{"id":"98b48fc3-7d02-4046-9c7f-aefefb170275","arxiv_id":"2608.03902","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"Discrete layer-skipping decisions in efficient UAV trackers are vulnerable to small perturbations that invert the inference path, causing rapid and irreversible tracking failure.","lead":"The paper shows that adaptive UAV trackers, which save computation by skipping network blocks, can be hijacked by tiny image changes that flip their internal 'run or skip' decisions. It then proposes an attack framework, API, that forces these routing flips to make the tracker quickly lose the target, with experiments showing strong and fast attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim depends on the untested assumption that AVTrack, SGLATrack, and LGTrack use deterministic hard binary gates at inference; if any uses soft or stochastic routing, Eq. (2) and the unbounded-Lipschitz argument do not apply to it.","rationale":"The paper has genuinely strong empirical support: API consistently degrades precision and success across multiple adaptive trackers and benchmarks, the ablation in Table 4 shows that removing the path-inversion objective substantially weakens the attack, and the counterfactual path experiment in Appendix A.1 is a reasonable causal probe of the mechanism. The theoretical result in Eq. (7) is mathematically correct for a hard indicator gate, and the authors do acknowledge prior dynamic-routing attacks in classification. The load-bearing weak point is exactly the reader's weakest assumption: Eq. (2) is asserted, not verified, for the three victim trackers. If the trackers are indeed hard-gated, the central theoretical and empirical claims largely survive, and the remaining issues (novelty overlap with SlowFormer/DeepSloth, broken cross-references, the unsupported 'mathematically proven amplification' phrase) are framing and presentation problems rather than fatal flaws. If a tracker instead uses soft or stochastic routing at inference, the 'unbounded Lipschitz constant' argument does not apply to that tracker, and the causal attribution of the attack to topology inversion would need a different explanation. The proposed check directly resolves this precondition, so the conditional verdict is appropriate; no change in the verdict is warranted until that check is run.","tokens_in":19590,"tokens_out":10610,"duration_ms":107862,"concrete_test":"Download the official AVTrack, SGLATrack, and LGTrack checkpoints and code, insert logging hooks on every gating module, and run 1,000 frames from UAV123. Record the raw pre-activation logits, the post-activation values, and the final routing decision for each block. Check whether the final decision is computed as a deterministic hard threshold (e.g., torch.where(g > tau), argmax over paths) or as a soft multiplication, Gumbel sample, or differentiable relaxation. Then feed a clean frame and the same frame plus the API perturbation at the stated budget (epsilon = 6.5/255) and count the actual gate flips. If all three trackers use deterministic hard thresholds and the API perturbation flips decisions at the reported rates, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The exploitability claim rests on Section 3.2's Eq. (2), which abstracts every gating decision as pi(x) = I(g(x) > tau), a hard binary threshold, and on the white-box availability of pre-sigmoid logits for the path-inversion objective in Eq. (13). The paper asserts this discrete abstraction for AVTrack, SGLATrack, and LGTrack but does not verify the inference-time gating behavior of those released trackers. If any victim uses soft routing (e.g., sigmoid-weighted activation, Gumbel-softmax sampling, stochastic gates, or a differentiable top-k selection) at inference, the step-function model does not hold, Eq. (7)'s unbounded local Lipschitz constant is not realized, and the claimed topology-path-based mechanism is not established. This is load-bearing because the ablation in Table 4 and the counterfactual path experiment in Appendix A.1 attribute the attack's damage specifically to path inversion; if the gates are not hard, that causal attribution collapses even if the empirical precision/success drops are real and reproducible. The theoretical claim would then reduce to ordinary feature-level adversarial sensitivity, not a new structural singularity.