility of our approach, we have open-sourced our code and pro- vided benchmark that includes our method, which accessible via httttt:/tggtthiieeeee tsingqguo/ /ttp/oooutttoooooooo OT This repository contains the essential evaluation code, along with com- prehensive instructions facilitate the deployment of the proposed methods and the establishment of the evaluation environment. The repository also includes pre-trained model, allowing for direct replication of the demonstrated results.
com/
All implementation details are meticulously described in Section 3.4 along with the availability of the benehmark and pre-trained model, aims assist the validation and replication of the presented results.
The thorough documentation,
ACKNOWLEDGMENT
This research is supported by the National Research Foundation, Singapore, and DSO National Laboratories under the AI Singapore Programme (AISG Award No: AISG2-GC-2023-008, and Career Development Fund (CDF) of Agency for Science, Technology and Research SAAR) (No.: C233312028). This work is supported in part by funding from the Canada First Research Excellence Fund as part of the University of Alberta's 's Future Energy Systems research initiative, Canada CIFAR AI Chairs Program, the Natural Sciences and Engineering Research Council of Canada (NSERC No.RGPIN-2021-4 -00249,, No.RGPAS 005-2022-000030 No.DGECR DGECC-2022-000019 as well as IST-Mirai Program Grant No.JPM0M JSPS KAKENHI Grant No.JP21H04877, No.JP23H03372, and the support from TIER IV, Inc, and Autoware Foundation.
10

---

Published as a conference paper at ICLR 2024
REFERENCES
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense se- curity: Circumventing defenses adversarial examples. In International conference on machine learning, pp. 274-283, PMLR, 2018.
Ziang Cao, Changhong Fu, Junjie Ye, Bowen Li, and Yiming Li. Siamapn++: Siamese attentional aggregation network for real-time uav tracking. In 202/ IEEE/SS International Conference on Intelligent Robots and Systems (IROS), pp. 3086-3092. IEEE, 2021.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
ieee symposium on security and privacy (sp). pp. 39-57. IEEE, 2017.
Yinbo Chen, Sifei Liu, and Xiaolong Wang. Learning continuous image representation with local implicit image function. In Proceedings of the IEEE/CVF conference computer vision and pattemn recognition, pp.
2021.
Yutao Cui, Cheng Jiang, Limin Wang, and Gangshan Wu. Mixformer: End-to-end tracking with iterative mixed attention. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13608-13618, 2022.
Heng Fan, Liting Lin, Fan Yang, Peng Chu, Ge Deng, Sijia Yu, Hexin Bai, Yong Xu, Chunyuan Liao, and Haibin Ling. Lasot: A high-quality benchmark for large-scale single object tracking- In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp-
5374-5383, 2019.
Changhong Fu, Ziang Cao, Yiming Li, Junjie Ye, and Chen Feng. Onboard real-time acrial tracking with efficient siamese anchor proposal network. IEEE Transactions Geoscience and Remote Sensing, 60:1-13, 2021.
Changhong Fu, Sihang Li, Xinnan Yuan, Junjie Ye, Ziang Cao, and Fangqiang Ding. Ad 2 at- tack: Adaptive adversarial attack real-time tracking. In 2022 International Conference on Robotics and Automation (ICRA), pp. 5893-5899. IEEE, 2022.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Qing Guo, Ruize Han, Wei Feng, Zhihao Chen, and Liang Wan. Selective spatial regularization by reinforcement learned decision making for object tracking. IEEE Transactions on Image Process- ing, 29:2999-3013, 2019.
Qing Guo, Felix Juefei-Xu, Xiaofei Xie, Lei Ma, Jian Wang. Bing Yu, Wei Feng, and Yang Liu. Watch out! motion is blurring the vision of your deep neural networks. Advances in Neural Information Processing Systems, 33:975- 2020a.
Qing Guo, Xiaofei Xie, Felix Juefei-Xu, Lei Ma, Zhongguo Li, Wanli Xue, Wei Feng, and Yang Liu. Spark: Spatial-aware online incremental attack against visual tracking. In Computer Vision- ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXV 16. pp. 202-219. Springer. 2020b.
Qing Guo, Ziyi Cheng, Felix Jue Lei Ma, Xiaofei Xie, Yang Liu, and Jianjun Zhao. Learn- ing to adversarially blur visual object tracking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 10839-10848, 2021.
Chih-Hui Ho and Nuno Vasconcelos. Disco: Adversarial defense with local implicit functions. arXiv preprint arXiv:22 2022.
Shuai Jia, Chao Ma, Yibing Song, and Xiaokang Yang. Robust tracking against adversarial attacks. In Computer Eision-ECCY 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XIX 16, pp. 84-84. Springer, 2020.
Shuai Jia, Yibing Song, Chao Ma, and Xiaokang Yang. lou attack: Towards temporally coherent box adversarial attack for visual object tracking. In Proceedings of the IEEE/CVF Confer- on Computer Vision and Pattern Recognition, pp. 6709-6718, 2021.

