Pith. sign in

REVIEW 4 major objections 6 minor 47 references

Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that DiffDf, a diffusion-model input purifier trained with pixel, semantic, and structural losses, restores most tracking accuracy lost to CSA adversarial attacks, recovering 89.3–94.4% of the un-attacked baselines while…

desk verdict A plausible first application of diffusion purification to tracking, with solid evidence for non-adaptive CSA attacks but claims that far outrun the evaluation. read the letter →

arxiv 2506.00325 v1 pith:BFM7JHXL submitted 2025-05-31 cs.CV

Long Xu , Peng Gao , Wen-Jia Tang , Fei Wang , Ru-Yue Yuan This is my paper
classification cs.CV
keywords adversarialdefensevisualtrackingdiffusionmodelDDPMCSAattackinputpurificationmulti-scalelossrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DiffDf is offered as the first diffusion-model defense for visual tracking: an input-level purifier that removes adversarial perturbations before the tracker sees the frame, leaving the tracker's architecture unchanged. The paper argues that a denoising diffusion probabilistic model (DDPM), trained on adversarial/clean image pairs, can strip CSA-style attacks and that the added pixel, semantic, and structural losses make the restoration stable enough to rescue tracking. On SiamRPN++, the attack drops VOT2018 EAO from 0.374 to as low as 0.073, and DiffDf restores it to 0.305–0.341 depending on attack location; on OTB2015 the Success rate recovers to 94.4% of baseline, and the defense transfers to DaSiamRPN and DiMP50. A sympathetic reader would care because this promises a plug-and-play robustness layer for a safety-critical task, without retraining the tracker.

What carries the argument

The load-bearing object is the DDPM denoising chain combined with a multi-scale loss. In the forward process the adversarial example is perturbed to $x_t = \sqrt{\bar{\alpha}_t} x' + \sqrt{1-\bar{\alpha}_t}\epsilon$, and a U-Net with time-step embeddings predicts $\epsilon$; the reverse update steers the image back toward the clean manifold. The total objective is $L_{\text{total}} = L_{\text{simple}} + \lambda_1 L_{\text{pixel}} + \lambda_2 L_{\text{semantic}} + \lambda_3 L_{\text{ssim}}$, with $\lambda_1=1$, $\lambda_2=5$, $\lambda_3=10$, where $L_{\text{pixel}}$ is noise-prediction/reconstruction error, $L_{\text{semantic}}$ aligns conv4_x features of a frozen ResNet-50, and $L_{\text{ssim}}$ preserves local structure through the SSIM metric. This joint constraint is what the paper credits for suppressing adversarial perturbations while preserving target cues, and for transferring across trackers.

What would settle it

Run the trained DiffDf against the black-box IoU attack on OTB2015 and compare Success to the reported CSA-S numbers (attacked 0.346, defended 0.658); if Success stays near the attacked level, the generalized defense claim is false. Alternatively, run an adaptive white-box CSA attack that differentiates through the full DiffDf-plus-tracker pipeline and check whether the VOT2018 EAO recovery of 0.332 collapses.

Watch

Extended reading notes

Core claim

The paper's central discovery is that adversarial defense for visual tracking can be modeled as a diffusion-denoising problem: add Gaussian noise to the adversarial frame, then reverse the process with a U-Net that predicts the injected noise, and the output approximates the clean input closely enough for the tracker to recover. To keep the restored image faithful at multiple levels, DiffDf combines the standard DDPM noise-prediction loss with a pixel-level L2 reconstruction loss, a semantic consistency loss computed on ResNet-50 conv4_x features, and an SSIM-based structural loss. Under white-box CSA attacks on the template (CSA-T), search region (CSA-S), or both (CSA-TS), the method recovers 89.3% to 94.4% of the original EAO/Success in the main experiments, e.g. VOT2018 EAO from 0.090 back to 0.332 under CSA-S, and LaSOT Success from 0.168 back to 0.466 under CSA-TS. The paper also reports real-time inference above 30 FPS, and transfer across SiamRPN++, DaSiamRPN, and DiMP50.