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies adversarial attacks against adaptive transformer trackers whose layer execution is input-dependent. The authors argue that deterministic binary gating decisions produce discontinuous input-output mappings with unbounded local Lipschitz constants at decision boundaries (Section 3.2), and they exploit this with the Adversarial Path-Inversion (API) framework, a generator trained with gate-logit inversion, response-map suppression, feature-space disruption, and reconstruction losses. The main experiments report large precision and success-rate drops on AVTrack, SGLATrack, and LGTrack across six UAV benchmarks, with ablations and a counterfactual route-restoration experiment in Appendix A.1 indicating that the path-inversion objective is the main driver of attack strength.","tokens_in":19948,"tokens_out":9619,"duration_ms":89558,"significance":"If the claimed mechanism is verified, the paper identifies a practically relevant attack surface for adaptive trackers and demonstrates an attack that dominates existing baselines in both potency and speed. The empirical study is unusually thorough: three victim architectures, six benchmarks, baseline attacks retrained for AVTrack, efficiency comparisons, cross-architecture transfer analysis, a causal decomposition experiment, and multiple ablations. The main weakness is that the theoretical preamble is largely a restatement of the fact that step functions are discontinuous, and its applicability to the named trackers depends on an unverified hard-gate assumption. The empirical contribution is plausible and well structured, but the explanatory claim about a new 'Lipschitz singularity' needs to be either verified or substantially reframed.","major_comments":[{"comment":"The central theoretical claim is built entirely on the assumption that each routing decision is a deterministic hard binary threshold, pi(x)=I(g(x)>tau). The paper states this abstraction for AVTrack, SGLATrack, and LGTrack but does not verify the inference-time gating behavior of the released implementations. If any of these trackers uses soft routing, stochastic gates, or a differentiable relaxation at inference, Eq. (7) does not hold for that tracker, and the attack would reduce to ordinary feature-level sensitivity rather than a topological singularity. Because the ablation in Table 4 and the counterfactual path experiment in Appendix A.1 attribute the damage specifically to path inversion, this assumption is load-bearing. Please inspect the official code, report the exact gating function used at inference for each victim, and either prove hard gating or narrow the theoretical claim to trackers with hard gates.","section":"Section 3.2, Eq. (2)"},{"comment":"Eq. (7) is a correct observation about any hard-switch function: a step discontinuity yields an unbounded supremum of output-change over input-change in the limit. As a statement, however, it is a restatement of the definition of discontinuity rather than a tracking-specific theorem, so the claimed 'formal characterization' of adaptive tracking adds little beyond the abstraction in Eq. (2). Moreover, the unbounded local Lipschitz constant is a local property on the boundary manifold, and the paper does not show that clean tracking inputs typically lie close enough to gating boundaries for an epsilon=0.025 perturbation to cross them. To make the theoretical claim load-bearing, the authors should report the distribution of gating margins g(x)-tau, relate the margin distribution to flip rates under the API objective, and present this as the actual instability mechanism.","section":"Section 3.2, Eqs. (5)-(7)"},{"comment":"The 'cascade amplification' mechanism is asserted rather than demonstrated. The depth-stratified flip rates in Table 6 (shallow ~4.8%, deep ~89.9%) are consistent with a cascade, but they are also consistent with depth-dependent gate thresholds, different feature sensitivities, or simply larger margins in shallow gates. The paper even labels the process 'mathematically proven' without providing a proof. Please add an intervention that isolates the cascade: for example, freeze or randomize the early gates, measure whether deep flip rates change accordingly, and quantify how much of the deep flip rate survives when early flips are suppressed. Without such evidence, the explanatory story in Section 4.3 should be weakened.","section":"Section 4.3 and Appendix A.2"}],"minor_comments":[{"comment":"The path-inversion objective uses the pre-sigmoid gating logits of the frozen victim and therefore requires white-box access to every gating module. This is a legitimate threat model, but it should be stated explicitly and prominently, including the absence of a black-box or query-based variant, so that the scope of the claimed attack surface is clear.","section":"Section 3.3, Eq. (13)"},{"comment":"In Eq. (18), the notation \\hat R_i is used as the target response map but is not defined, and the text says the response map is