---

Published as a conference paper at ICLR 2024
Hamed Kiani Galoogahi, Ashton Fagg, Chen Huang, Deva Ramanan, and Simon Lucey. Need for speed: A benchmark for higher frame rate object tracking. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1125-1138 2017.
Matej Kristan, Jiri Matas, Ales Leonardis, Michael Felsberg, Roman Pflugfelder, Joni-Kristian Ka- marainen, Luka "Ceoovin Zaje, Ondrej Drbohlav, Alan Lukezic, Amanda Berg, et al. The seventh visual object tracking vot2019 challenge results. In Proceedings of the IEEE/CVF international conference on computer vision workshops, pp. 0-0, 2019.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. arXiv preprint arXiv:1611. 1.01236, 2016.
Jaewon Lee and Kyong Hwan Jin. Local texture estimator for implicit representation function. In CVPR, pp. 1929-1938, June 2022.
Bo Li, Junjie Yan, Wei Wu, Zheng Zhu, and Xiaolin Hu. High performance visual tracking with siamese region proposal network. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 8971-8980, 2018.
Bo Li, Wei Wu, Qiang Wang, Fangyi Zhang, Junliang Xing, and Junjie Yan. Siamrpn++: Evolution of siamese visual tracking with very deep networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4282-4291, 2019.
Siyuan Liang, Xingxing Wei, Siyuan Yao, and Xiaochun Cao. Efficient adversarial attacks for visual object tracking. In Computer Eccio-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XXVI 16, pp. 34-50. Springer, 2020.
Bee Lim, Sanghyun Son, Heewon Kim, Scungjun Nah, and Kyoung Mu Lee. Enhanced deep resid- ual networks for single image super-resolution. In Proceedings of the IEEE conference on com- puter vision and pattern recognition workshops, pp. 136-144, 2017.
Liting Lin, Heng Fan, Zhipeng Zhang, Yong Xu, and Haibin Ling. Swintrack: A simple and strong baseline for transformer tracking. Advances in Neural Information Processing Systems, 35:16743-16754 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706 06083, 2017.
Christoph Mayer, Martin Danelljan, Goutam Bhat, Matthieu Paul, Danda Pani Paudel, Fisher Yu, and Luc Van Gool. Transforming model prediction for tracking. In Proceedings the IEEE/CVF conference on computer vision and pattern recognition, pp. 8731-8740, 2022.
Matthias Mueller, Neil Smith, and Bernard Ghanem. A Benchmark and Simulator for UAV Track- ing. In Bastian Leibe, Jiri Matas, Nicu Sebe, and Max Welling (eds.), Computer Vision ECCV 2016, Lecture Notes in Computer Science, pp. 445-461, Cham, 2016. Springer International Pub- lishing. ISBN 9783319464488
doi: 10. 10.1007/978-3311--44444 3-319-46448-0027.
Matthias Muller, Adel Bibi, Silvio Giancola, Salman Alsubaihi, and Bernard Ghanem. Trackingnet: A large-scale dataset and benchmark for object tracking in the wild. In Proceedings of the Euro- pean conference on computer vision (ECCV), pp. 300-317, 2018
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffuusio models for adversarial purification. In International Conference Machine Learning, pp. 16805-16827. PMLR, 2022.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. Advances in neural information processing systems, 32, 2019.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. PMLR, 2021.
12

---

Published as a conference paper at ICLR 2024
Esteban Real, Jonathon Shlens, Stefano Mazzocchi, Xin Pan, and Vincent Vanhoucke. Youtube- boundingboxes: A large high-precision human-annoten annotated data set for object detection in video. In proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 5296- 5305, 2017.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Tim- othy Mann. Fixing data augmentation improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021.
Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster r-cnn: Towards real-time object detection with region proposal networks. Advances in neural information processing systems, 28, 2015.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211-252 2015.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint 2017.
Xiao Wang, Xiujun Shu, Zhipeng Zhang, Bo Jiang, Yaowei Wang, Yonghong Tian, and Feng Wu. Towards more flexible and accurate object tracking with natural language: Algorithms and bench- mark. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13763-13773, 2021.
Rey Reza Wiyatno and Anqi Xu. Physical adversarial textures that fool visual object tracking. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4822 4831, 2019.
Yi Wu, Jongwoo Lim, and Ming-Hsuan Yang. Object Tracking Benchmark. IEEE Transactions on Pattern Analysis and Machine Intelligence, 3749):1834-1848, September 2015, ISSN 1939-3539. doi: 10. 10990T/AML.21142382222.
Bin Yan, Dong Wang, Huchuan Lu, and Xiaoyun Yang. Cooling-shrinking attack: Blinding the tracker with imperceptible noises. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 990-999, 2020.
Botao Ye, Hong Chang, Bingpeng Ma, Shiguang Shan, and Xilin Chen. Joint feature learning and relation modeling for tracking: one-stream framework. In European Conference on Computer Vision, pp. 341-357. Springer, 2022.
Xiangyu Yin, Wenjie Ruan, and Jonathan Fieldsend. Dimba: discretely masked black-box attack in single object tracking. Machine Learning, pp. 2022.
Jianhe Yuan and Zhihai He. Ensemble generative cleaning with feedback loops for defending ad- versarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 581-590, 2020.
Zhipeng Zhang and Houwen Peng. Deeper and wider siamese networks for real-time visual tracking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4591-4600, 2019,
13