Load-bearing premise

The load-bearing premise is that the kinds of attack noise the defense was trained on are representative of all attacks a tracker might face, and that the attacker will not adapt to the presence of the defense.

Editorial extensions

If this is right

  • Any existing tracker can be hardened by prepending DiffDf without retraining or modifying the tracker, since the defense is an input-level module.
  • Under CSA-T on VOT2018, EAO recovers to 0.341 versus a 0.374 clean baseline, implying template attacks can be almost fully neutralized.
  • On OTB2015 under CSA-S, Success recovers from 0.346 to 0.658 (94.4% of the 0.697 baseline), showing search-region attacks are also largely neutralized.
  • The same trained purifier improves both DaSiamRPN and DiMP50 on LaSOT, indicating the defense is not tied to one tracker's architecture.
  • The defense runs at 34 FPS end-to-end with SiamRPN++, so it remains real-time despite the multi-step diffusion process.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper trains on CSA and IoU adversarial pairs but evaluates only on CSA; a natural next test is to run the same DiffDf against the black-box IoU attack, where the reported recovery rates would show whether the learned denoiser generalizes beyond its training attack.
  • An adaptive adversary who knows DiffDf is present could generate CSA perturbations by back-propagating through the full denoising-plus-tracking pipeline; the paper does not test this, and such attacks often reduce purification defenses.
  • Because the defense is decoupled from the tracker, the paper's own discussion suggests an end-to-end variant that optimizes the tracker's loss through the purifier could surpass the reported recoveries, though it would sacrifice plug-and-play generality.
  • The multi-scale loss prescription (pixel+semantic+SSIM) is transferable as a recipe to other restoration tasks, but the specific weights $\lambda_1=1$, $\lambda_2=5$, $\lambda_3=10$ may need retuning for other domains like infrared or remote sensing.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes DiffDf, an input-level adversarial purification method for visual trackers based on a DDPM U-Net. DiffDf is trained on GOT-10k image pairs consisting of clean frames and adversarial examples generated with the white-box CSA attack and the black-box IoU attack, using a loss that combines standard noise prediction with semantic consistency and SSIM terms. At inference, the adversarial frame is passed through the reverse diffusion process and the denoised image is fed into an unmodified tracker. Experiments on VOT2018, OTB2015, and LaSOT with SiamRPN++, DaSiamRPN, and DiMP50 report large recovery of EAO and success metrics under CSA attacks, e.g., EAO recovering from 0.090 to 0.332 (89.3% of the 0.374 baseline), plus an efficiency analysis showing about 34 FPS.

Significance. If the reported robustness holds against a broader range of attacks, DiffDf would be a useful plug-and-play defense for visual tracking and appears to be the first diffusion-based purification method applied to this task. The paper has clear strengths: it evaluates three trackers of different architectures on three benchmarks, includes ablation studies of the loss components, provides an efficiency analysis, and states that code will be released. The main significance is conditional, however, because the current experimental evidence is limited to non-adaptive white-box attacks from the same CSA family used to build part of the training data. The contribution is therefore potentially valuable but not yet convincingly established as a general defense.

