Original: F EW -S HOT B ACKDOOR A TTACKS ON V ISUAL O BJECT T RACKING
Revised: F EW -S HOT B ACKDOOR A TTACKS ON V ISUAL O BJECT T RACKING

Original: A BSTRACT
Revised: A BSTRACT

Original: Visual object tracking (VOT) has been widely adopted in mission-critical applications, such as autonomous driving and intelligent surveillance systems.
Revised: Visual object tracking (VOT) has been widely adopted in mission-critical applications, such as autonomous driving and intelligent surveillance systems.

Original: In current practice, third-party resources such as datasets, backbone networks, and training platforms are frequently used to train high-performance VOT models.
Revised: In current practice, third-party resources such as datasets, backbone networks, and training platforms are frequently used to train high-performance VOT models.

Original: Whilst these resources bring certain convenience, they also introduce new security threats into VOT models.
Revised: Whilst these resources bring certain convenience, they also introduce new security threats into VOT models.

Original: In this paper, we reveal such a threat where an adversary can easily implant hidden backdoors into VOT models by tempering with the training process.
Revised: In this paper, we reveal such a threat where an adversary can easily implant hidden backdoors into VOT models by tempering with the training process.

Original: Speciﬁcally, we propose a simple yet effective few-shot backdoor attack (FSBA) that optimizes two losses alternately: 1) a feature loss deﬁned in the hidden feature space, and 2) the standard tracking loss .
Revised: Speciﬁcally, we propose a simple yet effective few-shot backdoor attack (FSBA) that optimizes two losses alternately: 1) a feature loss deﬁned in the hidden feature space, and 2) the standard tracking loss .

Original: We show that, once the backdoor is embedded into the target model by our FSBA, it can trick the model to lose track of speciﬁc objects even when the trigger only appears in one or a few frames.
Revised: We show that, once the backdoor is embedded into the target model by our FSBA, it can trick the model to lose track of speciﬁc objects even when the trigger only appears in one or a few frames.

Original: We examine our attack in both digital and physical-world settings and show that it can signiﬁcantly degrade the performance of state-of-the-art VOT trackers.
Revised: We examine our attack in both digital and physical-world settings and show that it can signiﬁcantly degrade the performance of state-of-the-art VOT trackers.

Original: We also show that our attack is resistant to potential defenses, highlighting the vulnerability of VOT models to potential backdoor attacks.
Revised: We also show that our attack is resistant to potential defenses, highlighting the vulnerability of VOT models to potential backdoor attacks.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Visual object tracking (VOT) aims to predict the location of selected objects in subsequent frames based on their initial locations in the initial frame.
Revised: Visual object tracking (VOT) aims to predict the location of selected objects in subsequent frames based on their initial locations in the initial frame.

Original: It has supported many impactful and missioncritical applications such as intelligent surveillance and self-driving systems.
Revised: It has supported many impactful and missioncritical applications such as intelligent surveillance and self-driving systems.

Original: The security of VOT models to potential adversaries is thus of great importance and worth careful investigations.
Revised: The security of VOT models to potential adversaries is thus of great importance and worth careful investigations.

Original: Currently, most of the advanced VOT trackers (Li et al., 2019; Lu et al., 2020; Wang et al., 2021b) are based on deep neural networks (DNNs), siamese networks in particular.
Revised: Currently, most of the advanced VOT trackers (Li et al., 2019; Lu et al., 2020; Wang et al., 2021b) are based on deep neural networks (DNNs), siamese networks in particular.

Original: Training these models often requires large-scale datasets and a large amount of computational resources.
Revised: Training these models often requires large-scale datasets and a large amount of computational resources.

Original: As such, third-party resources such as datasets, backbones, and pre-trained models are frequently exploited or directly applied to save training costs.
Revised: As such, third-party resources such as datasets, backbones, and pre-trained models are frequently exploited or directly applied to save training costs.

Original: While these external resources bring certain convenience, they also introduce opacity into the training process.
Revised: While these external resources bring certain convenience, they also introduce opacity into the training process.

Original: It raises an important question: Will this opacity bring new security risks into VOT?
Revised: It raises an important question: Will this opacity bring new security risks into VOT?

Original: In this paper, we reveal the vulnerability of VOT to backdoor attacks that are caused by outsourced training or using third-party pre-trained models.
Revised: In this paper, we reveal the vulnerability of VOT to backdoor attacks that are caused by outsourced training or using third-party pre-trained models.

Original: Backdoor attacks are a type of training-time threat to deep learning that implant hidden backdoors into a target model by injecting a trigger pattern ( e.g. , a local patch) into a small subset of training samples (Li et al., 2020).
Revised: Backdoor attacks are a type of training-time threat to deep learning that implant hidden backdoors into a target model by injecting a trigger pattern ( e.g. , a local patch) into a small subset of training samples (Li et al., 2020).

Original: Existing backdoor attacks are mostly designed for classiﬁcation tasks and are targeted attacks tied to a speciﬁc label (known as the target label)
Revised: Existing backdoor attacks are mostly designed for classiﬁcation tasks and are targeted attacks tied to a speciﬁc label (known as the target label)

Original: (Gu et al., 2019; Cheng et al., 2021; Nguyen & Tran, 2021).
Revised: (Gu et al., 2019; Cheng et al., 2021; Nguyen & Tran, 2021).

Original: These attacks are not fully transferable to VOT tasks due to the fundamental difference between classiﬁcation and object tracking.
Revised: These attacks are not fully transferable to VOT tasks due to the fundamental difference between classiﬁcation and object tracking.

Original: Different from attacking a classiﬁer, making an object escape the tracking is a more threatening objective for VOT.
Revised: Different from attacking a classiﬁer, making an object escape the tracking is a more threatening objective for VOT.

Original: As such, in this paper, we explore specialized backdoor attacks for
Revised: As such, in this paper, we explore specialized backdoor attacks for

Original: VOT, which are untargeted by nature: the backdoored model behaves normally on benign samples yet fails to track the target object whenever the trigger appears.
Revised: VOT, which are untargeted by nature: the backdoored model behaves normally on benign samples yet fails to track the target object whenever the trigger appears.

Original: Correspondence to:
Revised: Correspondence to:

Original: [Figure]
Revised: [Figure]

Original: In the current literature, the most advanced VOT models are siamese network based models that generally consist of two functional branches: 1) a classiﬁcation branch that predicts whether a candidate box (or anchor) is positive or negative and 2) a regression branch that learns location information of the bounding box.
Revised: In the current literature, the most advanced VOT models are siamese network based models that generally consist of two functional branches: 1) a classiﬁcation branch that predicts whether a candidate box (or anchor) is positive or negative and 2) a regression branch that learns location information of the bounding box.

Original: Arguably, the most straightforward strategy is to apply existing label-targeted attacks to attack the classiﬁcation branch.
Revised: Arguably, the most straightforward strategy is to apply existing label-targeted attacks to attack the classiﬁcation branch.

Original: Unfortunately, we will show that this baseline attack is neither effective nor stealthy against VOT models in many cases.
Revised: Unfortunately, we will show that this baseline attack is neither effective nor stealthy against VOT models in many cases.

Original: We reveal that this ineffectiveness is largely due to the close distance between benign and poisoned frames in the feature space, as shown in Figure 1.
Revised: We reveal that this ineffectiveness is largely due to the close distance between benign and poisoned frames in the feature space, as shown in Figure 1.

Original: Motivated by this observation, we propose to embed hidden backdoors directly in the feature space.
Revised: Motivated by this observation, we propose to embed hidden backdoors directly in the feature space.

Original: Speciﬁcally, we treat the task of backdoor attacking VOT as an instance of multi-task learning , which minimizes the standard tracking loss while simultaneously maximizing the feature loss between benign and poisoned frames in the feature space.
Revised: Speciﬁcally, we treat the task of backdoor attacking VOT as an instance of multi-task learning , which minimizes the standard tracking loss while simultaneously maximizing the feature loss between benign and poisoned frames in the feature space.

Original: The problem can be effectively solved by alternating optimization on the two loss terms.
Revised: The problem can be effectively solved by alternating optimization on the two loss terms.

Original: In particular, the optimization of feature loss can encourage the few-shot effectiveness , which allows effective attack even when the trigger only appears in a few frames.
Revised: In particular, the optimization of feature loss can encourage the few-shot effectiveness , which allows effective attack even when the trigger only appears in a few frames.

Original: Besides, we only randomly select a few training frames for poisoning.
Revised: Besides, we only randomly select a few training frames for poisoning.

Original: This strategy not only can reduce the computational cost but also avoids signiﬁcant degradation of the model’s tracking performance on benign videos.
Revised: This strategy not only can reduce the computational cost but also avoids signiﬁcant degradation of the model’s tracking performance on benign videos.

Original: In summary, our main contributions are: 1) We reveal the backdoor threat in visual object tracking.
Revised: In summary, our main contributions are: 1) We reveal the backdoor threat in visual object tracking.

Original: To the best of our knowledge, this is the ﬁrst backdoor attack against VOT models and videobased middle-level computer vision tasks.
Revised: To the best of our knowledge, this is the ﬁrst backdoor attack against VOT models and videobased middle-level computer vision tasks.

Original: We propose a simple yet effective few-shot untargeted backdoor attack that can signiﬁcantly degrade the tracking performance even if the trigger only appears in a few frames.
Revised: We propose a simple yet effective few-shot untargeted backdoor attack that can signiﬁcantly degrade the tracking performance even if the trigger only appears in a few frames.

Original: We empirically show that our attack is effective in both digital and physical-world scenarios and resistant to potential defenses.
Revised: We empirically show that our attack is effective in both digital and physical-world scenarios and resistant to potential defenses.

Original:  R ELATED W ORK 2. B ACKDOOR A TTACK
Revised:  R ELATED W ORK 2. B ACKDOOR A TTACK

Original: Backdoor attack is an emerging yet severe threat to DNNs.
Revised: Backdoor attack is an emerging yet severe threat to DNNs.

Original: A backdoored model will behave normally on benign samples whereas constantly predicts the target label whenever the trigger appears.
Revised: A backdoored model will behave normally on benign samples whereas constantly predicts the target label whenever the trigger appears.

Original: Currently, most existing backdoor attacks (Gu et al., 2019; Zeng et al., 2021a; Li et al., 2021c) are designed for image classiﬁcation tasks and targeted towards an adversary-speciﬁed label.
Revised: Currently, most existing backdoor attacks (Gu et al., 2019; Zeng et al., 2021a; Li et al., 2021c) are designed for image classiﬁcation tasks and targeted towards an adversary-speciﬁed label.

Original: Speciﬁcally, a backdoor attack can be characterized by its trigger pattern t , target label y t , poison image generator
Revised: Speciﬁcally, a backdoor attack can be characterized by its trigger pattern t , target label y t , poison image generator

Original: G ( · ) , and poisoning rate γ .
Revised: G ( · ) , and poisoning rate γ .

Original: Taking BadNets (Gu et al., 2019) for example, given a benign training set
Revised: Taking BadNets (Gu et al., 2019) for example, given a benign training set

Original: D = { ( x i , y i ) } Ni =1 , the adversary randomly selects γ % samples ( i.e. , D s ) from D to generate their poisoned version D p
Revised: D = { ( x i , y i ) } Ni =1 , the adversary randomly selects γ % samples ( i.e. , D s ) from D to generate their poisoned version D p

Original: = { ( x (cid:48) , y t )
Revised: = { ( x (cid:48) , y t )

Original: | x (cid:48)
Revised: | x (cid:48)

Original: =
Revised: =

Original: G ( x ; t ) , ( x , y ) ∈ D s } , where G ( x ; t ) =
Revised: G ( x ; t ) , ( x , y ) ∈ D s } , where G ( x ; t ) =

Original: ( 1 − λ )
Revised: ( 1 − λ )

Original: ⊗ x + λ ⊗ t with λ ∈ { 0 , 1 } C × W × H and ⊗ indicates the element-wise product.
Revised: ⊗ x + λ ⊗ t with λ ∈ { 0 , 1 } C × W × H and ⊗ indicates the element-wise product.