suppressed 'toward a uniform distribution' while the formula appears to use a fixed reference; please clarify the definition of \\hat R_i and \\hat x_i.","section":"Section 3.3, Eq. (18)"},{"comment":"The 'Full API' row differs between Table 4 (DTB70 Succ. 8.2) and Table 9 (DTB70 Succ. 10.11) despite both being described as the full model under comparable budgets; please explain the discrepancy or match the reporting conditions.","section":"Tables 4 and 9"},{"comment":"There is a broken reference 'Figure??' in the text describing the distribution of Recovery and Injection Ratios; please fix the reference and ensure all appendix figures have descriptive captions.","section":"Appendix A.1"},{"comment":"The paper repeatedly mentions supplementary materials and claims reproducible experimental design, but no code or supplementary document is provided; please state the release plan for code and trained generators, which is particularly important for a security paper.","section":"Experimental Settings"},{"comment":"All numerical results are single-run values without standard deviations or confidence intervals; given the strength of the claims, reporting variance across at least a few seeds or benchmarks would improve reliability.","section":"Tables 1 and 3"}],"recommendation":"major_revision","confidential_remarks":"The main stress-test concern about hard versus soft inference-time gating is valid and should be the focus of the revision. If the authors can produce direct evidence of deterministic hard gating from official implementations, the empirical contribution is likely strong enough for publication after the theoretical framing is corrected. If such evidence is not available, the paper should be reframed as a white-box attack on hard-gated adaptive trackers, with the singularity argument downgraded accordingly. I also note the absence of code and supplementary materials as a reproducibility concern."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nHere's my read on arXiv:2608.03902. The actual contribution is the API framework: an offline generator that flips the layer-skipping decisions in adaptive UAV trackers, and the experiments are fairly convincing. On AVTrack, SGLATrack, LGTrack, across six benchmarks, it beats established tracking attacks by a wide margin, and the ablations show the path-inversion term is the main driver. The counterfactual path-surgery study in Appendix A.1 is a good idea—restoring clean routing recovers most of the damage, and injecting adversarial routing onto clean inputs reproduces a good chunk of it. That is the strongest evidence for the causal claim, and it is the part I would want a reviewer to dig into.\n\nThe theory is not new. Equation (7) simply states that a step function has an unbounded ratio of output change to input change across the boundary. Calling it a 'Lipschitz singularity' is a repackaging. If the paper had framed it as 'adaptive trackers use hard gates, and hard gates are discontinuous, so expect sensitivity near thresholds,' that would be accurate. The 'for the first time' novelty claim is also too strong—DeepSloth and SlowFormer already attacked dynamic routing, even if for different objectives.\n\nTwo soft spots matter. First, the binary-gate assumption is load-bearing and not verified. The paper asserts AVTrack, SGLATrack, and LGTrack use deterministic hard thresholds, but never checks the released code. If any of them uses soft or stochastic gating at inference, Eq. (2) does not describe it, and the unbounded-Lipschitz story collapses even though the attack might still work by ordinary feature corruption. The authors need to show the actual gating function for each tracker. Second, the white-box requirement: Lpath needs access to pre-sigmoid gating logits. That is a legitimate threat model, but it should be stated clearly rather than implied.\n\nThere are also presentation issues: a 'Figure ??' in Appendix A.1, a reference to a nonexistent 'Section F' in B.1, and some unsupported phrases like 'mathematically proven amplification' in Figure 3. Those are fixable.\n\nOverall, the empirical attack is solid and the causal analysis is a genuine step beyond prior dynamic-routing attacks. It deserves peer review, probably as a major-revision—verify the gating behavior, temper the theoretical claims, release code, and clean up the references. A serious referee will need to check whether the path-surgery experiment really isolates routing, which is the paper's key evidence.