{"id":"55d4eac6-b1c1-44fa-9a6c-ebd83e8541ad","arxiv_id":"2505.08999","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"The AMGA attack, built from an ensemble of image classifiers trained with momentum, Gaussian smoothing, and a meta-learning-style update, substantially reduces the accuracy of seven visual trackers on three benchmarks in black-box settings.","lead":"The paper proposes AMGA, an adversarial attack that adds tiny perturbations to the first frame of a video to make seven leading visual trackers lose the object. It combines gradients from several image-classification networks, momentum, and Gaussian smoothing to make the attack work even when the tracker's internal details are hidden.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 6's black-box comparison lacks a matched perturbation budget and protocol; with AMGA's edge over IoU only ~0.02-0.03, the claimed superiority is not yet established.","rationale":"The reader's y-label concern is real and should be fixed, but it is primarily a reproducibility gap: even if y is arbitrary, the reported attack could still work because maximizing cross-entropy with any fixed label degrades classifier features, and the empirical drops versus random noise are consistent. The comparison claim in Table 6 is more directly load-bearing for the paper's headline 'outperforms existing black-box methods': a fair comparison requires matching perturbation magnitude and attack protocol. AMGA's margin over IoU is only about two percentage points, so unaccounted differences in epsilon or in first-frame-only versus per-frame attack could explain the entire advantage. The proposed check would settle this by re-running the three methods under identical constraints. I therefore keep the reader's CONDITIONAL verdict; the authors should report budgets, PSNR, and protocol for all methods, and ideally release attack code so the label y in Eq. (2) and the exact frame iteration can be verified.","tokens_in":15241,"tokens_out":7176,"duration_ms":73320,"concrete_test":"Re-run the SiamRPN++/OTB2015 comparison in Table 6 with all three black-box methods constrained to the same l_infinity budget (e.g., 8/255 or 16/255) and the same frame protocol: either all methods perturb only the initial frame or all methods perturb every frame. Record the achieved epsilon, PSNR, and speed for each method. If AMGA's success/precision drops fall to or below IoU's 0.196/0.261 (or SPARK's 0.066/0.027) under the matched budget, the superiority claim in Table 6 is an artifact of unconstrained perturbation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that AMGA outperforms SPARK and IoU rests on Table 6, but that table does not report the perturbation budget (e.g., l_infinity epsilon), PSNR, or the number of frames attacked for any method. Section 4.1 says the AMGA perturbation is 'used on the initial frame' only, whereas SPARK is an online incremental attack and IoU is a temporally coherent attack that perturbs frames throughout the sequence; if the budgets or frame protocols differ, the comparison conflates attack strength with threat model. The reported margins are small: over IoU, AMGA gains only 0.219 vs 0.196 success drop and 0.287 vs 0.261 precision drop. A modest change in perturbation magnitude or in the number of attacked frames could reverse the ranking. The paper's only quality number (PSNR 31.76 dB, Table 5, sigma=1) is not reported for the Table 6 configuration or for SPARK/IoU. Without a matched budget, the 'significantly outperforms' claim is unsupported; the large drops versus random noise in Tables 1-3 remain evidence of effectiveness, but not of superiority over the baselines.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes AMGA, a black-box adversarial attack for visual trackers. AMGA generates perturbations on the first frame of a video by optimizing cross-entropy loss of an ensemble of ImageNet classification surrogate models, using a meta-training/meta-testing procedure with random model selection, momentum, Gaussian smoothing, and input diversity. The authors evaluate the attack on seven trackers (SiamCAR, SiamRPN++, DiMP, MixFormer, TransT, OSTrack, SeqTrack) across OTB2015, LaSOT, and GOT-10k, reporting large success-rate and precision drops relative to random noise. They also compare AMGA with CSA, SPARK, and IoU attacks on SiamRPN++/OTB2015, claim superior black-box performance, and provide ablations and visualizations.","tokens_in":15432,"tokens_out":3383,"duration_ms":34406,"significance":"If the empirical claims hold, AMGA would be a useful black-box attack for robustness evaluation of visual trackers, since it demonstrates that perturbations computed on generic ImageNet classifiers can transfer to a wide range of modern trackers. The paper has several strengths: it evaluates on seven trackers and three datasets with consistent large drops versus random noise; the ablation study in Table 4 attributes improvements to the proposed components; and the authors promise code and data at a public repository. However, the central comparative claim