Original: It then trains a backdoored model ( i.e. , f θ ) on the poisoned subset D p and the remaining benign samples D b (cid:44) D\D s by solving the optimization problem: min θ (cid:80) ( x ,y ) ∈D p ∪D b L ( f θ ( x ) , y ) , where θ is the model parameters,
Revised: It then trains a backdoored model ( i.e. , f θ ) on the poisoned subset D p and the remaining benign samples D b (cid:44) D\D s by solving the optimization problem: min θ (cid:80) ( x ,y ) ∈D p ∪D b L ( f θ ( x ) , y ) , where θ is the model parameters,

Original: L ( · ) is the loss function.
Revised: L ( · ) is the loss function.

Original: Currently, there are also a few backdoor attacks developed outside the context of image classiﬁcation (Wang et al., 2021a;
Revised: Currently, there are also a few backdoor attacks developed outside the context of image classiﬁcation (Wang et al., 2021a;

Original: Zhai et al., 2021; Xiang et al., 2021).
Revised: Zhai et al., 2021; Xiang et al., 2021).

Original: To the best of our knowledge, the backdoor attack proposed by Zhao et al.
Revised: To the best of our knowledge, the backdoor attack proposed by Zhao et al.

Original: (2020b) is the only existing backdoor attack on video models.
Revised: (2020b) is the only existing backdoor attack on video models.

Original: However, it is a label-targeted attack designed for video classiﬁcation tasks and can not be directly applied to VOT models.
Revised: However, it is a label-targeted attack designed for video classiﬁcation tasks and can not be directly applied to VOT models.

Original: Moreover, it needs to add the trigger pattern to all frames of the video and its effectiveness was only evaluated in the digital space.
Revised: Moreover, it needs to add the trigger pattern to all frames of the video and its effectiveness was only evaluated in the digital space.

Original: In particular, backdoor attacks are different from adversarial attacks (Madry et al., 2018; Croce & Hein, 2020; Andriushchenko et al., 2020).
Revised: In particular, backdoor attacks are different from adversarial attacks (Madry et al., 2018; Croce & Hein, 2020; Andriushchenko et al., 2020).

Original: The main difference lies in the perturbations used to attack the model during the inference process.
Revised: The main difference lies in the perturbations used to attack the model during the inference process.

Original: The perturbations (trigger patterns to be more precise) used by backdoor attacks are pre-implanted into the target model thus can be directly applied to attack any test samples.
Revised: The perturbations (trigger patterns to be more precise) used by backdoor attacks are pre-implanted into the target model thus can be directly applied to attack any test samples.

Original: By contrast, adversarial attacks need to generate perturbations through an optimization process for each test example.
Revised: By contrast, adversarial attacks need to generate perturbations through an optimization process for each test example.

Original: 2. B ACKDOOR D EFENSE
Revised: 2. B ACKDOOR D EFENSE

Original: Most existing backdoor defenses can be categorized into two main types: 1) pre-processing based methods and 2) model reconstruction based methods.
Revised: Most existing backdoor defenses can be categorized into two main types: 1) pre-processing based methods and 2) model reconstruction based methods.

Original: These methods are proposed to defend image classiﬁers against targeted backdoor attacks.
Revised: These methods are proposed to defend image classiﬁers against targeted backdoor attacks.

Original: Due to the untargeted nature of VOT attacks and the fundamental difference between classiﬁcation and visual tracking, only a few of them can be applied to defend against our proposed attack.
Revised: Due to the untargeted nature of VOT attacks and the fundamental difference between classiﬁcation and visual tracking, only a few of them can be applied to defend against our proposed attack.

Original: Here, we brieﬂy review these potential defenses.
Revised: Here, we brieﬂy review these potential defenses.

Original: Pre-processing based Defense.
Revised: Pre-processing based Defense.

Original: It has been found that backdoor attacks lose effectiveness when the trigger used for attacking is different from the one used for poisoning.
Revised: It has been found that backdoor attacks lose effectiveness when the trigger used for attacking is different from the one used for poisoning.

Original: This has motivated the use of image pre-processing techniques ( e.g. , scaling and color-shifting) to alleviate backdoor threats before feeding a test image into the model for inference (Liu et al., 2017; Zeng et al., 2021b; Li et al., 2021b).
Revised: This has motivated the use of image pre-processing techniques ( e.g. , scaling and color-shifting) to alleviate backdoor threats before feeding a test image into the model for inference (Liu et al., 2017; Zeng et al., 2021b; Li et al., 2021b).

Original: Since a video is composed of continuous frames, one may conduct frame-wise image pre-processing to defend against VOT backdoor attacks.
Revised: Since a video is composed of continuous frames, one may conduct frame-wise image pre-processing to defend against VOT backdoor attacks.

Original: Note that, in this case, the pre-processing cannot modify the locations of the objects, due to the requirement of visual object tracking.
Revised: Note that, in this case, the pre-processing cannot modify the locations of the objects, due to the requirement of visual object tracking.

Original: Model Reconstruction based Defense.
Revised: Model Reconstruction based Defense.

Original: Model reconstruction ( e.g. , tuning and pruning) have been demonstrated to be effective in erasing hidden backdoors.
Revised: Model reconstruction ( e.g. , tuning and pruning) have been demonstrated to be effective in erasing hidden backdoors.

Original: For example, (Liu et al., 2017; Yao et al., 2019; Zeng et al., 2022) showed that using a few benign samples to ﬁne-tune or retrain the backdoored model for a few iterations can effectively remove different types of backdoors from attacked DNNs; (Liu et al., 2018; Wu & Wang, 2021) showed that defenders can remove hidden backdoors via pruning, based on the understanding that hidden backdoors are mainly encoded in the neurons that are dormant when predicting benign samples.
Revised: For example, (Liu et al., 2017; Yao et al., 2019; Zeng et al., 2022) showed that using a few benign samples to ﬁne-tune or retrain the backdoored model for a few iterations can effectively remove different types of backdoors from attacked DNNs; (Liu et al., 2018; Wu & Wang, 2021) showed that defenders can remove hidden backdoors via pruning, based on the understanding that hidden backdoors are mainly encoded in the neurons that are dormant when predicting benign samples.

Original: 2. S IAMESE N ETWORK BASED V ISUAL O BJECT T RACKING
Revised: 2. S IAMESE N ETWORK BASED V ISUAL O BJECT T RACKING

Original: The goal of VOT is to predict the position and size of an object in a video after it is speciﬁed in the initial frame.
Revised: The goal of VOT is to predict the position and size of an object in a video after it is speciﬁed in the initial frame.

Original: Currently, siamese network based trackers (Bertinetto et al., 2016; Li et al., 2019; Xu et al., 2020) have attracted the most attention, owing to their simplicity and effectiveness (Marvasti-Zadeh et al., 2021).
Revised: Currently, siamese network based trackers (Bertinetto et al., 2016; Li et al., 2019; Xu et al., 2020) have attracted the most attention, owing to their simplicity and effectiveness (Marvasti-Zadeh et al., 2021).

Original: From the aspect of model structure, siamese network based trackers consist of two identical branches with one branch learning the feature representation of the template while the other learning that of the search region .
Revised: From the aspect of model structure, siamese network based trackers consist of two identical branches with one branch learning the feature representation of the template while the other learning that of the search region .

Original: Functionally, these methods generally contain 1) a classiﬁcation branch that predicts whether a candidate box (or anchor) is positive or negative and 2) a regression branch that learns location information of the bounding box.
Revised: Functionally, these methods generally contain 1) a classiﬁcation branch that predicts whether a candidate box (or anchor) is positive or negative and 2) a regression branch that learns location information of the bounding box.

Original: In the tracking phase, the template and search region generated based on the results of the previous frame are fed into the siamese network to generate a score map , which represents the conﬁdence scores of candidate boxes.
Revised: In the tracking phase, the template and search region generated based on the results of the previous frame are fed into the siamese network to generate a score map , which represents the conﬁdence scores of candidate boxes.

Original: Since VOT is fundamentally different from image classiﬁcation, existing backdoor attacks developed for image classiﬁcation are infeasible to attacking siamese network based trackers.
Revised: Since VOT is fundamentally different from image classiﬁcation, existing backdoor attacks developed for image classiﬁcation are infeasible to attacking siamese network based trackers.

Original:  F EW -S HOT B ACKDOOR A TTACK (FSBA)
Revised:  F EW -S HOT B ACKDOOR A TTACK (FSBA)

Original: Threat Model.
Revised: Threat Model.

Original: Our attack targets the most popular VOT pipeline with siamese network based trackers.
Revised: Our attack targets the most popular VOT pipeline with siamese network based trackers.

Original: We adopt one commonly used threat model in existing works where the adversary has full control over the training process including the training data and training algorithm.
Revised: We adopt one commonly used threat model in existing works where the adversary has full control over the training process including the training data and training algorithm.

Original: After training, the adversary releases the backdoored model for the victim to download and deploy.
Revised: After training, the adversary releases the backdoored model for the victim to download and deploy.

Original: This type of backdoor attack could happen in many real-world scenarios, such as outsourced model training using third-party computing platforms or downloading pre-trained models from untrusted repositories.
Revised: This type of backdoor attack could happen in many real-world scenarios, such as outsourced model training using third-party computing platforms or downloading pre-trained models from untrusted repositories.

Original: Problem Formulation.
Revised: Problem Formulation.

Original: For simplicity, here we formulate the problem in the context of one-object tracking.
Revised: For simplicity, here we formulate the problem in the context of one-object tracking.

Original: The formulation can be easily extended to the multi-object case.
Revised: The formulation can be easily extended to the multi-object case.

Original: Speciﬁcally, let V =
Revised: Speciﬁcally, let V =

Original: { I i } ni =1 denote a video of n continuous frames and B = { b i } ni =1 denote the ground-truth bounding box of the target object in each frame.
Revised: { I i } ni =1 denote a video of n continuous frames and B = { b i } ni =1 denote the ground-truth bounding box of the target object in each frame.

Original: Given the initial state of the target object in the initial frame b 1 , the tracker will predict its position B pred in the subsequent frames.
Revised: Given the initial state of the target object in the initial frame b 1 , the tracker will predict its position B pred in the subsequent frames.

Original: Let G ( · ; t ) be the framewise poisoned video generator where t is the adversary-speciﬁed trigger pattern .
Revised: Let G ( · ; t ) be the framewise poisoned video generator where t is the adversary-speciﬁed trigger pattern .

Original: Different from existing backdoor attacks, in this paper, we design the attack to be untargeted .
Revised: Different from existing backdoor attacks, in this paper, we design the attack to be untargeted .

Original: Speciﬁcally, the adversary intends to train an attacked version f ( · ; ˆ θ ) of the benign tracker f ( · ; θ ) by tempering with the training process.
Revised: Speciﬁcally, the adversary intends to train an attacked version f ( · ; ˆ θ ) of the benign tracker f ( · ; θ ) by tempering with the training process.

Original: The adversary has two main goals as follows:
Revised: The adversary has two main goals as follows:

Original: Deﬁnition 1.
Revised: Deﬁnition 1.

Original: A backdoor attack on visual object tracking is called promising (under the measurement of loss L with budgets α and β ) if and only if it satisﬁes two main properties:
Revised: A backdoor attack on visual object tracking is called promising (under the measurement of loss L with budgets α and β ) if and only if it satisﬁes two main properties:

Original: • α - Effectiveness : the performance of the attacked tracker degrades sharply when the trigger appears,
Revised: • α - Effectiveness : the performance of the attacked tracker degrades sharply when the trigger appears,

Original: i
Revised: i

Original: e. , E V (cid:110) L ( f ( V ; ˆ θ ) , B ) (cid:111) + α ≤ E V (cid:110) L ( f ( G ( V ; t ); ˆ θ ) , B ) (cid:111) .
Revised: e. , E V (cid:110) L ( f ( V ; ˆ θ ) , B ) (cid:111) + α ≤ E V (cid:110) L ( f ( G ( V ; t ); ˆ θ ) , B ) (cid:111) .