major comments (4)
  1. [Section 4.1 and Section 4.2] The defense is trained on adversarial examples from both the white-box CSA attack and the black-box IoU attack (Section 4.1), but all numerical evaluations in Sections 4.2 through 4.5 and 4.7 use only CSA variants. No result is reported for the IoU attack or for any held-out attack family, so the abstract's claim of defense against 'various types of attacks' is not supported by the data. More importantly, every CSA attack is generated against the tracker alone, without DiffDf in the loop; there is no adaptive attack that differentiates through the purification process and no expectation-over-transformation evaluation. For input-purification defenses, this is a known failure mode: an adversary aware of the defense can often recover much of the attack strength. The reported recovery rates of 89.3%-94.4% should therefore be presented as results under a non-adaptive white-box setting, and the paper should include held-out attack and adaptive attack experiments before claiming general robustness.
  2. [Equation (18) and Equation (10)] The pixel-level reconstruction loss in Eq. (18) is defined as E[||epsilon_theta(x_t,t) - epsilon_t||^2], which is identical to the standard noise-prediction loss L_simple in Eq. (10). Consequently, L_pixel is not a separate pixel-level reconstruction term, and the hyperparameter lambda_1 merely reweights the same objective. The surrounding text says the loss constrains the L2 distance between the denoised example D(x') and the clean image x, but the formula contains neither D(x') nor x. In addition, the reparameterization in Eq. (18) uses sqrt(alpha_t) while the forward process in Eq. (15) uses sqrt(bar_alpha_t), so the notation is internally inconsistent. This issue affects the claim of a multi-scale loss mechanism and the ablation in Table 5, where the row labeled 'L_pixel only' cannot be distinguished from a scaled version of L_simple. Please either replace Eq. (18) with an explicit reconstruction term involving D(x') and x, or state clearly that the pixel-level constraint is already contained in L_simple and remove L_pixel from the decomposition.
  3. [Section 4.5 and Table 3] The text describing Table 3 does not match the numbers in the table. The paragraph quotes accuracy 0.508, robustness 1.456, lost number 311, and EAO 0.090 for the CSA-T attack, but those numbers are the CSA-S row of Table 1; the actual CSA-T row in Table 3 has 0.541, 1.147, 245, and 0.123. The prose also claims the Gaussian filter improves accuracy by 12% and 14%, whereas the table values give an improvement of about 5% (0.568 vs. 0.541), and the baseline is quoted as 0.604 instead of the 0.609 shown elsewhere. These inconsistencies make the quantitative comparison unreliable and must be corrected.
  4. [Section 4.5 and Section 4.2] The defense comparison is limited to Gaussian and median filtering (Table 3), even though the related work section cites diffusion-based purification methods such as GDMP and DiffPure. Without a comparison against at least one diffusion-purification baseline, the claim that the multi-scale design is responsible for the improvement over existing defenses is not established. In addition, all metrics are reported from a single run, despite the stochastic reverse sampling in the method; error bars or results over multiple seeds should be provided to support the stability of the recovery rates.
minor comments (6)
  1. [Abstract and Keywords] The keyword 'denosing' should be 'denoising'.
  2. [Equation (6)] The expression 'sqrt(alpha_t - 1) beta_t' is ambiguous; it should be written as sqrt(alpha_{t-1}) beta_t or with explicit parentheses, and the line is otherwise difficult to parse.
  3. [Equation (3)] The derivation of x_2 omits the deterministic term involving x_0; the variance computation is correct but the presentation should include the full recursive expansion for clarity.
  4. [Figure 6 caption] The caption contains an unexplained line of numbers ('88 288 368 458 ...') that appears to be a formatting artifact; these frame indices should either be removed or presented as a proper list.
  5. [Section 4.4 and Figure 7] The text does not state the original (unattacked) values for DaSiamRPN and DiMP50; including them in the text would make the recovery rates easier to verify against the figure.
  6. [Section 3.3] The description of the SSIM loss uses notation mu_D and mu_x that is not defined at first use; please clarify that these are local means of the denoised and clean images, respectively, and specify whether the loss is averaged over spatial windows.

Circularity Check

2 steps flagged · score 2.0 of 10

No significant circularity; the central claim is empirical and self-contained, but the pixel-level loss is a relabeled standard DDPM loss and the main evaluation uses the same CSA attack family used in training.

  1. renaming known result [Section 3.3, Eq. (10), Eq. (18), and Eq. (21)]
    "Lsimple = Et,x0,ϵ[∥ϵ − ϵθ(xt, t)∥2], (10) ... Lpixel = Ex,δ,t[∥ϵθ(xt, t) − ϵt∥2], (18) ... Ltotal = Lsimple + λ1Lpixel + λ2Lsemantic + λ3Lssim, (21)"

    Eq. (18) is the same expectation as Eq. (10) with the noise variable relabeled (epsilon_t vs epsilon). The paper presents this as a separate pixel-level reconstruction loss in the multi-scale objective, but since Ltotal adds Lsimple and Lpixel, the pixel-level 'constraint' is just a rescaling of the standard DDPM noise-prediction loss by (1 + lambda1). This is an exact identity by construction, so the claimed pixel-level reconstruction loss is a relabeled version of the standard loss rather than an independent new term. It is redundancy, not a circular derivation of the empirical results.