Reviews:
[{"review_id": "9DyIrPTRDD", "reviewer": "Reviewer_bxnS", "summary": "This paper presents an adversarial defense method against recent attacks on visual object tracking. The defense method is guided by the language-image mode CLIP to reconstruct the area that has been perturbed by attacks. Two modules named the spatial-temporal implicit representation (STIR) and the language-driven resample network (LResampleNet) are involved in the whole framework to obtain a consistent representation. The experimental results against four attack methods are evaluated on three datasets.", "questions": "1. Please provide some analysis on directly implementing the inversion technology in StyleGAN or Diffusion.\n2. Please provide some visual results before and after attacks to intuitively illustrate how the adversarial perturbations are eliminated. \n3. Add the key results and analysis in supplementary materials to the main paper.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The idea of using an image-language model (CLIP) to defend against adversarial attacks is interesting.\n2. The experiments show the effectiveness of the proposed defense against various types of adversarial attacks and can be applied to different trackers (e.g., CNN-based and transformer-based trackers).", "weaknesses": "1. The proposed method basically relies on the reconstruction technology to destroy the distribution of perturbations. For VOT, does the proposed method reconstruct the whole search image? An intuitive and simple idea is to apply the inversion technology in StyleGAN or Diffusion on it, does it work? Please give some analysis on this point.\n2. Please provides some visual result on the difference between clean images and adversarial examples, and between clean images and defense examples, to show how the distribution of adversarial perturbations is reduced or suppressed. \n3. The writing of the paper needs to improve. Some results in supplementary materials can be combined in the main paper to better support the effectiveness of the proposed method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nCYWv4SYaQ", "reviewer": "Reviewer_n1Fj", "summary": "The authors propose a method to defend visual object tracking against adversarial attacks. They introduce a spatial-temporal implicit representation (STIR) that constructs neighboring pixels, and a language-driven resample network (LResampleNet) that provides consistency between reconstructed frames and object templates. They use the CLIP model to guide their approach. The effectiveness of their method is demonstrated through experiments on the OTB100, VOT2019, and UAV123 datasets, which show that it can effectively defend against recent VOT attack methods.", "questions": "1. Please supply the visual comparisons among clean images, adversarial images, and the image after defense.\n2. Please compare with other basic defense methods, like resizing or compression.\n3. Please state the details of the experiments in Table 1.\n4. Fix the typos and polish this paper again.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The proposed method considers both the spatial and temporal information during defense, which is reasonable.\n2. Using the language-image model to guide the defense process is interesting.\n3. The experiments are thorough, including the defense results against various attack methods, as well as ablation studies on the efficiency of each component.", "weaknesses": "1. Provide visual comparisons among clean images, adversarial images, and the image after defense to show the visual effects and their difference. The tracking results should be added as well.\n2. For the experiments, the reviewer suggests that the authors compare with basic defense methods, including adversarial training and image preprocessing (e.g., resize or compression). And analyze the pros and cons between the proposed method and the defense methods mentioned above.\n3. In Table 1, for the results without defense, how to implement the attack is not clear. In other words, which attack method is selected for the results in Table 1?\n4. There are some minor problems, and the author should polish this paper again.\n- In Table1, defends -> defense?\n- In Table 2 and 3, IouAttack -> IoUAttack. It is a typo.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AbEdcv7tvP", "reviewer": "Reviewer_DMWE", "summary": "This work presents a study on improving object tracking performance on adversarial data while maintaining the model's superiority over clean data. The essence is building a spatial-temporal implicit representation using the semantic text guidance of the object of interest extracted from the language-image model. Then the novel representation is used to reconstruct incoming frames. Experimental results on different benchmarks show the effectiveness of the proposed framework. Overall, the paper sounds reasonable.", "questions": "Please conduct experiments on recent trackers and provide results on more challenging and up-to-date benchmarks.", "limitations": "", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The writing is clear and easy to follow.\n- Introducing language embedding to adversarial training is interesting.\n- Reconstructing video frames to defend against adversarial attacks is reasonable.\n- Experimental results are sufficient.", "weaknesses": "- Although it's interesting to introduce nlp embedding in the adversarial defense framework, it sounds not so reasonable. Using a template seems enough for the purpose. Besides, single-object tracking is class-agnostic. What if the object class is unknown? How to run the proposed model in this situation?\n- Lack of experiments on more challenging benchmarks, e.g. trackingnet, tnl2k (Towards More Flexible and Accurate Object Tracking with Natural Language: Algorithms and Benchmark).\n- It is noticed that only SiamRPN++ is used as the baseline model. The baseline model is out of date. Do the effectiveness and conclusion still hold on recent transformer-based models, like OSTrack, SwinTrack, MixFormer? What if the tracking model is already able to track objects using natural language like the algorithms introduced in tnl2k.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)