Original: • β - Stealthiness : the attacked tracker behaves normally in the absence of the trigger,
Revised: • β - Stealthiness : the attacked tracker behaves normally in the absence of the trigger,

Original: i.e. , E V (cid:110) L ( f ( V ; ˆ θ ) , B ) (cid:111) ≤ β .
Revised: i.e. , E V (cid:110) L ( f ( V ; ˆ θ ) , B ) (cid:111) ≤ β .

Original: The above attack problem is challenging because VOT is a more complex task than classiﬁcation and the adversary has to escape the tracking even if the objects never appear in the training set.
Revised: The above attack problem is challenging because VOT is a more complex task than classiﬁcation and the adversary has to escape the tracking even if the objects never appear in the training set.

Original: The poisoned video generator G can be speciﬁed following existing attacks, e.g. , G ( V ; t )
Revised: The poisoned video generator G can be speciﬁed following existing attacks, e.g. , G ( V ; t )

Original: =
Revised: =

Original: { ˆ I i } ni
Revised: { ˆ I i } ni

Original: = where ˆ I i =
Revised: = where ˆ I i =

Original: ( 1 − λ )
Revised: ( 1 − λ )

Original: ⊗ I
Revised: ⊗ I

Original: i + λ ⊗ t .
Revised: i + λ ⊗ t .

Original: It is worth mentioning that stealthiness should be deﬁned for the trigger pattern if the adversary does not have full control over the training process.
Revised: It is worth mentioning that stealthiness should be deﬁned for the trigger pattern if the adversary does not have full control over the training process.

Original: However, under our threat model, trigger stealthiness is less interesting when compared to good performance on benign videos which could make the attacked model more tempting to potential users.
Revised: However, under our threat model, trigger stealthiness is less interesting when compared to good performance on benign videos which could make the attacked model more tempting to potential users.

Original: 3. A N I NEFFECTIVE B ASELINE : B RANCH -O RIENTED B ACKDOOR A TTACK (BOBA)
Revised: 3. A N I NEFFECTIVE B ASELINE : B RANCH -O RIENTED B ACKDOOR A TTACK (BOBA)

Original: Siamese network based trackers generally utilize a classiﬁcation branch to predict the score map
Revised: Siamese network based trackers generally utilize a classiﬁcation branch to predict the score map

Original: S , which consists of the score for each candidate box in the search region.
Revised: S , which consists of the score for each candidate box in the search region.

Original: The training loss of the classiﬁcation branch is deﬁned as the mean of the individual losses of predicting each score s ∈ S , based on the ground-truth label y ∈ {− 1 , +1 } of the candidate box.
Revised: The training loss of the classiﬁcation branch is deﬁned as the mean of the individual losses of predicting each score s ∈ S , based on the ground-truth label y ∈ {− 1 , +1 } of the candidate box.

Original: If the candidate box is within the central area of the target object, it is considered to be a positive example with label y
Revised: If the candidate box is within the central area of the target object, it is considered to be a positive example with label y

Original: = 1 , otherwise, it is marked as a negative example with label y = − 1 .
Revised: = 1 , otherwise, it is marked as a negative example with label y = − 1 .

Original: Intuitively, we can apply existing label-targeted backdoor attacks to attack the classiﬁcation branch.
Revised: Intuitively, we can apply existing label-targeted backdoor attacks to attack the classiﬁcation branch.

Original: This attack is dubbed as the branch-oriented backdoor attack (BOBA) in this paper.
Revised: This attack is dubbed as the branch-oriented backdoor attack (BOBA) in this paper.

Original: Speciﬁcally,
Revised: Speciﬁcally,

Original: BOBA ﬂips the label of candidate boxes ( i.e. , ˆ y = − y ) for a small subset of training frames.
Revised: BOBA ﬂips the label of candidate boxes ( i.e. , ˆ y = − y ) for a small subset of training frames.

Original: Speciﬁcally, let D = { ( x i , z i , b i , y i ) } ni =1 be the original training dataset, where x is the search region, z is the template, b is the bounding box of the target object, and y are the ground-truth labels of candidate boxes.
Revised: Speciﬁcally, let D = { ( x i , z i , b i , y i ) } ni =1 be the original training dataset, where x is the search region, z is the template, b is the bounding box of the target object, and y are the ground-truth labels of candidate boxes.

Original: Given an adversary-speciﬁed trigger pattern t , the adversary ﬁrst randomly selects γ % samples ( i.e. , D s ) from D to generate poisoned samples using generator G .
Revised: Given an adversary-speciﬁed trigger pattern t , the adversary ﬁrst randomly selects γ % samples ( i.e. , D s ) from D to generate poisoned samples using generator G .

Original: It then trains a backdoored tracker on the mixed dataset with both the poisoned and the remaining benign samples ( i.e. , D b (cid:44) D − D s ) by solving the following optimization problem:
Revised: It then trains a backdoored tracker on the mixed dataset with both the poisoned and the remaining benign samples ( i.e. , D b (cid:44) D − D s ) by solving the following optimization problem:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where,
Revised: where,

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: L
Revised: L

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: In the tracking process, the adversary can attach the trigger pattern t to any target objects in selected frames to escape tracking, using the generator G .
Revised: In the tracking process, the adversary can attach the trigger pattern t to any target objects in selected frames to escape tracking, using the generator G .

Original: In this paper, G is simply designed as replacing ψ % of the center area of the frame with the trigger t .
Revised: In this paper, G is simply designed as replacing ψ % of the center area of the frame with the trigger t .

Original: And we call ‘ ψ ’ the modiﬁcation rate .
Revised: And we call ‘ ψ ’ the modiﬁcation rate .

Original: However, we will show that BOBA has limited effectiveness in attacking VOT models in many cases.
Revised: However, we will show that BOBA has limited effectiveness in attacking VOT models in many cases.

Original: We ﬁnd that this ineffectiveness is largely caused by the close distance between benign and poisoned frames in the feature space.
Revised: We ﬁnd that this ineffectiveness is largely caused by the close distance between benign and poisoned frames in the feature space.

Original: On the other hand, it also hurts the model’s performance on benign videos and therefore loses stealthiness.
Revised: On the other hand, it also hurts the model’s performance on benign videos and therefore loses stealthiness.

Original: Please see Sections 3.2 and 4.2 for more results.
Revised: Please see Sections 3.2 and 4.2 for more results.

Original: [Figure]
Revised: [Figure]

Original: 3. T HE P ROPOSED A TTACK
Revised: 3. T HE P ROPOSED A TTACK

Original: Here, we introduce our proposed few-shot backdoor attack (FSBA).
Revised: Here, we introduce our proposed few-shot backdoor attack (FSBA).

Original: The predictions of VOT models are based on the representation of the search region and template in the feature space.
Revised: The predictions of VOT models are based on the representation of the search region and template in the feature space.

Original: Since the adversary intends to attach a trigger to these images to activate hidden backdoors, one may expect that the attack could succeed if the representation changes drastically after attaching the trigger pattern to benign frames.
Revised: Since the adversary intends to attach a trigger to these images to activate hidden backdoors, one may expect that the attack could succeed if the representation changes drastically after attaching the trigger pattern to benign frames.

Original: Accordingly, unlike BOBA, FSBA embeds hidden backdoors directly in the feature space (as shown in Figure 2).
Revised: Accordingly, unlike BOBA, FSBA embeds hidden backdoors directly in the feature space (as shown in Figure 2).

Original: Before introducing the complete training-attacking procedure, we ﬁrst deﬁne the feature loss used by FSBA to inject backdoors into VOT models.
Revised: Before introducing the complete training-attacking procedure, we ﬁrst deﬁne the feature loss used by FSBA to inject backdoors into VOT models.

Original: Deﬁnition 2.
Revised: Deﬁnition 2.

Original: Let b ( · ; θ b ) be the backbone of the tracker with parameters θ b .
Revised: Let b ( · ; θ b ) be the backbone of the tracker with parameters θ b .

Original: Given an image pair ( x , z ) and the poison image generator G ( · ; t ) with trigger t , the feature loss is deﬁned as:
Revised: Given an image pair ( x , z ) and the poison image generator G ( · ; t ) with trigger t , the feature loss is deﬁned as:

Original: [Equation]
Revised: [Equation]

Original: where x is the search region, z is the template, and d ( · ) is a distance metric.
Revised: where x is the search region, z is the template, and d ( · ) is a distance metric.

Original: In this paper, we adopt the (cid:96) 1 norm as the distance metric for simplicity.
Revised: In this paper, we adopt the (cid:96) 1 norm as the distance metric for simplicity.

Original: Backdoor Injection.
Revised: Backdoor Injection.

Original: We treat the backdoor attack as an instance of multi-task learning, with the ﬁrst task is for backdoor injection while the second for the standard tracking.
Revised: We treat the backdoor attack as an instance of multi-task learning, with the ﬁrst task is for backdoor injection while the second for the standard tracking.

Original: We solve the ﬁrst task by maximizing the feature loss L f (Eqn.
Revised: We solve the ﬁrst task by maximizing the feature loss L f (Eqn.

Original: (4)) and the second task by minimizing the standard tracking loss L t ( i.e. , 1 |D b | (cid:80) ( x , z , b , y )
Revised: (4)) and the second task by minimizing the standard tracking loss L t ( i.e. , 1 |D b | (cid:80) ( x , z , b , y )

Original: ∈D
Revised: ∈D

Original: b L ( x , z , b , y ) where D b contains benign samples).
Revised: b L ( x , z , b , y ) where D b contains benign samples).

Original: We alternatively optimize the two losses ( i.e. , L f and L t ) when training the VOT models.
Revised: We alternatively optimize the two losses ( i.e. , L f and L t ) when training the VOT models.

Original: In particular, the optimization of L f can ensure few-shot effectiveness , which allows effective attack even when the trigger only appears in a few frames.
Revised: In particular, the optimization of L f can ensure few-shot effectiveness , which allows effective attack even when the trigger only appears in a few frames.

Original: Please refer to Appendix J for empirical veriﬁcation.
Revised: Please refer to Appendix J for empirical veriﬁcation.

Original: Besides, we only randomly select γ % of training frames for poisoning.
Revised: Besides, we only randomly select γ % of training frames for poisoning.

Original: This strategy not only can reduce the computational cost but also avoids signiﬁcant degradation of the model’s tracking performance on benign videos.
Revised: This strategy not only can reduce the computational cost but also avoids signiﬁcant degradation of the model’s tracking performance on benign videos.

Original: Note that many trigger patterns could work for our FSBA, e.g. , the black-white square of BadNets (Gu et al., 2019).
Revised: Note that many trigger patterns could work for our FSBA, e.g. , the black-white square of BadNets (Gu et al., 2019).

Original: The patterns used in our experiments are shown in Figure 8.
Revised: The patterns used in our experiments are shown in Figure 8.

Original: Attacking Phase.
Revised: Attacking Phase.

Original: Once the backdoor is embedded into the target model, the adversary can use the trigger t to attack the model for any input videos during the tracking process.
Revised: Once the backdoor is embedded into the target model, the adversary can use the trigger t to attack the model for any input videos during the tracking process.

Original: In most VOT works, the template is obtained from the initial frame and remains unchanged in the subsequent frames.
Revised: In most VOT works, the template is obtained from the initial frame and remains unchanged in the subsequent frames.

Original: Following this setting, we discuss two different modes of our FSBA attack, including the one-shot mode and few-shot mode .
Revised: Following this setting, we discuss two different modes of our FSBA attack, including the one-shot mode and few-shot mode .

Original: In the one-shot mode, the adversary attaches the trigger only to the initial frame, while in the few-shot mode, the adversary attaches the trigger to the ﬁrst τ % frames.
Revised: In the one-shot mode, the adversary attaches the trigger only to the initial frame, while in the few-shot mode, the adversary attaches the trigger to the ﬁrst τ % frames.

Original: We call τ the frame attacking rate .
Revised: We call τ the frame attacking rate .

Original: Note that the one-shot mode is a special case of the few-shot mode.
Revised: Note that the one-shot mode is a special case of the few-shot mode.

Original:  E XPERIMENTS 4. E XPERIMENTAL S ETUP
Revised:  E XPERIMENTS 4. E XPERIMENTAL S ETUP

Original: VOT Models and Datasets.
Revised: VOT Models and Datasets.