  2. fitted input called prediction [Section 4.1 Experimental Settings and Section 4.2 Comparison results]
    "we construct the training data by generating adversarial examples using various adversarial attack methods from visual tracking tasks (e.g., white-box CSA attack[32] and black-box IoU attack[11]) ... we conducted experimental comparisons using the white-box CSA attack method[32] and the SiamRPN++[10] tracker on three mainstream datasets"

    The defense model is trained on adversarial examples from the CSA attack family and all main numerical evaluations (Tables 1-5, Figs. 4-7) are against CSA variants. The reported recovery rates of 89.3%-94.4% are therefore measured on the same attack family used to fit the denoiser, so the headline results partly reflect fitting to the training attack distribution rather than a prediction for unseen attack families. The black-box IoU attack mentioned in training is never evaluated numerically, so the claim of defense against 'various types of attacks' is not tested on a held-out attack family. This is a same-distribution fit/evaluation gap rather than a definitional equivalence, and the experiments still independently compare against baselines and multiple trackers.

full rationale

The paper's contribution is empirical rather than a derivation, so the strongest circularity patterns do not apply: there is no load-bearing self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via citation. The one exact identity is Eq. (18) versus Eq. (10), where the pixel-level reconstruction loss is the same noise-prediction expectation as the standard DDPM objective; adding both in Eq. (21) merely rescales Lsimple. That is a redundant relabeling, but it does not force the experimental outcome. The more substantive concern is that the model is trained on CSA adversarial examples and then evaluated almost exclusively on CSA variants, with the IoU attack mentioned in training never assessed, so the 'various types of attacks' generalization claim is not demonstrated. This is a fit-and-test-on-the-same-family limitation rather than a circular derivation, and the paper does provide independent comparisons against Gaussian/median filtering, across multiple trackers and datasets. Internal inconsistencies, such as Section 4.5 discussing CSA-S numbers under the CSA-T heading, are correctness risks rather than circularity. Overall circularity is minor, consistent with a score of 2.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or mathematical entities. The free parameters are the three loss weights and the diffusion schedule, all chosen by hand with no sensitivity analysis. The key domain assumptions are that diffusion denoising removes adversarial perturbations and that training on CSA examples transfers to other attacks.

free parameters (4)
  • loss weight lambda_1 (Lpixel) = 1
    Set by hand in Section 4.1; no sensitivity analysis; Eq. 21 weights Lpixel which is identical to Lsimple, so the effective weight on the standard noise-prediction loss is 2.
  • loss weight lambda_2 (Lsemantic) = 5
    Hand-chosen in Section 4.1; no ablation over the value.
  • loss weight lambda_3 (Lssim) = 10
    Hand-chosen in Section 4.1; no ablation over the value.
  • diffusion timesteps and inference schedule = T=1000 (implied), inference steps unspecified
    The text mentions t close to 1000 and Figure 2 shows T steps, but the exact schedule and number of reverse steps used at inference are not given. The reported FPS depends on this choice.
assumptions (4)
  • standard math Standard DDPM forward/reverse formulation from Ho et al. (Eqs. 1-10)
    Used as the backbone; assumed correct.
  • domain assumption Adversarial perturbations can be modeled as removable Gaussian-like noise via progressive denoising
    Central premise of the defense in Section 3.3; no theoretical justification that adversarial perturbations lie in the diffusion denoising manifold.
  • domain assumption Adversarial examples generated with CSA and IoU attacks on GOT-10k are representative of test-time attacks
    Training data construction in Section 4.1; only CSA is tested, so the transferability premise is unverified.
  • domain assumption Pretrained ResNet50 conv4_x features provide a semantically meaningful and stable space for the consistency loss
    Eq. 19 depends on the features being stable under denoising and appropriate for tracking targets.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking." pith.science (2026). https://pith.science/paper/BFM7JHXL

@misc{pith2026250600325,
  author       = {Pith},
  title        = {Pith review of: Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BFM7JHXL}},
  note         = {Machine review of arXiv:2506.00325}
}
read the original abstract