\n\nRecommendation: send it to review.","headline":"A solid empirical attack paper with a thin theoretical frame; the path-inversion mechanism is plausible and mostly supported by ablations, but the 'singularity' is just a step function and the binary-gate assumption is unverified.","tokens_in":20401,"tokens_out":3808,"would_cite":false,"duration_ms":33215,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hard-threshold layer skipping gives adaptive trackers an unbounded local sensitivity, and path-inversion attacks exploit it.","keywords":["Object tracking","Feature Deception","Dynamic Neural Networks","Adversarial Attack","Efficient Visual Tracking","Lipschitz singularity","Path inversion"],"falsifier":"Record actual routing behavior near a gating boundary in AVTrack by computing the output difference for inputs on opposite sides of a real decision boundary as the perturbation size shrinks to machine precision. If the ratio stays bounded, or if the deployed model uses soft routing or stochastic sampling at inference, the unbounded-Lipschitz claim is false; if the ratio diverges as the singularity equation predicts, the claim is confirmed.","tokens_in":19345,"feed_emoji":"🎯","tokens_out":9657,"duration_ms":82112,"temperature":0.7,"pith_summary":"This paper argues that adaptive Transformer trackers—networks that save computation by letting each input decide which Transformer blocks to skip—carry a structural flaw. Because the skip decision is a hard binary threshold, the network's local Lipschitz constant is infinite at every decision boundary, so an infinitesimal perturbation can flip the computational path. The paper proposes Adversarial Path-Inversion (API), a perturbation generator that deliberately flips the gates, and reports that this collapses tracking precision by over 80% and success rate by over 85% on the AVTrack baseline across six UAV benchmarks. If true, the finding turns computation-on-demand from a pure efficiency win into a security liability: conditional computation must be treated as an attack surface, not just a speed device.","feed_headline":"Router-flip attack crashes adaptive trackers by inverting gates","feed_subtitle":"API forces gates that would skip a block to run it, and vice versa, cutting precision by more than 80%.","key_machinery":"The load-bearing object is the step-function gate $\\pi(x)=\\mathbb{I}(g(x)>\\tau)$ that switches between an active branch $f_{\\mathrm{act}}(x)$ and a skip branch $f_{\\mathrm{skip}}(x)$. Because the gate is an indicator, sitting on the boundary manifold $D_b=\\{x:g(x)=\\tau\\}$ gives a finite output gap $D=\\|f_{\\mathrm{act}}(x_0)-f_{\\mathrm{skip}}(x_0)\\|_p$ over an input gap that goes to zero, so the local Lipschitz constant $L(x_0)\\ge \\lim_{\\epsilon\\to0^+}D/(2\\epsilon)$ is infinite. API exploits this by training a perturbation generator with the path-inversion objective $\\mathcal{L}_{\\text{path}}$ that flips the sign of pre-sigmoid gating logits, guided by the saliency module SGPF and completed by response-suppression and reconstruction terms.","core_discovery":"On the paper's own terms, the discovery is that the efficiency mechanism itself is the vulnerability. The gate $\\pi(x)=\\mathbb{I}(g(x)>\\tau)$ makes the network's overall map piecewise discontinuous: an adversarial point pair straddling the decision boundary has vanishing input distance but a non-vanishing output distance $D=\\|f_{\\mathrm{act}}(x_0)-f_{\\mathrm{skip}}(x_0)\\|_p$, which makes the local Lipschitz constant $L(x_0)\\ge \\lim_{\\epsilon\\to 0^+}D/(2\\epsilon)=\\infty$. The paper then shows this singularity is directly exploitable. The Adversarial Path-Inversion framework learns a perturbation generator whose path-inversion objective pushes pre-sigmoid gating logits across zero, so active blocks are skipped and skipped blocks are activated, while a response-suppression objective collapses the localization map. Across six UAV benchmarks, AVTrack's average precision drops by over 80% and success rate by over 85%, and counterfactual path experiments—restoring clean routing to an adversarial input recovers most of the performance, while injecting adversarial routing into a clean input alone reproduces about 40.8% of the damage—support the claim that topology inversion, not pixel-level semantic corruption, is the dominant cause.","pith_inferences":["Editorial inference: the unbounded-Lipschitz argument is generic to hard-switch computation, so API-style path inversion should transfer to other conditional networks such as early-exit classifiers, hard-gated mixtures of experts, or input-dependent LLM routing.","Editorial inference: because the attack needs pre-sigmoid gate logits, a natural next test is a black-box variant that probes gate decisions only through final outputs or timing; the present experiments do not rule that out.","Editorial inference: softening