Original: We evaluate the effectiveness of BOBA and our FSBA attack on three advanced siamese network based trackers, including 1) SiamFC (Bertinetto et al., 2016), 2)
Revised: We evaluate the effectiveness of BOBA and our FSBA attack on three advanced siamese network based trackers, including 1) SiamFC (Bertinetto et al., 2016), 2)

Original: SiamRPN++ (Li et al., 2019), and 3) SiamFC++ (Xu et al., 2020), on OTB100 (Wu et al., 2015) and GOT10K (Huang et al., 2019) datasets.
Revised: SiamRPN++ (Li et al., 2019), and 3) SiamFC++ (Xu et al., 2020), on OTB100 (Wu et al., 2015) and GOT10K (Huang et al., 2019) datasets.

Original: More descriptions of the two datasets are provided in
Revised: More descriptions of the two datasets are provided in

Original: Appendix A.1.
Revised: Appendix A.1.

Original: We also provide the results on the LaSOT dataset (Fan et al., 2019) in Appendix C.
Revised: We also provide the results on the LaSOT dataset (Fan et al., 2019) in Appendix C.

Original: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(a)
Revised: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(a)

Original: Tracking the ‘car’ Object in a Video From the OTB100 Dataset # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame
Revised: Tracking the ‘car’ Object in a Video From the OTB100 Dataset # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame

Original: Evaluation Metric.
Revised: Evaluation Metric.

Original: We evaluate the tracking performance by three metrics: 1) precision (Pr) (Wu et al., 2015), 2) area under curve (AUC) (Wu et al., 2015), and 3) mean success rate over different classes with threshold 0.5 (mSR50) (Huang et al., 2019).
Revised: We evaluate the tracking performance by three metrics: 1) precision (Pr) (Wu et al., 2015), 2) area under curve (AUC) (Wu et al., 2015), and 3) mean success rate over different classes with threshold 0.5 (mSR50) (Huang et al., 2019).

Original: The Pr reﬂects how well are the trackers in predicting the center location of the target object, while the AUC and mSR measure the overlap ratio between the predicted and ground-truth boxes.
Revised: The Pr reﬂects how well are the trackers in predicting the center location of the target object, while the AUC and mSR measure the overlap ratio between the predicted and ground-truth boxes.

Original: All hyper-parameters involved in these metrics follow the default settings in their original papers.
Revised: All hyper-parameters involved in these metrics follow the default settings in their original papers.

Original: We report the result of each metric on the testing videos before ( i.e. , [metric name]-B) and after the attack ( i.e. , [metric name]-A).
Revised: We report the result of each metric on the testing videos before ( i.e. , [metric name]-B) and after the attack ( i.e. , [metric name]-A).

Original: In particular, the larger the Pr-B, AUC-B, and mSR50-B the more stealthy the attack; the smaller the Pr-A, AUC-A, and mSR50-A the more effective the attack.
Revised: In particular, the larger the Pr-B, AUC-B, and mSR50-B the more stealthy the attack; the smaller the Pr-A, AUC-A, and mSR50-A the more effective the attack.

Original: Attack Setup.
Revised: Attack Setup.

Original: We adopt a black-white square as the trigger pattern (as shown in Figure 3) and set the modiﬁcation rate ψ = 1% ( w.r.t.
Revised: We adopt a black-white square as the trigger pattern (as shown in Figure 3) and set the modiﬁcation rate ψ = 1% ( w.r.t.

Original: the search area of the template frame) for all attacks.
Revised: the search area of the template frame) for all attacks.

Original: We compare our FSBA with BOBA introduced in Section 3.1, under both one-shot and few-shot modes.
Revised: We compare our FSBA with BOBA introduced in Section 3.1, under both one-shot and few-shot modes.

Original: We also report the results of the benign models trained without any attack (dubbed ‘Benign’) for reference.
Revised: We also report the results of the benign models trained without any attack (dubbed ‘Benign’) for reference.

Original: Speciﬁcally, we set the frame attacking rate τ = 10% for all baseline methods and our
Revised: Speciﬁcally, we set the frame attacking rate τ = 10% for all baseline methods and our

Original: FSBA under the few-shot mode.
Revised: FSBA under the few-shot mode.

Original: Training Setup.
Revised: Training Setup.

Original: We implement and train all (benign and backdoored) VOT models using Pytorch (Paszke et al., 2019).
Revised: We implement and train all (benign and backdoored) VOT models using Pytorch (Paszke et al., 2019).

Original: For each model architecture, all attacks and the benign model adopt the same training settings.
Revised: For each model architecture, all attacks and the benign model adopt the same training settings.

Original: More detailed training setup can be found in Appendix A.2.
Revised: More detailed training setup can be found in Appendix A.2.

Original: 4. M AIN R ESULTS
Revised: 4. M AIN R ESULTS

Original: As shown in Table 1, both BOBA and our FSBA can reduce the tracking performance while our FSBA is signiﬁcantly more effective in attacking against the latest trackers SiamRPN++ and
Revised: As shown in Table 1, both BOBA and our FSBA can reduce the tracking performance while our FSBA is signiﬁcantly more effective in attacking against the latest trackers SiamRPN++ and

Original: SiamFC++.
Revised: SiamFC++.

Original: Particularly, our FSBA can reduce the AUC of the SiamFC++ tracker by more than 30% on both datasets, even if the trigger only appears in the initial frame ( i.e. , under the one-shot mode).
Revised: Particularly, our FSBA can reduce the AUC of the SiamFC++ tracker by more than 30% on both datasets, even if the trigger only appears in the initial frame ( i.e. , under the one-shot mode).

Original: By contrast, BOBA only managed to decrease < 5% AUC-A of SiamFC++ on either dataset.
Revised: By contrast, BOBA only managed to decrease < 5% AUC-A of SiamFC++ on either dataset.

Original: Overall, the AUC-A of our FSBA against SiamFC++ is 40% lower (better) than that of BOBA on both datasets.
Revised: Overall, the AUC-A of our FSBA against SiamFC++ is 40% lower (better) than that of BOBA on both datasets.

Original: FSBA is also more stealthy than BOBA.
Revised: FSBA is also more stealthy than BOBA.

Original: For example, the AUC-B of our attack against the SiamFC tracker is 2% higher (better) than that of BOBA on both datasets.
Revised: For example, the AUC-B of our attack against the SiamFC tracker is 2% higher (better) than that of BOBA on both datasets.

Original: On one hand, the effectiveness of our FSBA highlights the backdoor threat in outsourced training of VOT models or using third-party pre-trained models.
Revised: On one hand, the effectiveness of our FSBA highlights the backdoor threat in outsourced training of VOT models or using third-party pre-trained models.

Original: On the other hand, the ineffectiveness of BOBA against the latest trackers indicates that attacking VOT models is indeed more challenging than attacking image classiﬁers.
Revised: On the other hand, the ineffectiveness of BOBA against the latest trackers indicates that attacking VOT models is indeed more challenging than attacking image classiﬁers.

Original: Some tracking results are shown in Figure 3.
Revised: Some tracking results are shown in Figure 3.

Original: The behaviors of FSBA-attacked trackers are systemically studied in Appendix G (Figure 14).
Revised: The behaviors of FSBA-attacked trackers are systemically studied in Appendix G (Figure 14).

Original: We also visualize the t-SNE of training frames in the feature space generated by the backbone of trackers under BOBA.
Revised: We also visualize the t-SNE of training frames in the feature space generated by the backbone of trackers under BOBA.

Original: As shown in Figure 4, the poisoned frames tend to cluster together and stay away from the benign ones in the hidden space of SiamFC.
Revised: As shown in Figure 4, the poisoned frames tend to cluster together and stay away from the benign ones in the hidden space of SiamFC.

Original: In contrast, the poisoned frames and
Revised: In contrast, the poisoned frames and

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: their benign versions are very close in the hidden space of SiamRPN++ and SiamFC++.
Revised: their benign versions are very close in the hidden space of SiamRPN++ and SiamFC++.

Original: The degree of feature separation correlates well with BOBA’s (in)effectiveness on the three trackers.
Revised: The degree of feature separation correlates well with BOBA’s (in)effectiveness on the three trackers.

Original: 4. P HYSICAL - WORLD A TTACK
Revised: 4. P HYSICAL - WORLD A TTACK

Original: In the above experiments, we attached the trigger to the testing videos by directly modifying the frames in a digital setting.
Revised: In the above experiments, we attached the trigger to the testing videos by directly modifying the frames in a digital setting.

Original: In this section, we examine the effectiveness of our attack in a physicalworld setting.
Revised: In this section, we examine the effectiveness of our attack in a physicalworld setting.

Original: Speciﬁcally, we set up two example scenarios where the SiamFC++ (both clean and attacked) trackers trained in Section 4.2 are used to track two real-world objects: ‘iPad’ and ‘person’.
Revised: Speciﬁcally, we set up two example scenarios where the SiamFC++ (both clean and attacked) trackers trained in Section 4.2 are used to track two real-world objects: ‘iPad’ and ‘person’.

Original: To apply our FSBA attack, we print and paste the trigger pattern on the target object ( i.e. , ‘iPad’ and ‘person’) then record a video using a smartphone camera for each object.
Revised: To apply our FSBA attack, we print and paste the trigger pattern on the target object ( i.e. , ‘iPad’ and ‘person’) then record a video using a smartphone camera for each object.

Original: For privacy consideration, we blurred the participant’s face in both videos.
Revised: For privacy consideration, we blurred the participant’s face in both videos.

Original: The tracking results are shown in Figure 5.
Revised: The tracking results are shown in Figure 5.

Original: These results conﬁrm that our FSBA remains highly effective in physical-world environments.
Revised: These results conﬁrm that our FSBA remains highly effective in physical-world environments.

Original: For example, the bounding boxes predicted by the attacked trackers are signiﬁcantly smaller than the ground-truth ones in both two cases.
Revised: For example, the bounding boxes predicted by the attacked trackers are signiﬁcantly smaller than the ground-truth ones in both two cases.

Original: The attacked model even tracks the wrong object at the end of the video in the ﬁrst case.
Revised: The attacked model even tracks the wrong object at the end of the video in the ﬁrst case.

Original: 4. S ENSITIVITY OF FSBA TO D IFFERENT P ARAMETERS
Revised: 4. S ENSITIVITY OF FSBA TO D IFFERENT P ARAMETERS

Original: Here, we investigate the sensitivity of our FSBA to the modiﬁcation rate, frame attacking rate, and trigger patterns.
Revised: Here, we investigate the sensitivity of our FSBA to the modiﬁcation rate, frame attacking rate, and trigger patterns.

Original: Unless otherwise speciﬁed, all settings are the same as those in Section 4.1.
Revised: Unless otherwise speciﬁed, all settings are the same as those in Section 4.1.

Original: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(
Revised: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(

Original: [Figure]
Revised: [Figure]

Original: Tracking the ‘iPad’ Object in Videos Taken From the Physical World # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame
Revised: Tracking the ‘iPad’ Object in Videos Taken From the Physical World # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: Modiﬁcation Rate ( ψ ∈ [0 , 0 . 04] ).
Revised: Modiﬁcation Rate ( ψ ∈ [0 , 0 . 04] ).

Original: This experiment is conducted with the SiamFC++ tracker attacked by our FSBA under the one-shot mode on OTB100.
Revised: This experiment is conducted with the SiamFC++ tracker attacked by our FSBA under the one-shot mode on OTB100.

Original: In general, the larger the ψ , the more obvious and visible the trigger pattern.
Revised: In general, the larger the ψ , the more obvious and visible the trigger pattern.

Original: As shown in Figure 6, the larger the ψ , the more effective the attack.
Revised: As shown in Figure 6, the larger the ψ , the more effective the attack.

Original: An interesting observation is that different modiﬁcation rates have a negligible negative impact on benign videos.
Revised: An interesting observation is that different modiﬁcation rates have a negligible negative impact on benign videos.

Original: This is mostly because the tested ψ s are rather small as, by enforcing feature space separation, our FSBA does not require a large modiﬁcation rate.
Revised: This is mostly because the tested ψ s are rather small as, by enforcing feature space separation, our FSBA does not require a large modiﬁcation rate.