Although deep learning-based visual tracking methods have made significant progress, they exhibit vulnerabilities when facing carefully designed adversarial attacks, which can lead to a sharp decline in tracking performance. To address this issue, this paper proposes for the first time a novel adversarial defense method based on denoise diffusion probabilistic models, termed DiffDf, aimed at effectively improving the robustness of existing visual tracking methods against adversarial attacks. DiffDf establishes a multi-scale defense mechanism by combining pixel-level reconstruction loss, semantic consistency loss, and structural similarity loss, effectively suppressing adversarial perturbations through a gradual denoising process. Extensive experimental results on several mainstream datasets show that the DiffDf method demonstrates excellent generalization performance for trackers with different architectures, significantly improving various evaluation metrics while achieving real-time inference speeds of over 30 FPS, showcasing outstanding defense performance and efficiency. Codes are available at https://github.com/pgao-lab/DiffDf.

Figures

Figures reproduced from arXiv: 2506.00325 by the authors.

Figure 1
Figure 1. Response map comparisons of the SiamRPN++[ [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overall pipeline of our proposed DDPM-based adversarial defense method, DiffDf. [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. The convergence curves of the pixel-level reconstruction loss, semantic consistency loss, [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Success plots of our proposed DiffDf method on defending the SiamRPN++ tracker[ [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Precision plots of our proposed DiffDf method on defending the SiamRPN++ tracker[ [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Visualization of tracking results of SiamRPN++[ [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: The transferability validation results of our proposed DiffDf defense method on trackers [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Performance comparison of different defense methods using SiamRPN++[ [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Visual comparison of the effects of different defense methods on the target templates of the [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 37 canonical work pages

  1. [1]

    Zhang, Y

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, M. Jordan, Theoretically principled trade-off between robustness and accuracy, in: International conference on machine learning, PMLR, 2019, pp. 7472–7482

    work page 2019

  2. [2]

    Chen, J.-H

    H.-Y . Chen, J.-H. Liang, S.-C. Chang, J.-Y . Pan, Y .-T. Chen, W. Wei, D.-C. Juan, Improving adversarial robustness via guided complement entropy, in: Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 4881–4889

    work page 2019

  3. [3]

    G. K. Dziugaite, Z. Ghahramani, D. M. Roy, A study of the effect of jpg compression on adversarial images, arXiv preprint arXiv:1608.00853

    arXiv

  4. [4]

    W. Xu, D. Evans, Y . Qi, Feature squeezing: Detecting adversarial examples in deep neural networks, arXiv preprint arXiv:1704.01155

    arXiv

  5. [5]

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, J. Zhu, Defense against adversarial attacks using high-level representation guided denoiser, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 1778–1787

    work page 2018

  6. [6]

    Improving Adversarial Robustness via Attention and Adversarial Logit Pairing

    D. Goodman, X. Li, J. Liu, D. Dou, T. Wei, Improving adversarial robustness via attention and adversarial logit pairing, arXiv preprint arXiv:1908.11435

    work page Pith review arXiv 1908

  7. [7]

    J. Ho, A. Jain, P. Abbeel, Denoising diffusion probabilistic models, Advances in neural informa- tion processing systems 33 (2020) 6840–6851

    work page 2020

  8. [8]

    J. Wang, Z. Lyu, D. Lin, B. Dai, H. Fu, Guided diffusion model for adversarial purification, arXiv preprint arXiv:2205.14969

    arXiv

Show all 47 references
  1. [9]

    W. Nie, B. Guo, Y . Huang, C. Xiao, A. Vahdat, A. Anandkumar, Diffusion models for adversarial purification, arXiv preprint arXiv:2205.07460

    arXiv

  2. [10]

    B. Li, W. Wu, Q. Wang, F. Zhang, J. Xing, J. Yan, Siamrpn++: Evolution of siamese visual tracking with very deep networks, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4282–4291

    2019

  3. [11]

    S. Jia, Y . Song, C. Ma, X. Yang, Iou attack: Towards temporally coherent black-box adversarial attack for visual object tracking, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 6709–6718

    2021

  4. [12]