against existing black-box attacks is not yet supported because the comparison protocol is not matched and the attack objective is under-specified. The headline results against random noise are plausible, but the claimed superiority over SPARK and IoU requires a controlled experimental setup.","major_comments":[{"comment":"The attack objective uses a true label y and dataset D for the cross-entropy loss, but y is never defined for tracking benchmarks. The surrogate models are ImageNet classifiers (Section 4.1), while the trackers predict bounding boxes; no mapping from OTB2015/LaSOT/GOT-10k ground truth to classification labels is given. Please specify how y is constructed (e.g., the target object's ImageNet/WordNet class, or a false class) and justify why maximizing this classification loss on the first frame is an appropriate surrogate for disrupting the tracker's regression and similarity objectives. Without this, the core attack objective is not reproducible.","section":"Section 3.2, Eq. (2) and Eq. (8)"},{"comment":"The black-box comparison with SPARK and IoU is not matched in threat model. The text states that the AMGA perturbation is used on the initial frame only, whereas SPARK is an online incremental attack and IoU is a temporally coherent attack; yet no perturbation budget (epsilon), PSNR, or number of attacked frames is reported for any method. The reported margins over IoU are small (0.219 vs 0.196 success drop; 0.287 vs 0.261 precision drop). A modest change in perturbation magnitude or in the number of attacked frames could reverse the ranking, so the claim that AMGA 'significantly outperforms' these baselines is unsupported as presented.","section":"Table 6 and Section 4.1"},{"comment":"No perturbation budget (epsilon) or projection/clipping step is reported or described anywhere in the methodology or experiments. The update rules in Eqs. (3), (5), and (9) do not constrain the perturbation magnitude, so the attacks in Tables 1-6 are not reproducible and their comparison with standard attacks that use explicit budgets is ambiguous. Please report the l_infinity (or other) constraint used, include any clipping to the epsilon ball, and state the perturbation strength for every configuration, including the Table 6 baselines.","section":"Section 4.1 and Eqs. (3)-(9)"}],"minor_comments":[{"comment":"The tracker name 'TansT' in the Table 2 header is a typo and should be 'TransT'.","section":"Table 2"},{"comment":"The text says 'Independently applying the input diversity strategy further improved the attack performance,' but the row labeled 'w/ input diversity' may be interpreted as input diversity combined with meta-gradient learning rather than input diversity alone. Please clarify the exact configuration of each ablation row.","section":"Section 4.3, Table 4"},{"comment":"Several mathematical expressions in Figure 2 appear garbled (subscripts and superscripts are unclear). Please replace them with clean typeset equations that match Eqs. (3)-(5) in the text.","section":"Figure 2"},{"comment":"SPARK is described as a 'transfer-based black-box attack,' but the cited paper describes it as a spatial-aware online incremental attack; please verify this characterization and describe the actual attack mechanism accurately.","section":"Section 4.4"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of a security/robustness-oriented venue, but the evaluation protocol for the central comparison needs substantial revision. The authors should also be asked to clearly define the surrogate-labeling step, which is currently a reproducibility blocker."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nQuick take: this is a competent, thoroughly evaluated adversarial attack paper for visual tracking, but the claimed superiority over SPARK and IoU in Table 6 is not yet established, and Eq. (2)'s undefined y needs fixing. The breadth of the evaluation is the real strength: seven trackers spanning Siamese, discriminative, and Transformer architectures, three datasets, and consistent large drops versus random noise. The method itself is a combination of known ingredients—momentum iterative attack, multi-model ensemble, Gaussian smoothing, and a meta-gradient-style update—plus a random model-selection twist. That's a modest novelty, but the application to tracking and the scale of the study make it a useful baseline.\n\nThe ablation study is the most convincing part: each component (input diversity, meta-gradient, momentum, Gaussian smoothing) contributes, and Table 5 shows the expected sigma tradeoff with PSNR/SSIM. I also appreciate that the code and data are promised, and the conclusion honestly admits limits.\n\nNow the soft spots. The stress-test note is right: Table 6 compares AMGA against SPARK and IoU without reporting the perturbation budget, the number of frames attacked, or any quality metric for the comparison configuration. AMGA perturbs only the initial frame (per Sec. 4.1), while SPARK is online incremental and IoU is temporally coherent. Those are different threat models. The margins over IoU are small—0.023 in success drop, 0.026 in precision drop—so a modest protocol change could flip the ranking. The paper's own PSNR number (31.76 dB) is for a different configuration and isn't given for the baselines. So the central claim of 'significantly outperforms' is not supported; the claim of effectiveness against random noise is.