Pith. sign in

REVIEW 3 major objections 5 minor 86 references

Acoustic signals injected into UAV gimbals can force visual trackers to switch from a true target to an attacker-chosen object with high probability.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 14:31 UTC pith:URBLM3HH

load-bearing objection Solid end-to-end demo that turns known acoustic IMU spoofing into reliable UAV target-switch; soft spots are scope (in-flight diversity, axis generality), not a broken claim. the 3 major comments →

arxiv 2607.09930 v1 pith:URBLM3HH submitted 2026-07-10 cs.CV cs.CR

Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection

Jiarui Li , Joseph Brewington , Qingzhao Zhang , Z. Morley Mao This is my paper
classification cs.CV cs.CR
keywords UAV visual trackingacoustic injectiongimbal attacktarget switchMEMS gyroscopeadversarial motiondrone security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Banshee establishes that carefully shaped acoustic waveforms can exploit the MEMS gyroscopes inside commercial UAV gimbals, producing controlled, directionally biased camera drifts that break the inter-frame association assumptions of modern visual trackers. The result is that a drone following a person or vehicle can be driven to lock onto a nearby decoy, or to lose the target entirely. Earlier acoustic work stopped at sensor or firmware disruption; this paper closes the loop to the application layer under realistic object-motion uncertainty and runtime latency. Across two commercial gimbal systems and five trackers the attack disables tracking in 93.6 percent of simulation trials; real-world benchtop and in-flight black-box tests on a commercial drone reach 95.5 percent overall success. The finding matters because gimbal-stabilized following underpins autonomous filming, surveillance and inspection, so a practical cross-domain path from sound to vision threatens both flight safety and privacy.

Core claim

Banshee is the first physically realizable attack that induces target switching in UAV visual tracking systems by exploiting acoustic vulnerabilities in gimbal-camera systems. Carefully crafted acoustic waveforms induce optimized adversarial gimbal oscillations that cause directionally biased camera-view drifts, breaking inter-frame target associations and driving the onboard tracker to switch from the original target to an attacker-selected object with high probability, with occasional target loss.

What carries the argument

The Gimbal Acoustic Response Model—an offline black-box mapping from acoustic frequency and amplitude to three-axis angular velocity—combined with runtime phase modulation that forces consistent directional bias along the most vulnerable axis, which then feeds an online planner optimizing injection sequences against a surrogate tracker.

Load-bearing premise

The attack rests on the premise that an offline acoustic model built from an identical spare gimbal still produces reliable directional camera drifts once the real drone is flying, vibrating, and subject to temperature and sampling-phase drift.

What would settle it

Repeat the in-flight black-box trials after deliberately detuning the injected frequency by a few hertz or after thermal cycling the gimbal; if target-switch rates collapse while the surrogate planner still believes the model is accurate, the profiling-to-flight transfer fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Acoustic injection can convert a UAV’s own target-following capability into a vehicle-theft or escape tool by redirecting the tracker onto an attacker-controlled object.
  • Existing robustness features in appearance-aware and motion-compensated trackers do not stop the attack and can even raise switch rates by keeping corrupted tracks alive.
  • Future gimbal designs and UAV applications must treat acoustic isolation and visual-inertial consistency checks as first-class security requirements.
  • Black-box profiling of an identical commercial unit is sufficient to mount the attack without access to the victim’s camera stream or internal software.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Similar resonance-driven viewpoint drifts could affect any gimbal-stabilized camera platform—ground robots, body-worn stabilizers, or pan-tilt surveillance mounts—not only UAVs.
  • Long-range ultrasonic emitters or laser-induced vibration could convert the present close-range or payload-based attack into a purely remote threat.
  • Trackers that re-initialize search regions from multi-sensor fusion rather than pure inter-frame association would be a natural defensive evolution.
  • Crowded scenes with many similar objects remain untested; success rates and controllability could drop when the planner must choose among more than two candidates.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. Banshee claims to be the first end-to-end, physically realizable acoustic attack that induces target switch (or loss) in UAV gimbal-stabilized visual tracking. Offline black-box profiling of an identical commercial gimbal yields a Gimbal Acoustic Response Model (linear amplitude scaling plus runtime phase modulation for directional bias, Eqs. 1–9). An online dual-loop planner (surrogate tracker on projected 3-D detections + gradient optimization of angular velocity under EoT, Alg. 1 and Eq. 10) then injects acoustic waveforms that produce directionally biased camera-view drifts, breaking inter-frame associations. Simulation (Gazebo+PX4, two profiled gimbals, five trackers, 108 trials/cell) reports 75.0%/93.6% switch/disable rates; physical benchtop (direct-contact and contact-free) and in-flight black-box tests on a commercial HighEndDrone report overall 95.5% success (60%/80% switch/disable on the built-in tracker).