    Bertinetto, J

    L. Bertinetto, J. Valmadre, J. F. Henriques, A. Vedaldi, P. H. Torr, Fully-convolutional siamese networks for object tracking, in: European conference on computer vision, Springer, 2016, pp. 850–865

    2016

  5. [13]

    B. Li, J. Yan, W. Wu, Z. Zhu, X. Hu, High performance visual tracking with siamese region proposal network, in: Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 8971–8980

    2018

  6. [14]

    W. Hu, Q. Wang, L. Zhang, L. Bertinetto, P. H. Torr, Siammask: A framework for fast online object tracking and segmentation, IEEE Transactions on Pattern Analysis and Machine Intelligence 45 (3) (2023) 3072–3089

    2023

  7. [15]

    G. Bhat, M. Danelljan, L. V . Gool, R. Timofte, Learning discriminative model prediction for tracking, in: Proceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 6182–6191. 20

    2019

  8. [16]

    Danelljan, G

    M. Danelljan, G. Bhat, F. S. Khan, M. Felsberg, Atom: Accurate tracking by overlap maximiza- tion, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4660–4669

    2019

  9. [17]

    Danelljan, L

    M. Danelljan, L. V . Gool, R. Timofte, Probabilistic regression for visual tracking, in: Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 7183–7192

    2020

  10. [18]

    X. Chen, B. Yan, J. Zhu, D. Wang, X. Yang, H. Lu, Transformer tracking, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 8126–8135

    2021

  11. [19]

    B. Yan, H. Peng, J. Fu, D. Wang, H. Lu, Learning spatio-temporal transformer for visual tracking, in: Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 10448–10457

    2021

  12. [20]

    Y . Cui, C. Jiang, L. Wang, G. Wu, Mixformer: End-to-end tracking with iterative mixed attention, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 13608–13618

    2022

  13. [21]

    S. Yan, N. Dong, L. Zhang, J. Tang, Clip-driven fine-grained text-image person re-identification, IEEE Transactions on Image Processing 32 (2023) 6032–6046

    2023

  14. [22]

    N. Dong, L. Zhang, S. Yan, H. Tang, J. Tang, Erasing, transforming, and noising defense network for occluded person re-identification, IEEE Transactions on Circuits and Systems for Video Technology 34 (6) (2023) 4458–4472

    2023

  15. [23]

    N. Dong, S. Yan, H. Tang, J. Tang, L. Zhang, Multi-view information integration and propagation for occluded person re-identification, Information Fusion 104 (2024) 102201

    2024

  16. [24]

    Szegedy, W

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, R. Fergus, Intriguing properties of neural networks, arXiv preprint arXiv:1312.6199

    arXiv

  17. [25]

    I. J. Goodfellow, J. Shlens, C. Szegedy, Explaining and harnessing adversarial examples, arXiv preprint arXiv:1412.6572

    arXiv

  18. [26]

    Madry, A

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, A. Vladu, Towards deep learning models resistant to adversarial attacks, arXiv preprint arXiv:1706.06083

    arXiv

  19. [27]

    Carlini, D

    N. Carlini, D. Wagner, Towards evaluating the robustness of neural networks, in: IEEE sympo- sium on security and privacy, Ieee, 2017, pp. 39–57

    2017

  20. [28]

    P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, C.-J. Hsieh, Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models, in: Proceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26

    2017

  21. [29]

    Brendel, J

    W. Brendel, J. Rauber, M. Bethge, Decision-based adversarial attacks: Reliable attacks against black-box machine learning models, arXiv preprint arXiv:1712.04248

    arXiv

  22. [30]

    X. Yan, X. Chen, Y . Jiang, S.-T. Xia, Y . Zhao, F. Zheng, Hijacking tracker: A powerful adversarial attack on visual tracking, in: ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), IEEE, 2020, pp. 2897–2901

    2020

  23. [31]

    X. Chen, X. Yan, F. Zheng, Y . Jiang, S.-T. Xia, Y . Zhao, R. Ji, One-shot adversarial attacks on visual tracking with dual attention, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 10176–10185

    2020

  24. [32]