\n\nThe under-specified attack objective is a real clarity problem. Eq. (2) uses a true label y and dataset D for tracking frames, but y is never defined. Since the surrogate models are ImageNet classifiers, presumably y is either the ground-truth class of the frame's target or the model's own prediction, but the paper doesn't say. This is fixable in revision but load-bearing for reproducibility.\n\nMinor: no error bars or multiple runs; sigma = 1 is chosen on the same SiamRPN++/OTB setup used for headline results, which is a mild selection-on-validation issue. The meta-learning description (Section 3.5) overclaims what Eqs. (8)-(9) actually do—there's no inner-loop/outer-loop distinction, just one extra gradient step on a held-out model.\n\nWho is this for? Researchers working on adversarial robustness of visual trackers will want this as a strong black-box attack candidate, and the dataset of transferability numbers is useful. It deserves a serious referee. My recommendation: engage with it, but require the authors to match the threat model in Table 6, define y, and add error bars before accepting.\n\nBest","headline":"Solid attack paper with broad evaluation, but its baseline comparison is under-matched and the attack objective is under-specified.","tokens_in":16007,"tokens_out":3403,"would_cite":false,"duration_ms":29734,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A black-box meta-gradient attack transfers across visual trackers, cutting SiamRPN++ success from 0.639 to 0.420.","keywords":["adversarial attack","visual tracking","meta-learning","momentum mechanism","black-box attack","transferability","adversarial examples","Gaussian smoothing"],"falsifier":"Repeat the OTB2015 experiment with Eq. (2)'s label y replaced by a random label or a constant; if success-rate drops stay near AMGA's, the classification objective is not load-bearing, and if they collapse, the transfer claim depends entirely on that surrogate label.","tokens_in":14992,"feed_emoji":"🎯","tokens_out":6359,"duration_ms":57813,"temperature":0.7,"pith_summary":"The paper proposes AMGA, a black-box adversarial attack that degrades visual trackers without accessing their parameters or gradients. The attack optimizes a perturbation of the first frame by alternating between meta-training on a random subset of pretrained ImageNet classifiers and meta-testing on a held-out classifier, with momentum, Gaussian smoothing, and input diversity stabilizing the update. The central claim is that this recipe produces perturbations that transfer across trackers of very different architectures, far beyond random noise. The evidence includes success-rate drops on OTB2015, LaSOT, and GOT-10k for seven trackers, most notably SiamRPN++ falling from 0.639 to 0.420 on OTB2015.","feed_headline":"Black-box attack cuts SiamRPN++ tracking success to 0.420","feed_subtitle":"Meta-trained perturbation transfers to seven unseen trackers and beats SPARK and IoU without tracker gradients.","key_machinery":"The central mechanism is the meta-learning task split over a model repository. In each iteration AMGA randomly selects n+1 ImageNet classifiers; the first n form a meta-training set whose weighted ensemble probability is attacked with cross-entropy loss and momentum-based sign-gradient updates, and the last forms a meta-testing set on which the resulting perturbation receives one further update. Because the ensemble weights are learned and the input is randomly scaled and padded, the perturbation is pushed onto features shared by many surrogate models rather than any single classifier. Gaussian smoothing then removes high-frequency components, which the paper argues improves both transferability and imperceptibility.","core_discovery":"AMGA is claimed to make black-box adversarial attacks on visual trackers practical by treating a repository of pretrained image classifiers as surrogate models and attacking them through a meta-learning loop. In each learning task, n models are used for meta-training, where a weighted ensemble loss is maximized with sign-gradient updates, and one held-out model is used for meta-testing, where the perturbation is refined once more. The paper reports that this yields adversarial examples that transfer to unseen trackers: on OTB2015 the success rate of SiamRPN++ drops from 0.639 to 0.420 and precision from 0.849 to 0.562, with comparable degradations for SiamCAR, DiMP, MixFormer, TransT, OSTrack, and SeqTrack across three benchmark datasets. The method outperforms the SPARK and IoU black-box baselines while remaining below the white-box CSA baseline.","pith_inferences":["Editorial inference: the label y in Eq. (2) is never defined for tracking frames; if it is an ImageNet category, the method