Abstract
Multi-Object Tracking (MOT) is a critical task in computer vision, with applications ranging from surveillance systems to autonomous driving. However, threats to MOT algorithms have yet been widely studied. In particular, incorrect association between the tracked objects and their assigned IDs can lead to severe consequences, such as wrong trajectory predictions. Previous attacks against MOT either focused on hijacking the trackers of individual objects, or manipulating the tracker IDs in MOT by attacking the integrated object detection (OD) module in the digital domain, which are model-specific, non-robust, and only able to affect specific samples in offline datasets. In this paper, we present AdvTraj, the first online and physical ID-manipulation attack against tracking-by-detection MOT, in which an attacker uses adversarial trajectories to transfer its ID to a targeted object to confuse the tracking system, without attacking OD. Our simulation results in CARLA show that AdvTraj can fool ID assignments with 100% success rate in various scenarios for white-box attacks against SORT, which also have high attack transferability (up to 93% attack success rate) against state-of-the-art (SOTA) MOT algorithms due to their common design principles. We characterize the patterns of trajectories generated by AdvTraj and propose two universal adversarial maneuvers that can be performed by a human walker/driver in daily scenarios. Our work reveals under-explored weaknesses in the object association phase of SOTA MOT systems, and provides insights into enhancing the robustness of such systems.
Abstract (translated)
多目标跟踪（MOT）是计算机视觉中的一个关键任务，应用范围从监控系统到自动驾驶领域。然而，针对MOT算法的安全威胁尚未被广泛研究。尤其是，追踪对象与其分配ID之间的错误关联可能导致严重后果，比如轨迹预测错误。以往的攻击主要集中在劫持个别物体的追踪器或通过在网络域中攻击集成的对象检测（OD）模块来操纵MOT中的跟踪器ID上，这些方法针对特定模型、不具备鲁棒性，并且只能影响离线数据集中的特定样本。 在本文中，我们提出了AdvTraj——首个在线和物理级别的ID操控攻击，专门用于基于检测的多目标追踪系统。该攻击使用对抗轨迹让攻击者将其ID转移给选定的目标物体以混淆跟踪系统，而无需直接针对对象检测模块进行操作。我们在CARLA模拟环境中进行了实验，结果显示，对于SORT算法，在白盒攻击下AdvTraj可以以100%的成功率在各种场景中欺骗ID分配，并且由于现代顶级MOT算法的共同设计原则，该方法对其他SOTA MOT算法也具有高迁移性（最高达93%的成功率）。 我们描述了由AdvTraj生成的轨迹模式，并提出了两种通用对抗操作策略，这些策略可以被行人或驾驶员在日常场景中执行。我们的工作揭示了顶级MOT系统在目标关联阶段未被充分探索的安全弱点，并为提高此类系统的鲁棒性提供了见解。
URL
https://arxiv.org/abs/2512.01934