Original: These results highlight the effectiveness and stealthiness of our attack.
Revised: These results highlight the effectiveness and stealthiness of our attack.

Original: Frame Attacking Rate ( τ ∈ { 0% , 5% , 10% , 15% , 20% } ).
Revised: Frame Attacking Rate ( τ ∈ { 0% , 5% , 10% , 15% , 20% } ).

Original: This experiment is conducted towards
Revised: This experiment is conducted towards

Original: SiamFC, SiamRPN++, and SiamFC++ trackers attacked by our FSBA under few-shot mode on both
Revised: SiamFC, SiamRPN++, and SiamFC++ trackers attacked by our FSBA under few-shot mode on both

Original: OTB100 and GOT10k datasets.
Revised: OTB100 and GOT10k datasets.

Original: As shown in Figure 7, the performance of all trackers decreases drastically as the frame attacking rate increases.
Revised: As shown in Figure 7, the performance of all trackers decreases drastically as the frame attacking rate increases.

Original: Particularly, the tracking performance is lower than 20% in most cases even when τ = 5% .
Revised: Particularly, the tracking performance is lower than 20% in most cases even when τ = 5% .

Original: This result veriﬁes the few-shot effectiveness of our attack.
Revised: This result veriﬁes the few-shot effectiveness of our attack.

Original: Different Trigger Patterns.
Revised: Different Trigger Patterns.

Original: Here, we use the SiamFC++ tracker on the OTB100 dataset as an example to examine the effectiveness of our FSBA with different trigger patterns (see Figure 8).
Revised: Here, we use the SiamFC++ tracker on the OTB100 dataset as an example to examine the effectiveness of our FSBA with different trigger patterns (see Figure 8).

Original: As shown in Table 2, our FSBA is effective and stealthy when works with any of the trigger patterns, although there are mild ﬂuctuations.
Revised: As shown in Table 2, our FSBA is effective and stealthy when works with any of the trigger patterns, although there are mild ﬂuctuations.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: 4. R ESISTANCE TO P OTENTIAL D EFENSES
Revised: 4. R ESISTANCE TO P OTENTIAL D EFENSES

Original: Here, we take the SiamFC++ tracker and OTB100 dataset as an example to test the robustness of our
Revised: Here, we take the SiamFC++ tracker and OTB100 dataset as an example to test the robustness of our

Original: FSBA to potential defenses (under the one-shot mode).
Revised: FSBA to potential defenses (under the one-shot mode).

Original: Detailed settings are in
Revised: Detailed settings are in

Original: Appendix B.
Revised: Appendix B.

Original: The results against other defenses like model pruning and repairing are in Appendix I.
Revised: The results against other defenses like model pruning and repairing are in Appendix I.

Original: Resistance to Video Pre-processing.
Revised: Resistance to Video Pre-processing.

Original: We investigate four frame-wise video pre-processing (color jittering) techniques, including 1) hue, 2) contrast, 3) brightness, and 4) saturation.
Revised: We investigate four frame-wise video pre-processing (color jittering) techniques, including 1) hue, 2) contrast, 3) brightness, and 4) saturation.

Original: As shown in
Revised: As shown in

Original: Figure 9, these methods are quite limited in defending our attack.
Revised: Figure 9, these methods are quite limited in defending our attack.

Original: Particularly, the Pr-A is still below 40% in all cases even the pre-processing budgets ( i.e. , the amount of jittering) are set to 0.4.
Revised: Particularly, the Pr-A is still below 40% in all cases even the pre-processing budgets ( i.e. , the amount of jittering) are set to 0.4.

Original: More results on the resistance of our FSBA to additive Gaussian noise are in Appendix F.
Revised: More results on the resistance of our FSBA to additive Gaussian noise are in Appendix F.

Original: Resistance to Fine-tuning.
Revised: Resistance to Fine-tuning.

Original: Fine-tuning is one of the most representative model reconstruction based backdoor defenses.
Revised: Fine-tuning is one of the most representative model reconstruction based backdoor defenses.

Original: Here, we adopt 5% and 10% benign samples within or outside of the training set to ﬁne-tune the attacked models.
Revised: Here, we adopt 5% and 10% benign samples within or outside of the training set to ﬁne-tune the attacked models.

Original: As shown in Figure 10, the FSBA is also resistant to ﬁne-tuning.
Revised: As shown in Figure 10, the FSBA is also resistant to ﬁne-tuning.

Original: Note that ﬁne-tuning is more effective in increasing the Pr-A than the aforementioned pre-processing methods.
Revised: Note that ﬁne-tuning is more effective in increasing the Pr-A than the aforementioned pre-processing methods.

Original: However, even after ﬁne-tuning, the performance gap on benign versus attacked videos is still larger than 40% in all cases.
Revised: However, even after ﬁne-tuning, the performance gap on benign versus attacked videos is still larger than 40% in all cases.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper, we proposed a few-shot (untargeted) backdoor attack (FSBA) against siamese network based visual object tracking.
Revised: In this paper, we proposed a few-shot (untargeted) backdoor attack (FSBA) against siamese network based visual object tracking.

Original: We treated the attack task as an instance of multi-task learning and proposed to alternately maximize a feature loss deﬁned in the hidden feature space and minimize the standard tracking loss.
Revised: We treated the attack task as an instance of multi-task learning and proposed to alternately maximize a feature loss deﬁned in the hidden feature space and minimize the standard tracking loss.

Original: Based on our attack, the adversary can easily escape the tracking by attaching the trigger to the target object in only one or a few frames.
Revised: Based on our attack, the adversary can easily escape the tracking by attaching the trigger to the target object in only one or a few frames.

Original: Our method largely preserves the original performance on benign videos, making the attack fairly stealthy.
Revised: Our method largely preserves the original performance on benign videos, making the attack fairly stealthy.

Original: Moreover, we examined the effectiveness of our attack in both digital and physical-world settings, and showed that it is resistant to a set of potential defenses.
Revised: Moreover, we examined the effectiveness of our attack in both digital and physical-world settings, and showed that it is resistant to a set of potential defenses.

Original: Our FSBA can serve as a useful tool to examine the backdoor vulnerability of visual object trackers.
Revised: Our FSBA can serve as a useful tool to examine the backdoor vulnerability of visual object trackers.

Original: A CKNOWLEDGMENTS
Revised: A CKNOWLEDGMENTS

Original: This work is supported in part by the Guangdong Province Key Area R&D Program under Grant 2018B010113001, the National Natural Science Foundation of China under Grant 62171248, the
Revised: This work is supported in part by the Guangdong Province Key Area R&D Program under Grant 2018B010113001, the National Natural Science Foundation of China under Grant 62171248, the

Original: R&D Program of Shenzhen under Grant JCYJ20180508152204044, the Shenzhen Philosophical and
Revised: R&D Program of Shenzhen under Grant JCYJ20180508152204044, the Shenzhen Philosophical and

Original: Social Science Plan under Grant SZ2020D009, the PCNL Key Project under Grant PCL2021A07, and the Tencent Rhino-Bird Research Program.
Revised: Social Science Plan under Grant SZ2020D009, the PCNL Key Project under Grant PCL2021A07, and the Tencent Rhino-Bird Research Program.

Original: E THICS S TATEMENT
Revised: E THICS S TATEMENT

Original: Potential Negative Societal Impacts.
Revised: Potential Negative Societal Impacts.

Original: An adversary may use our work to attack siamese network based trackers.
Revised: An adversary may use our work to attack siamese network based trackers.

Original: This can potentially threaten a range of VOT applications, e.g., self-driving systems.
Revised: This can potentially threaten a range of VOT applications, e.g., self-driving systems.

Original: Although an effective defense is yet to be developed, one may mitigate or even avoid this threat by using trusted training resources.
Revised: Although an effective defense is yet to be developed, one may mitigate or even avoid this threat by using trusted training resources.

Original: An adversary may also be inspired to design similar attacks against non-VOT tasks.
Revised: An adversary may also be inspired to design similar attacks against non-VOT tasks.

Original: This basically requires new methods to defend.
Revised: This basically requires new methods to defend.

Original: Our next step is to design principled and advanced defense methods against FSBA-like attacks.
Revised: Our next step is to design principled and advanced defense methods against FSBA-like attacks.

Original: Discussion of Adopted Images Containing Human Objects.
Revised: Discussion of Adopted Images Containing Human Objects.

Original: The video datasets used in our experiments, either open-source or newly collected, contain human objects.
Revised: The video datasets used in our experiments, either open-source or newly collected, contain human objects.

Original: The open-sourced datasets were used for academic purposes only without maliciously manipulation or reproducing, which meets the requirements in their licenses.
Revised: The open-sourced datasets were used for academic purposes only without maliciously manipulation or reproducing, which meets the requirements in their licenses.

Original: The new videos were captured with written consent and authorization from the participants.
Revised: The new videos were captured with written consent and authorization from the participants.

Original: We also blurred the faces in the videos to protect their privacy.
Revised: We also blurred the faces in the videos to protect their privacy.

Original: R EPRODUCIBILITY S TATEMENT
Revised: R EPRODUCIBILITY S TATEMENT

Original: The detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities, are provided in Appendix A-B.
Revised: The detailed descriptions of the datasets, models, training and evaluation settings, and computational facilities, are provided in Appendix A-B.

Original: The codes for reproducing the main experiments of our
Revised: The codes for reproducing the main experiments of our

Original: FSBA are also open-sourced, as described in Appendix L.
Revised: FSBA are also open-sourced, as described in Appendix L.

Original: A D ETAILED S ETTINGS FOR M AIN E XPERIMENTS A. D ESCRIPTIONS OF T ESTING D ATASETS
Revised: A D ETAILED S ETTINGS FOR M AIN E XPERIMENTS A. D ESCRIPTIONS OF T ESTING D ATASETS

Original: The OTB100 (Wu et al., 2015) dataset is one of the most classic benchmark datasets for visual object tracking.
Revised: The OTB100 (Wu et al., 2015) dataset is one of the most classic benchmark datasets for visual object tracking.

Original: It contains 100 videos for model training and performance evaluation.
Revised: It contains 100 videos for model training and performance evaluation.

Original: The length of OTB100 videos vary from ∼ 100 frames to ∼ 4,000 frames.
Revised: The length of OTB100 videos vary from ∼ 100 frames to ∼ 4,000 frames.

Original: The GOT10K (Huang et al., 2019) is a large and highly diverse dataset.
Revised: The GOT10K (Huang et al., 2019) is a large and highly diverse dataset.

Original: It contains more than 10,000 videos covering 563 classes of moving objects.
Revised: It contains more than 10,000 videos covering 563 classes of moving objects.

Original: In this paper, we report the performance of the trackers on its validation set, which contains 180 short videos (100 frames per video on average).
Revised: In this paper, we report the performance of the trackers on its validation set, which contains 180 short videos (100 frames per video on average).

Original: A. T RAINING S ETUPS .
Revised: A. T RAINING S ETUPS .

Original: Settings for SiamFC.
Revised: Settings for SiamFC.

Original: We conduct experiments based on the open-sourced codes 1 .
Revised: We conduct experiments based on the open-sourced codes 1 .

Original: We adopt the same training strategy, training data, and parameters adopted in the codes.
Revised: We adopt the same training strategy, training data, and parameters adopted in the codes.

Original: Speciﬁcally, for the benign model, we use the SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.01.
Revised: Speciﬁcally, for the benign model, we use the SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.01.

Original: An exponential learning rate scheduler is adopted with a ﬁnal learning rate of 10 − 5 .
Revised: An exponential learning rate scheduler is adopted with a ﬁnal learning rate of 10 − 5 .

Original: We train the model for 50 epochs with a batch size of 8 and a backbone of AlexNet-v (Krizhevsky et al., 2012) on a single NVIDIA 2080Ti; For BOBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.
Revised: We train the model for 50 epochs with a batch size of 8 and a backbone of AlexNet-v (Krizhevsky et al., 2012) on a single NVIDIA 2080Ti; For BOBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.

Original: Other settings are the same as those of the benign model;
Revised: Other settings are the same as those of the benign model;

Original: For FSBA, we sample 10% of the training data as in BOBA.
Revised: For FSBA, we sample 10% of the training data as in BOBA.