the gate, for example with a sigmoid of finite temperature, would bound the local Lipschitz constant, so a testable prediction of the paper is that API's advantage shrinks as the gate becomes softer.","Editorial inference: the reported lead-lag correlation between route flips and IoU drops suggests an online attack that anticipates boundary crossings, or a defense that monitors flip rates as an early-warning signal."],"forward_implications":["Path inversion is the causal driver of the attack: when the original routing is restored to an adversarial input, most tracking performance returns, so the topology switch itself, not the pixel noise, is what breaks the tracker.","Any adaptive tracker that bases routing on a hard threshold is brittle exactly at inputs that sit near its decision boundaries, meaning efficiency-oriented gating creates a new security surface.","The attack generalizes across adaptive architectures: API degrades AVTrack, SGLATrack, and LGTrack on six UAV benchmarks, with a weaker effect on LGTrack because it routes only three blocks.","Defenses proposed in the paper target the gate itself: randomizing gating decisions, softening the routing boundary, or using topology-aware adversarial training."],"supporting_citations":[{"why":"supplies AVTrack, the primary victim model whose dynamic activation gates define the routing boundaries API inverts.","marker":"[38]"},{"why":"supplies SGLATrack, the second victim; its selection module is the gating mechanism targeted by API.","marker":"[43]"},{"why":"supplies LGTrack, the third victim; its limited number of routed blocks explains the weaker attack effect.","marker":"[49]"},{"why":"defines the RTAA optimization attack baseline that API outperforms and whose temporal segment treatment informs the path-inversion training.","marker":"[22]"},{"why":"defines the ICAttack baseline and the intra-modal excitation design that API's generator branches build on.","marker":"[39]"},{"why":"defines Ad2Attack, an existing UAV-tracking attack baseline that API compares against on precision and success.","marker":"[16]"},{"why":"is the prior dynamic-routing attack on multi-exit classifiers whose objective API distinguishes from its own path inversion.","marker":"[20]"},{"why":"is the SlowFormer dynamic-routing attack on efficient vision transformers that API transfers and compares to in the tracking setting.","marker":"[31]"}],"fun_headline_variants":["Efficient trackers hide infinite instability","Path-flip attack exploits efficiency flaw in trackers","Tiny perturbation flips router, crashes adaptive trackers","Gating singularity exposes new attack surface in tracking","Router-flip attack crushes tracker accuracy by 80%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire argument rests on the assumption that the victim trackers route with a deterministic hard threshold on a gate score at inference time, and that the attacker can read the pre-threshold gate logits; the paper asserts this binary behavior for AVTrack, SGLATrack, and LGTrack but does not verify their exact inference-time gating or treat black-box access.","fun_headline_variants_meta":{"raw":{"variants":["Efficient trackers hide infinite instability","Path-flip attack exploits efficiency flaw in trackers","Tiny perturbation flips router, crashes adaptive trackers","Gating singularity exposes new attack surface in tracking","Router-flip attack crushes tracker accuracy by 80%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000263,"raw_usage":{"total_tokens":1666,"prompt_tokens":1074,"completion_tokens":592,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":690,"completion_tokens_details":{"reasoning_tokens":517}},"tokens_in":690,"tokens_out":592,"duration_ms":6169,"temperature":1.0,"reasoning_tokens":517,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T04:13:21.090598+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Record actual routing behavior near a gating boundary in AVTrack by computing the output difference for inputs on opposite sides of a real decision boundary as the perturbation size shrinks to machine precision. If the ratio stays bounded, or if the deployed model uses soft routing or stochastic sampling at inference, the unbounded-Lipschitz claim is false; if the ratio diverges as the singularity equation predicts, the claim is confirmed.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"defines the ICAttack baseline and the intra-modal excitation design that API's generator branches build on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"defines Ad2Attack, an existing UAV-tracking attack baseline that API compares against on precision and success."}],"review_version":2}