    B. Yan, D. Wang, H. Lu, X. Yang, Cooling-shrinking attack: Blinding the tracker with imper- ceptible noises, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 990–999

    2020

  25. [33]

    C. Xie, J. Wang, Z. Zhang, Z. Ren, A. Yuille, Mitigating adversarial effects through randomiza- tion, arXiv preprint arXiv:1711.01991

    arXiv

  26. [34]

    C. Guo, M. Rana, M. Cisse, L. Van Der Maaten, Countering adversarial images using input transformations, arXiv preprint arXiv:1711.00117

    arXiv

  27. [35]

    Y . Pan, A. J. Ma, Y . Gao, J. Wang, Y . Lin, Multi-scale adversarial cross-domain detection with robust discriminative learning, in: Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2020, pp. 1324–1332

    2020

  28. [36]

    Goldblum, L

    M. Goldblum, L. Fowl, S. Feizi, T. Goldstein, Adversarially robust distillation, in: Proceedings of the AAAI conference on artificial intelligence, V ol. 34, 2020, pp. 3996–4003. 21

    2020

  29. [37]

    Zeng, J.-M

    G.-Q. Zeng, J.-M. Shao, K.-D. Lu, G.-G. Geng, J. Weng, Automated federated learning-based adversarial attack and defence in industrial control systems, IET Cyber-Systems and Robotics 6 (2) (2024) e12117

    2024

  30. [38]

    Wei, G.-Q

    H.-N. Wei, G.-Q. Zeng, K.-D. Lu, G.-G. Geng, J. Weng, Moar-cnn: Multi-objective adversarially robust convolutional neural network for sar image classification, IEEE Transactions on Emerging Topics in Computational Intelligence

  31. [39]

    Zhang, G.-Q

    Y . Zhang, G.-Q. Zeng, M.-R. Chen, G.-G. Geng, J. Weng, K.-D. Lu, Dofa: Adversarial examples detection for sar images by dual-objective feature attribution, Expert Systems with Applications 255 (2024) 124705

    2024

  32. [40]

    Zeng, H.-N

    G.-Q. Zeng, H.-N. Wei, K.-D. Lu, G.-G. Geng, J. Weng, Daco-bd: Data augmentation combina- torial optimization-based backdoor defense in deep neural networks for sar image classification, IEEE Transactions on Instrumentation and Measurement

  33. [41]

    H. Tang, Z. Li, D. Zhang, S. He, J. Tang, Divide-and-conquer: Confluent triple-flow network for rgb-t salient object detection, IEEE Transactions on Pattern Analysis and Machine Intelligence

  34. [42]

    T. Li, H. Feng, L. Wang, L. Zhu, Z. Xiong, H. Huang, Stimulating diffusion model for image denoising via adaptive embedding and ensembling, IEEE Transactions on Pattern Analysis and Machine Intelligence

  35. [43]

    Huang, X

    L. Huang, X. Zhao, K. Huang, Got-10k: A large high-diversity benchmark for generic object tracking in the wild, IEEE Transactions on Pattern Analysis and Machine Intelligence 43 (5) (2019) 1562–1577

    2019

  36. [44]

    Kristan, A

    M. Kristan, A. Leonardis, J. Matas, M. Felsberg, R. Pfugfelder, L. ˇCehovin, et al, The sixth visual object tracking vot2018 challenge results, in: European Conference on Computer Vision (ECCV), Springer-Verlag, 2018

    2018

  37. [45]

    Y . Wu, J. Lim, M.-H. Yang, Object tracking benchmark, IEEE Transactions on Pattern Analysis and Machine Intelligence 37 (9) (2015) 1834–1848

    2015

  38. [46]

    H. Fan, L. Lin, F. Yang, P. Chu, G. Deng, S. Yu, H. Bai, Y . Xu, C. Liao, H. Ling, Lasot: A high-quality benchmark for large-scale single object tracking, in: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 5374–5383

    2019

  39. [47]

    Z. Zhu, Q. Wang, L. Bo, W. Wu, J. Yan, W. Hu, Distractor-aware siamese networks for visual object tracking, in: European Conference on Computer Vision, 2018. 22

    2018

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.