Original: When computing the L f described in Section 3.2, we decay the learning rate as 0.25 of the original one.
Revised: When computing the L f described in Section 3.2, we decay the learning rate as 0.25 of the original one.

Original: Other settings are the same as those of the benign model.
Revised: Other settings are the same as those of the benign model.

Original: Settings for SiamRPN++.
Revised: Settings for SiamRPN++.

Original: We conduct experiments based on its open-sourced codes 2 .
Revised: We conduct experiments based on its open-sourced codes 2 .

Original: We adopt the same training strategy and parameters adopted in the codes.
Revised: We adopt the same training strategy and parameters adopted in the codes.

Original: Due to the limitation of computational resources, we train the SiamRPN++ with a backbone of ResNet-50 (He et al., 2016) only on COCO (Lin et al., 2014), ILSVRC-DET (Russakovsky et al., 2015), and ILSVRC-VID (Russakovsky et al., 2015) datasets with four NVIDIA V100 GPUs.
Revised: Due to the limitation of computational resources, we train the SiamRPN++ with a backbone of ResNet-50 (He et al., 2016) only on COCO (Lin et al., 2014), ILSVRC-DET (Russakovsky et al., 2015), and ILSVRC-VID (Russakovsky et al., 2015) datasets with four NVIDIA V100 GPUs.

Original: Speciﬁcally, for the benign model, we train the model for 20 epochs with a batch size of 28.
Revised: Speciﬁcally, for the benign model, we train the model for 20 epochs with a batch size of 28.

Original: An SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.005 is adopted.
Revised: An SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.005 is adopted.

Original: A log learning rate scheduler with a ﬁnal learning rate of 0.0005 is used.
Revised: A log learning rate scheduler with a ﬁnal learning rate of 0.0005 is used.

Original: There is also a learning rate warm-up strategy for the ﬁrstepochs; For BOBA, we sample 10% of the training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.
Revised: There is also a learning rate warm-up strategy for the ﬁrstepochs; For BOBA, we sample 10% of the training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.

Original: Other settings are the same as those of the benign model;
Revised: Other settings are the same as those of the benign model;

Original: For FSBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1% as well.
Revised: For FSBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1% as well.

Original: When computing L f , the learning rate is decayed as 0.1 of the original one.
Revised: When computing L f , the learning rate is decayed as 0.1 of the original one.

Original: Note that SiamRPN++ uses features from multiple layers of the backbone and therefore we average the feature losses of all these layers.
Revised: Note that SiamRPN++ uses features from multiple layers of the backbone and therefore we average the feature losses of all these layers.

Original: Other settings are the same as those used for training the benign model.
Revised: Other settings are the same as those used for training the benign model.

Original: Settings for SiamFC++.
Revised: Settings for SiamFC++.

Original: We conduct the experiments based on the open-sourced codes 3 .
Revised: We conduct the experiments based on the open-sourced codes 3 .

Original: We adopt the same training strategy and parameters adopted in the codes.
Revised: We adopt the same training strategy and parameters adopted in the codes.

Original: Due to the limitation of computational resources, we train the SiamFC++ with a backbone of Inception v3 (Szegedy et al., 2016) only on COCO (Lin et al., 2014) and ILSVRC-VID (Russakovsky et al., 2015) datasets with four NVIDIA V100 GPUs.
Revised: Due to the limitation of computational resources, we train the SiamFC++ with a backbone of Inception v3 (Szegedy et al., 2016) only on COCO (Lin et al., 2014) and ILSVRC-VID (Russakovsky et al., 2015) datasets with four NVIDIA V100 GPUs.

Original: Speciﬁcally, for the benign model, we train the model for 20 epochs with a batch size of 64.
Revised: Speciﬁcally, for the benign model, we train the model for 20 epochs with a batch size of 64.

Original: An SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.04 is adopted.
Revised: An SGD optimizer with momentum 0.9, weight decay of 5 × 10 − 4 , and an initial learning rate of 0.04 is adopted.

Original: A cosine scheduler is used with a ﬁnal learning rate of 10 − 6 .
Revised: A cosine scheduler is used with a ﬁnal learning rate of 10 − 6 .

Original: There is also a learning rate warm-up strategy for the ﬁrst epoch.
Revised: There is also a learning rate warm-up strategy for the ﬁrst epoch.

Original: The SiamFC++ will update all parts of the model except the Conv layers of the backbone for the ﬁrst 10 epochs, and unfreeze the
Revised: The SiamFC++ will update all parts of the model except the Conv layers of the backbone for the ﬁrst 10 epochs, and unfreeze the

Original: Conv layers in Conv stage 3 and 4 for the ﬁnal 10 epochs to avoid overﬁtting.
Revised: Conv layers in Conv stage 3 and 4 for the ﬁnal 10 epochs to avoid overﬁtting.

Original: Other details can be found in their codes; For BOBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.
Revised: Other details can be found in their codes; For BOBA, we sample 10% training samples to generate poisoned samples by adding triggers with a modiﬁcation rate ψ of 1%.

Original: Other settings are the same as those of the benign model;
Revised: Other settings are the same as those of the benign model;

Original: For FSBA, we sample 10% of the training data with a modiﬁcation rate ψ of 1%.
Revised: For FSBA, we sample 10% of the training data with a modiﬁcation rate ψ of 1%.

Original: When computing the L f , we decay the learning rate as half of the original one.
Revised: When computing the L f , we decay the learning rate as half of the original one.

Original: Other settings are the same as those of the benign model.
Revised: Other settings are the same as those of the benign model.

Original: 𝝐=
Revised: 𝝐=

Original: 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.
Revised: 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.

Original: (a) Hue 𝝐= 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.
Revised: (a) Hue 𝝐= 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.

Original: (b) Contrast 𝝐= 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.

Revised: (b) Contrast 𝝐= 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.

Original: 𝝐=𝟎.
Revised: 𝝐=𝟎.

Original: (c) Brightness 𝝐=
Revised: (c) Brightness 𝝐=

Original: 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.
Revised: 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎. 𝝐=𝟎.

Original: (d) Saturation
Revised: (d) Saturation

Original: B D ETAILED S ETTINGS FOR R ESISTANCE TO P OTENTIAL D EFENSES B. D ETAILED S ETTINGS FOR R ESISTANCE TO C OLOR S HIFTING
Revised: B D ETAILED S ETTINGS FOR R ESISTANCE TO P OTENTIAL D EFENSES B. D ETAILED S ETTINGS FOR R ESISTANCE TO C OLOR S HIFTING

Original: We examined four different types of color shifting strategies, including hue, contrast, saturation, and brightness.
Revised: We examined four different types of color shifting strategies, including hue, contrast, saturation, and brightness.

Original: Each strategy is applied to all the frames of the testing videos.
Revised: Each strategy is applied to all the frames of the testing videos.

Original: We implemented different strategies based on the ‘ColorJitter’ function in torchvision 4 .
Revised: We implemented different strategies based on the ‘ColorJitter’ function in torchvision 4 .

Original: Note that these defenses do not require training and we evaluate FSBA with SiamFC++ on the OTB100 dataset to validate whether our method can resist these defenses.
Revised: Note that these defenses do not require training and we evaluate FSBA with SiamFC++ on the OTB100 dataset to validate whether our method can resist these defenses.

Original: Other settings are the same as those stated in Appendix A.
Revised: Other settings are the same as those stated in Appendix A.

Original: B. D ETAILED S ETTINGS FOR R ESISTANCE TO F INE - TUNING
Revised: B. D ETAILED S ETTINGS FOR R ESISTANCE TO F INE - TUNING

Original: Fine-tuning is one of the most representative model reconstruction based defenses.
Revised: Fine-tuning is one of the most representative model reconstruction based defenses.

Original: It requires retaining FSBA models with a few local benign training samples.
Revised: It requires retaining FSBA models with a few local benign training samples.

Original: We adopt the SiamFC++ tracker under the few-shot backdoor attack with one-shot mode on the OTB100 dataset as an example for the exploration.
Revised: We adopt the SiamFC++ tracker under the few-shot backdoor attack with one-shot mode on the OTB100 dataset as an example for the exploration.

Original: We randomly sample 5% and 10% benign samples within or outside of the training set to ﬁne-tune the attacked models.
Revised: We randomly sample 5% and 10% benign samples within or outside of the training set to ﬁne-tune the attacked models.

Original: Speciﬁcally, the attacked SiamFC++ tracker was trained on
Revised: Speciﬁcally, the attacked SiamFC++ tracker was trained on

Original: ILSVRC-VID and COCO datasets.
Revised: ILSVRC-VID and COCO datasets.

Original: For the within dataset mode, the ﬁne-tuning samples are from the two datasets while the ﬁne-tuning samples are from the GOT10K for the out of dataset mode.
Revised: For the within dataset mode, the ﬁne-tuning samples are from the two datasets while the ﬁne-tuning samples are from the GOT10K for the out of dataset mode.

Original: For the ﬁne-tuning, we adopt a commonly used strategy, which is the same as the last 10 epochs of SiamFC++ training, to retrain FSBA models for 20 epochs.
Revised: For the ﬁne-tuning, we adopt a commonly used strategy, which is the same as the last 10 epochs of SiamFC++ training, to retrain FSBA models for 20 epochs.

Original: Other settings are the same as those stated in Appendix A.
Revised: Other settings are the same as those stated in Appendix A.

Original: C M AIN R ESULTS ON THE L A SOT D ATASET
Revised: C M AIN R ESULTS ON THE L A SOT D ATASET

Original: Dataset Descriptions and Evaluation Metrics.
Revised: Dataset Descriptions and Evaluation Metrics.

Original: To show the effectiveness of our FSBA in attacking long-term tracking, we evaluate attacked trackers on the testing set of LaSOT (Fan et al., 2019).
Revised: To show the effectiveness of our FSBA in attacking long-term tracking, we evaluate attacked trackers on the testing set of LaSOT (Fan et al., 2019).

Original: This
Revised: This

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: dataset includes 280 videos with an average length of around 2,500 frames, where each category has equal numbers of videos to avoid category bias that existed in former benchmark datasets.
Revised: dataset includes 280 videos with an average length of around 2,500 frames, where each category has equal numbers of videos to avoid category bias that existed in former benchmark datasets.

Original: Besides, other than the AUC metric used in the main manuscript, we adopt another metric called normalized precision (nPr) from the LaSOT benchmark.
Revised: Besides, other than the AUC metric used in the main manuscript, we adopt another metric called normalized precision (nPr) from the LaSOT benchmark.

Original: The nPr aims to relieve the sensitivity of Pr to the size of bounding boxes and frame resolutions.
Revised: The nPr aims to relieve the sensitivity of Pr to the size of bounding boxes and frame resolutions.

Original: Please refer to (Muller et al., 2018) for more details.
Revised: Please refer to (Muller et al., 2018) for more details.

Original: Training Setup.
Revised: Training Setup.

Original: All settings are the same as those stated in Appendix A.2.
Revised: All settings are the same as those stated in Appendix A.2.

Original: Results.
Revised: Results.

Original: As shown in Table 3, both BOBA and our FSBA can reduce the tracking performance while our FSBA is signiﬁcantly more effective in attacking against the latest trackers SiamRPN++ and SiamFC++.
Revised: As shown in Table 3, both BOBA and our FSBA can reduce the tracking performance while our FSBA is signiﬁcantly more effective in attacking against the latest trackers SiamRPN++ and SiamFC++.

Original: Particularly, our FSBA can reduce the AUC of the SiamRPN++ and SiamFC++ by more than 30% , even if the trigger only appears in the initial frame ( i.e. , the one-shot mode).
Revised: Particularly, our FSBA can reduce the AUC of the SiamRPN++ and SiamFC++ by more than 30% , even if the trigger only appears in the initial frame ( i.e. , the one-shot mode).

Original: By contrast, BOBA only managed to decrease < 10% AUC-A of SiamFC++.
Revised: By contrast, BOBA only managed to decrease < 10% AUC-A of SiamFC++.