implicitly assumes tracker-relevant feature geometry aligns with classification categories, and randomizing y would test whether that premise is doing the work.","Editorial inference: at 1.1 fps AMGA is slower than the IoU and SPARK baselines, so its practical use is likely limited to offline precomputation or settings where attack strength matters more than speed.","Editorial inference: the meta-train/meta-test loop over surrogate models is a generic recipe; the same structure, with momentum and smoothing, could be carried to adversarial attacks on re-identification, dense prediction, or video object segmentation.","Editorial inference: if the reported transfer depends on ImageNet-pretrained backbones, trackers trained from scratch or on non-ImageNet features may be far less vulnerable; this is testable but not tested in the paper."],"forward_implications":["A practical black-box attack on visual trackers needs no tracker gradients: only the first-frame image and a set of public classification models are required.","A single-frame perturbation can disrupt tracking over entire sequences, since the reported success and precision drops are measured over full benchmark runs.","The attack transfers across architectural families, covering Siamese trackers (SiamCAR, SiamRPN++), online discriminative trackers (DiMP), and Transformer trackers (MixFormer, TransT, OSTrack, SeqTrack).","The ablation study attributes the gain to the combination of meta-gradient learning, input diversity, momentum, and Gaussian smoothing, with the full method outperforming each component on its own.","Among the black-box baselines tested, AMGA outperforms SPARK and IoU on SiamRPN++ / OTB2015, suggesting that transfer-based black-box attacks deserve a place in tracker threat models."],"supporting_citations":[{"why":"introduces FGSM and the adversarial-example concept the attack builds on","marker":"[9]"},{"why":"provides iterative FGSM, the iterative gradient-update baseline AMGA extends","marker":"[10]"},{"why":"supplies the multi-model ensemble attack idea behind AMGA's model repository","marker":"[34]"},{"why":"provides the momentum mechanism used to stabilize gradient updates","marker":"[35]"},{"why":"frames the meta-learning paradigm that AMGA's training/testing split is based on","marker":"[12]"},{"why":"introduces the meta-gradient adversarial attack that AMGA adapts to visual tracking","marker":"[43]"},{"why":"defines SiamRPN++, the tracker used for the headline numbers and ablations","marker":"[22]"},{"why":"SPARK is the transfer-based black-box baseline AMGA compares against","marker":"[45]"},{"why":"IoU attack is the decision-based black-box baseline AMGA outperforms","marker":"[46]"},{"why":"OTB2015 is the benchmark dataset for the main comparative results","marker":"[28]"}],"fun_headline_variants":["Meta-learned attack drops SiamRPN++ success to 0.420","Black-box tracker attacks get a meta-learning boost","One perturbation transfers to seven unseen trackers","AMGA: adversarial examples that fool multiple trackers","Meta-gradient attack improves black-box tracker evasion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that maximizing a classification model's loss on the first frame, with a label y that the paper never defines for tracking videos, yields perturbations that transfer to trackers solving a different task.","fun_headline_variants_meta":{"raw":{"variants":["Meta-learned attack drops SiamRPN++ success to 0.420","Black-box tracker attacks get a meta-learning boost","One perturbation transfers to seven unseen trackers","AMGA: adversarial examples that fool multiple trackers","Meta-gradient attack improves black-box tracker evasion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1521,"prompt_tokens":962,"completion_tokens":559,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":578,"completion_tokens_details":{"reasoning_tokens":482}},"tokens_in":578,"tokens_out":559,"duration_ms":5091,"temperature":1.0,"reasoning_tokens":482,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T21:42:20.346286+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Repeat the OTB2015 experiment with Eq. (2)'s label y replaced by a random label or a constant; if success-rate drops stay near AMGA's, the classification objective is not load-bearing, and if they collapse, the transfer claim depends entirely on that surrogate label.","supporting_citations":[{"cited_title":"Hospedales, A","cited_arxiv_id":null,"evidence_quote":"frames the meta-learning paradigm that AMGA's training/testing split is based on"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"introduces the meta-gradient adversarial attack that AMGA adapts to visual tracking"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SPARK is the transfer-based black-box baseline AMGA compares against"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"IoU attack is the decision-based black-box baseline AMGA outperforms"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"OTB2015 is the benchmark dataset for the main comparative results"}],"review_version":1}