Original: Overall, the AUC-A of our FSBA against SiamFC++ is 30% smaller than that of BOBA.
Revised: Overall, the AUC-A of our FSBA against SiamFC++ is 30% smaller than that of BOBA.

Original: FSBA is also more stealthy than
Revised: FSBA is also more stealthy than

Original: BOBA.
Revised: BOBA.

Original: For example, the AUC-B of our attack against all trackers is 2% higher than that of BOBA.
Revised: For example, the AUC-B of our attack against all trackers is 2% higher than that of BOBA.

Original: On one hand, the effectiveness of our FSBA highlights the backdoor threat in outsourced training of VOT models or using third-party pre-trained models.
Revised: On one hand, the effectiveness of our FSBA highlights the backdoor threat in outsourced training of VOT models or using third-party pre-trained models.

Original: On the other hand, the ineffectiveness of
Revised: On the other hand, the ineffectiveness of

Original: BOBA against the latest trackers indicates that attacking VOT models is indeed more challenging than attacking image classiﬁers.
Revised: BOBA against the latest trackers indicates that attacking VOT models is indeed more challenging than attacking image classiﬁers.

Original: D T HE T -SNE OF S AMPLES IN THE F EATURE S PACE OF FSBA
Revised: D T HE T -SNE OF S AMPLES IN THE F EATURE S PACE OF FSBA

Original: Recall that we visualize the training samples in the feature space generated by the backbone of trackers under BOBA in Section 4.2.
Revised: Recall that we visualize the training samples in the feature space generated by the backbone of trackers under BOBA in Section 4.2.

Original: In this section, we visualize those of trackers under our FSBA.
Revised: In this section, we visualize those of trackers under our FSBA.

Original: As shown in Figure 12, the poisoned frames by our FSBA tend to cluster together and stay away from the benign ones in the hidden space of all three trackers.
Revised: As shown in Figure 12, the poisoned frames by our FSBA tend to cluster together and stay away from the benign ones in the hidden space of all three trackers.

Original: This phenomenon is highly correlated with the attack effectiveness of our FSBA.
Revised: This phenomenon is highly correlated with the attack effectiveness of our FSBA.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: E E FFECT OF THE T RAINING S ET
Revised: E E FFECT OF THE T RAINING S ET

Original: In this section, we evaluate whether our attack is still effective when the models are trained on different training sets.
Revised: In this section, we evaluate whether our attack is still effective when the models are trained on different training sets.

Original: Speciﬁcally, we adopt the SiamFC++ tracker on the OTB100 dataset as an example for the discussion.
Revised: Speciﬁcally, we adopt the SiamFC++ tracker on the OTB100 dataset as an example for the discussion.

Original: As shown in Table 4, our FSBA is still effective and stealthy when trackers are trained on different datasets.
Revised: As shown in Table 4, our FSBA is still effective and stealthy when trackers are trained on different datasets.

Original: F R ESISTANCE TO A DDITIVE G AUSSIAN N OISE
Revised: F R ESISTANCE TO A DDITIVE G AUSSIAN N OISE

Original: Settings.
Revised: Settings.

Original: Similar to the settings in Section 4.5, we take the SiamFC++ tracker under one-shot mode on OTB100 as an example to explore whether our attack can resist video pre-processing with additive Gaussian noise.
Revised: Similar to the settings in Section 4.5, we take the SiamFC++ tracker under one-shot mode on OTB100 as an example to explore whether our attack can resist video pre-processing with additive Gaussian noise.

Original: Speciﬁcally, we add random noise (with different standard deviations) to each frame of the test videos and then test the performance of the models on them.
Revised: Speciﬁcally, we add random noise (with different standard deviations) to each frame of the test videos and then test the performance of the models on them.

Original: Results.
Revised: Results.

Original: As shown in Table 5, the Pr-B decreases signiﬁcantly with the increase of the standard deviation.
Revised: As shown in Table 5, the Pr-B decreases signiﬁcantly with the increase of the standard deviation.

Original: This phenomenon is expectable since the additive noise will decrease the quality of the frames (as shown in Figure 13) and therefore reduce the tracking performance on benign objects.
Revised: This phenomenon is expectable since the additive noise will decrease the quality of the frames (as shown in Figure 13) and therefore reduce the tracking performance on benign objects.

Original: However, the Pr-A of FSBA remains small ( < 30% ) in all cases (as shown in Table 6).
Revised: However, the Pr-A of FSBA remains small ( < 30% ) in all cases (as shown in Table 6).

Original: It indicates that this approach has limited effectiveness in defending our attack.
Revised: It indicates that this approach has limited effectiveness in defending our attack.

Original: G R EPRESENTATIVE B EHAVIORS OF T RACKERS UNDER FSBA
Revised: G R EPRESENTATIVE B EHAVIORS OF T RACKERS UNDER FSBA

Original: In this section, we summarize ﬁve representative behaviors of the attacked trackers by our FSBA under the one-shot mode.
Revised: In this section, we summarize ﬁve representative behaviors of the attacked trackers by our FSBA under the one-shot mode.

Original: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(a) Fail to Attack # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(b) Tracking the Wrong Object # Frame# Frame
Revised: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(a) Fail to Attack # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(b) Tracking the Wrong Object # Frame# Frame

Original: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(c)
Revised: # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(c)

Original: Expanding the Bounding Box # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(d)
Revised: Expanding the Bounding Box # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(d)

Original: Shrinking the Bounding Box # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(e)
Revised: Shrinking the Bounding Box # Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame# Frame(e)

Original: Tracking the Wrong and then the Right Object
Revised: Tracking the Wrong and then the Right Object

Original: Failed Attacks.
Revised: Failed Attacks.

Original: In this type of attack, the attacked model will generate a normal bounding box, which is similar to the one generated by the benign model (as shown in Figure 14(a)).
Revised: In this type of attack, the attacked model will generate a normal bounding box, which is similar to the one generated by the benign model (as shown in Figure 14(a)).

Original: [Figure]
Revised: [Figure]

Original: Mode →
Revised: Mode →

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: Few
Revised: Few

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: Successful Attacks.
Revised: Successful Attacks.

Original: There are three representative behaviors in a successful attack, including (1) tracking the wrong object, (2) expanding the bounding box, and (3) shrinking the bounding box.
Revised: There are three representative behaviors in a successful attack, including (1) tracking the wrong object, (2) expanding the bounding box, and (3) shrinking the bounding box.

Original: In the ﬁrst type of behavior, the attacked model will track a completely different object (as shown in
Revised: In the ﬁrst type of behavior, the attacked model will track a completely different object (as shown in

Original: Figure 14(b))
Revised: Figure 14(b))

Original: ; In the second type of behavior, the attacked model will generate a signiﬁcantly larger bounding box, compared to the one generated by the benign model (as shown in Figure 14(c));
Revised: ; In the second type of behavior, the attacked model will generate a signiﬁcantly larger bounding box, compared to the one generated by the benign model (as shown in Figure 14(c));

Original: In the third type of behavior, the attacked model will generate a signiﬁcantly smaller bounding box, compared to the one generated by the benign model (as shown in Figure 14(d)).
Revised: In the third type of behavior, the attacked model will generate a signiﬁcantly smaller bounding box, compared to the one generated by the benign model (as shown in Figure 14(d)).

Original: Half Successful Attacks.
Revised: Half Successful Attacks.

Original: In this type of attack, the attacked model will ﬁrst track the wrong object and then track back to the right one, as shown in Figure 14(e).
Revised: In this type of attack, the attacked model will ﬁrst track the wrong object and then track back to the right one, as shown in Figure 14(e).

Original: This is most probably because the bounding box of a successful attack may re-overlap to the target object due to some natural factors ( e.g. , object movement), and causing subsequent attacks to fail.
Revised: This is most probably because the bounding box of a successful attack may re-overlap to the target object due to some natural factors ( e.g. , object movement), and causing subsequent attacks to fail.

Original: H W HY BOBA IS I NEFFECTIVE ON S IAM RPN++ AND S IAM FC++?
Revised: H W HY BOBA IS I NEFFECTIVE ON S IAM RPN++ AND S IAM FC++?

Original: In this section, we investigate the reason why BOBA is less effective in attacking against some of the VOT models, as shown in Figure 4 in the main text.
Revised: In this section, we investigate the reason why BOBA is less effective in attacking against some of the VOT models, as shown in Figure 4 in the main text.

Original: As we brieﬂy explained in Section 4.2, the ineffectiveness of BOBA on SiamRPN++ and SiamFC++ is mostly due to the close distance between benign and poisoned frames in the feature space.
Revised: As we brieﬂy explained in Section 4.2, the ineffectiveness of BOBA on SiamRPN++ and SiamFC++ is mostly due to the close distance between benign and poisoned frames in the feature space.

Original: To explore its intrinsic mechanism, here we visualize the training process of different trackers under BOBA on the OTB100 dataset.
Revised: To explore its intrinsic mechanism, here we visualize the training process of different trackers under BOBA on the OTB100 dataset.

Original: As shown in Figure 15, the feature loss L f increases with the decrease of the poisoned loss L p during the training process of the SiamFC tracker.
Revised: As shown in Figure 15, the feature loss L f increases with the decrease of the poisoned loss L p during the training process of the SiamFC tracker.

Original: However, the feature loss L f is relatively stable or even decreases when the poisoned loss L p continuously decreases during the training process of
Revised: However, the feature loss L f is relatively stable or even decreases when the poisoned loss L p continuously decreases during the training process of

Original: SiamRPN++ and SiamFC++ trackers.
Revised: SiamRPN++ and SiamFC++ trackers.

Original: This indicates that minimizing the poisoned loss L p alone (in
Revised: This indicates that minimizing the poisoned loss L p alone (in

Original: BOBA) cannot ensure large feature separation between the poisoned and benign frames.
Revised: BOBA) cannot ensure large feature separation between the poisoned and benign frames.

Original: It is also worth mentioning that the trend (increasing, stable, or decreasing) of the feature loss across different epochs is highly correlated with the attack effectiveness of BOBA (see the numerical results in Table 7).
Revised: It is also worth mentioning that the trend (increasing, stable, or decreasing) of the feature loss across different epochs is highly correlated with the attack effectiveness of BOBA (see the numerical results in Table 7).

Original: This again veriﬁes the importance of our proposed feature loss L f for effective backdoor attacks.
Revised: This again veriﬁes the importance of our proposed feature loss L f for effective backdoor attacks.

Original: We also notice that the change of L f is also related to the tracker’s architecture.
Revised: We also notice that the change of L f is also related to the tracker’s architecture.

Original: Particularly, SiamFC has only one (classiﬁcation) branch while SiamRPN++ and SiamFC++ have one and two additional (non-classiﬁcation) branches than SiamFC, respectively.
Revised: Particularly, SiamFC has only one (classiﬁcation) branch while SiamRPN++ and SiamFC++ have one and two additional (non-classiﬁcation) branches than SiamFC, respectively.

Original: Clearly, the more additional branches, the harder BOBA causes feature separation in the feature space generated by the backbone.
Revised: Clearly, the more additional branches, the harder BOBA causes feature separation in the feature space generated by the backbone.

Original: This is mainly because BOBA targets only the classiﬁcation branch (via optimizing the poisoned loss L p ).
Revised: This is mainly because BOBA targets only the classiﬁcation branch (via optimizing the poisoned loss L p ).

Original: By contrast, our FSBA provides a simple yet effective approach to affect all branches simultaneously, as it directly targets the backbone representation.
Revised: By contrast, our FSBA provides a simple yet effective approach to affect all branches simultaneously, as it directly targets the backbone representation.

Original: As shown in Table 8, FSBA can cause much larger loss differences at all types of branches.
Revised: As shown in Table 8, FSBA can cause much larger loss differences at all types of branches.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: I R ESISTANCE TO O THER P OTENTIAL D EFENSES
Revised: I R ESISTANCE TO O THER P OTENTIAL D EFENSES

Original: In this section
Revised: In this section

Original: [Table]
Revised: [Table]

Original: we take the SiamFC++ tracker as an example (under the one-shot mode on OTB dataset) to test the robustness of our FSBA to two other model reconstruction based defenses.
Revised: we take the SiamFC++ tracker as an example (under the one-shot mode on OTB dataset) to test the robustness of our FSBA to two other model reconstruction based defenses.

Original: In particular, we notice that there were also some other types of backdoor defenses (Du et al., 2020;
Revised: In particular, we notice that there were also some other types of backdoor defenses (Du et al., 2020;

Original: Li et al., 2021a; Huang et al., 2022) targeting the poison-only backdoor attacks, where the adversaries can only manipulate the training dataset.
Revised: Li et al., 2021a; Huang et al., 2022) targeting the poison-only backdoor attacks, where the adversaries can only manipulate the training dataset.

Original: These defenses are out of the scope of this paper since we assume that the adversary has full control over the training process.
Revised: These defenses are out of the scope of this paper since we assume that the adversary has full control over the training process.

Original: Besides, we also ignored detection-based defenses (Xiang et al., 2020;
Revised: Besides, we also ignored detection-based defenses (Xiang et al., 2020;

Original: Guo et al., 2022; Xiang et al., 2022) for they can not directly improve model robustness.
Revised: Guo et al., 2022; Xiang et al., 2022) for they can not directly improve model robustness.

Original: We will discuss the resistance to them in our future work.
Revised: We will discuss the resistance to them in our future work.

Original: I. R ESISTANCE TO M ODEL P RUNING .
Revised: I. R ESISTANCE TO M ODEL P RUNING .

Original: Recent studies (Liu et al., 2018; Wu & Wang, 2021) revealed that defenders can remove hidden backdoors in the attacked models via pruning neurons that are inactive on benign samples.
Revised: Recent studies (Liu et al., 2018; Wu & Wang, 2021) revealed that defenders can remove hidden backdoors in the attacked models via pruning neurons that are inactive on benign samples.

Original: It was believed that the backdoors are hidden in those neurons since the model demonstrates different predictions on benign vs. their poisoned samples.
Revised: It was believed that the backdoors are hidden in those neurons since the model demonstrates different predictions on benign vs. their poisoned samples.

Original: Since these defenses do not require the attack to be classiﬁcation-based nor targeted, they can also be applied to defend against our FSBA.
Revised: Since these defenses do not require the attack to be classiﬁcation-based nor targeted, they can also be applied to defend against our FSBA.

Original: Settings.
Revised: Settings.

Original: We implement the standard channel pruning (He et al., 2017) method at the last layers of the backbone of SiamFC++, based on the open-resource code 5 .
Revised: We implement the standard channel pruning (He et al., 2017) method at the last layers of the backbone of SiamFC++, based on the open-resource code 5 .

Original: Speciﬁcally, we prune τ % (dubbed pruning rate ) channels that have the smallest activation values on 5% benign training samples.
Revised: Speciﬁcally, we prune τ % (dubbed pruning rate ) channels that have the smallest activation values on 5% benign training samples.

Original: We also test different τ s to obtain more comprehensive results.
Revised: We also test different τ s to obtain more comprehensive results.

Original: Results.
Revised: Results.

Original: As shown in Table 9, the Pr-B decreases signiﬁcantly with the increase of the pruning rate.
Revised: As shown in Table 9, the Pr-B decreases signiﬁcantly with the increase of the pruning rate.

Original: However, the Pr-A remains below 30% in all cases, that is, our FSBA is resistant to model pruning to a large extent.
Revised: However, the Pr-A remains below 30% in all cases, that is, our FSBA is resistant to model pruning to a large extent.

Original: I. R ESISTANCE TO M ODE C ONNECTIVITY R EPAIRING .
Revised: I. R ESISTANCE TO M ODE C ONNECTIVITY R EPAIRING .

Original: Settings.
Revised: Settings.

Original: We implement the Mode Connectivity Repairing (MCR)
Revised: We implement the Mode Connectivity Repairing (MCR)

Original: (Zhao et al., 2020a) defense based on its ofﬁcial code 6 .
Revised: (Zhao et al., 2020a) defense based on its ofﬁcial code 6 .

Original: Following their settings, we ﬁrst train an additional backdoored tracker with different random initializations, and then train a connect curve with ζ % (dubbed bonaﬁde rate ) benign samples.
Revised: Following their settings, we ﬁrst train an additional backdoored tracker with different random initializations, and then train a connect curve with ζ % (dubbed bonaﬁde rate ) benign samples.

Original: All connect curves are trained for 100 epochs.
Revised: All connect curves are trained for 100 epochs.

Original: During the repairing process, we set t = 0 .
Revised: During the repairing process, we set t = 0 .

Original: 5 as suggested in (Zhao et al., 2020a).
Revised: 5 as suggested in (Zhao et al., 2020a).

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: Results.
Revised: Results.

Original: As shown in Table 10, the MCR defense tends to harm the model’s performance on  benign videos badly.
Revised: As shown in Table 10, the MCR defense has minor adverse effects on tracking benign videos.

Original: Even when we use 10% benign samples (which is much bigger than the one used inits original paper) to train the connect curve, the Pr-B still decreases by more than 50% compared with the one without defense.
Revised: However, it also has negligible beneﬁts in tracking attacked videos. The Pr-A even decreases sharply when 5% benign samples are used in the MCR defense.

Original: As such, it can not be used to defend against our FSBA.
Revised: In other words, our FSBA is resistant to the MCR defense.

Original: We conjecture that it is because  tracking is much more sophisticated than classiﬁcation and the side-effects (on a single frame) caused by repairing will be accumulated across theentire tracking process. 
Revised: We conjecture that it is because visual object tracking is much more sophisticated than classiﬁcation and therefore repairing every single frame is not enough to inﬂuence the tracking process. We will further analyze it in our future work.

Original: J W HY FSBA C AN E NSURE O NE -/F EW -S HOT E FFECTIVENESS ?
Revised: J W HY FSBA C AN E NSURE O NE -/F EW -S HOT E FFECTIVENESS ?

Original: In this section, we discuss why our proposed FSBA can ensure one-/few-shot effectiveness, even it seems to have no speciﬁc design to ensure one-/few-shot effectiveness.
Revised: In this section, we discuss why our proposed FSBA can ensure one-/few-shot effectiveness, even it seems to have no speciﬁc design to ensure one-/few-shot effectiveness.

Original: The feature separation in the deep representation space is the key for one-/few-shot effectiveness.
Revised: The feature separation in the deep representation space is the key for one-/few-shot effectiveness.

Original: In other words, by maximizing the effect of the trigger pattern on each frame via the L f , our attack ensures the one-/few-shot effectiveness.
Revised: In other words, by maximizing the effect of the trigger pattern on each frame via the L f , our attack ensures the one-/few-shot effectiveness.

Original: Intuitively, the tracking process can be viewed as a ﬁrstorder Markov process with the template and search region are generated based on the previous frame.
Revised: Intuitively, the tracking process can be viewed as a ﬁrstorder Markov process with the template and search region are generated based on the previous frame.

Original: Therefore, the stronger the trigger pattern disturbs a single frame, the longer (more frames) the attack effect will last, i.e. , the fewer frames it needs to appear on for a successful attack.
Revised: Therefore, the stronger the trigger pattern disturbs a single frame, the longer (more frames) the attack effect will last, i.e. , the fewer frames it needs to appear on for a successful attack.

Original: We did not explicitly optimize this sequential dependency is because the training process of a VOT model is not sequential (although the tracking process is sequential), i.e. , training is done in a frame-wise manner with the training videos are separated into frames.
Revised: We did not explicitly optimize this sequential dependency is because the training process of a VOT model is not sequential (although the tracking process is sequential), i.e. , training is done in a frame-wise manner with the training videos are separated into frames.

Original: To verify that the value of features loss is highly correlated to the one-/few-shot effectiveness, we conduct FSBA against SiamFC tracker with different poisoning rates to achieve attacked trackers with different performances and present the training details of our FSBA targeting SiamFC tracker.
Revised: To verify that the value of features loss is highly correlated to the one-/few-shot effectiveness, we conduct FSBA against SiamFC tracker with different poisoning rates to achieve attacked trackers with different performances and present the training details of our FSBA targeting SiamFC tracker.

Original: Unless otherwise speciﬁed, all settings are the same as those used in Section 4.2.
Revised: Unless otherwise speciﬁed, all settings are the same as those used in Section 4.2.

Original: As shown in Table 11-12, the larger the feature loss L f , the better the one-/few-shot effectiveness ( i.e. , the lower Pr-A).
Revised: As shown in Table 11-12, the larger the feature loss L f , the better the one-/few-shot effectiveness ( i.e. , the lower Pr-A).

Original: These results verify that our design of the feature loss L f in FSBA can indeed ensure one-/few-shot effectiveness.
Revised: These results verify that our design of the feature loss L f in FSBA can indeed ensure one-/few

Original: [Figure]
Revised: [Figure]

Original: K A NALYZING THE E FFECTIVENESS OF FSBA VIA A TTENTION M AP
Revised: K A NALYZING THE E FFECTIVENESS OF FSBA VIA A TTENTION M AP

Original: In this section, we analyze the working mechanism of our FSBA via visualizing attention maps.
Revised: In this section, we analyze the working mechanism of our FSBA via visualizing attention maps.

Original: Settings.
Revised: Settings.

Original: We use the Grad-CAM (Selvaraju et al., 2017) to generate the attention maps of benign or FSBA-attacked SiamFC++ trackers on the search regions.
Revised: We use the Grad-CAM (Selvaraju et al., 2017) to generate the attention maps of benign or FSBA-attacked SiamFC++ trackers on the search regions.

Original: The attention map visualizes the importance of each pixel to the model’s prediction.
Revised: The attention map visualizes the importance of each pixel to the model’s prediction.

Original: We choose SiamFC++ for this analysis because it is the only tracker (among all three trackers considered in previous experiments) that treats every pixel of a search region as an independent proposal in the classiﬁcation branch.
Revised: We choose SiamFC++ for this analysis because it is the only tracker (among all three trackers considered in previous experiments) that treats every pixel of a search region as an independent proposal in the classiﬁcation branch.

Original: We test 8 cases in total, including whether the model is attacked ( × 2), whether the template is attached with the trigger pattern ( × 2), and whether the search region is attached with the trigger pattern ( × 2).
Revised: We test 8 cases in total, including whether the model is attacked ( × 2), whether the template is attached with the trigger pattern ( × 2), and whether the search region is attached with the trigger pattern ( × 2).

Original: Results.
Revised: Results.

Original: As shown in Figure 16(a), the high attention areas of the benign tracker are always on the tracked object ( i.e , the basketball player), even when the search region or template image contains the trigger pattern.
Revised: As shown in Figure 16(a), the high attention areas of the benign tracker are always on the tracked object ( i.e , the basketball player), even when the search region or template image contains the trigger pattern.

Original: This phenomenon explains why the trigger pattern cannot mislead benign trackers.
Revised: This phenomenon explains why the trigger pattern cannot mislead benign trackers.

Original: In contrast, the attention of the attacked tracker by our FSBA is distracted whenever the trigger pattern appears.
Revised: In contrast, the attention of the attacked tracker by our FSBA is distracted whenever the trigger pattern appears.

Original: Particularly, when the trigger pattern only appears in one place ( i.e. , the search region or template), the high attention area is shifted away from the object.
Revised: Particularly, when the trigger pattern only appears in one place ( i.e. , the search region or template), the high attention area is shifted away from the object.

Original: This phenomenon (partly) explains why the attacked models cannot track the target objects when the trigger pattern appears.
Revised: This phenomenon (partly) explains why the attacked models cannot track the target objects when the trigger pattern appears.

Original: Interestingly, when the trigger pattern appears on both the search region and the template, the tracker tends to only pay attention to the trigger area.
Revised: Interestingly, when the trigger pattern appears on both the search region and the template, the tracker tends to only pay attention to the trigger area.

Original: This is probably why our FSBA is highly effective even under the few-shot mode.
Revised: This is probably why our FSBA is highly effective even under the few-shot mode.

Original: L C ODES
Revised: L C ODES

Original: The codes for reproducing the main experiments of our FSBA are open-sourced on Github 7 .
Revised: The codes for reproducing the main experiments of our FSBA are open-sourced on Github 7 .