Significance. If the empirical results hold, the paper establishes a concrete cross-domain attack path from acoustic IMU injection through gimbal stabilization into application-level visual tracking failures on commercial UAVs. Strengths include a complete offline-profiling + online-adaptive pipeline, high-fidelity simulation with residual-noise injection from physical traces, ablations (EoT, optimization, distance/angle, cycle time, surrogate transfer), and real-world validation that includes a closed-source in-flight tracker. Code release further supports follow-on robustness and defense work. The contribution is a valuable step that links known sensor-level acoustic vulnerabilities to a practically relevant tracking outcome.

major comments (3)
  1. §5.1 and Appendix D.4 concern: axis-dependent resonance (yaw-dominant a_y=2.63 vs. a_p=a_r=0.27 at 23232 Hz) is established only by black-box profiling of two commercial units. The central claim that an attacker can always align objects with a “most vulnerable axis” therefore rests on an untested assumption that similar selective resonance exists and is discoverable across arbitrary gimbal/IMU designs. A short multi-device characterization or explicit scope statement is needed before the geometric-placement guidance in §4.2.2 can be treated as general.
  2. §5.3.2 / Table 4: the in-flight black-box result (60 % switch / 80 % disable on the built-in tracker) is load-bearing for the “physically realizable on commercial closed-source UAVs” claim, yet is limited to a single altitude (~5 m), two pedestrians, ~3 m separation, and direct-contact payload. The manuscript already notes residual acoustic-control noise as the main failure mode; expanding the in-flight diversity (or clearly bounding the claim to the evaluated conditions) is required for the success-rate numbers to support the broader practicality assertion.
  3. §4.1.2–4.1.4 and §5.1: the orientation-independence argument (rotation matrix R and Figure 9) and residual-noise model are measured on a static benchtop. While residual noise is injected in simulation and the in-flight trial succeeds, the paper does not quantify how flight vibration, temperature, or sampling-phase drift degrade the linear coefficients a or the phase-switch reliability (N,T). Because the online planner’s ability to produce the required directional bias is the weakest link identified by the reader, a short flight-vibration sensitivity experiment or explicit uncertainty bound would strengthen the transfer claim.
minor comments (5)
  1. Table 1 comparison rows for prior acoustic and tracking attacks are useful but the “Online Optimize / Real-world Robustness” columns are binary; a short quantitative note on latency or uncertainty handling would make the contrast sharper.
  2. Figure 4 caption and surrounding text mix “T2P/F2P” notation with the later Box_track / Box_false symbols; consistent notation would improve readability.
  3. §5.2.1 lists 108 trials per cell but does not state the random-seed policy or whether the three-run standard deviations reported later apply to the main Table 3 numbers.
  4. Appendix C (detuning) is informative; a forward reference from §4.1.3 would help readers who wonder about frequency drift.
  5. Minor typos: “the the gimbal” (§4.1), “w/ various conditions” (Fig. 15 caption), and occasional missing spaces around units.

Circularity Check

0 steps flagged

No significant circularity: offline-fitted gimbal response model is used for planning, but attack success rates are measured empirically against external trackers and a closed-source commercial system.

full rationale

The paper's central claims are end-to-end empirical demonstrations of target-switch/loss rates (93.6% disable in simulation across five trackers and two profiled gimbals; 95.5% overall in benchtop/in-flight physical tests, including black-box success on the commercial built-in tracker). The Gimbal Acoustic Response Model (Eq. 1/9) is obtained by black-box frequency/amplitude sweeps and linear regression on physical hardware (Section 4.1.3, R^{2}≈0.997), then used only to generate candidate angular velocities for the online planner (Algorithm 1, Eq. 10). Success is not a restatement of the fitted coefficients a or fd; it is measured by whether the real (or simulated) tracker associates the false target for ≥10 consecutive frames. Surrogate trackers are black-box approximations for gradient-based planning and are never the evaluation oracles. Orientation-independence and residual-noise injection are validated by separate physical sweeps (Figures 7, 9), not assumed by definition. The single self-citation to the authors' own WIP [8] appears only as background motivation for consequences and is not load-bearing for any derivation, uniqueness claim, or success metric. No self-definitional loop, fitted-input-as-prediction, uniqueness import, or ansatz smuggling is present. The derivation chain is therefore self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 2 invented entities

The central empirical claim rests on a small set of domain assumptions about commercial gimbal hardware and tracker design, plus a handful of free parameters obtained by offline spectral fitting and linear regression. No new physical entities are postulated; the attack re-uses known resonant-drive physics. The free parameters (resonant frequencies, amplitude slopes, residual noise) are measured rather than invented, but they are still fitted quantities that the online planner depends on.

free parameters (5)
  • resonant frequency set Q (e.g., 7744 Hz, 23232 Hz for HighEndDrone)
    Identified by frequency sweep + spectral peak finding; directly selects the injected waveform that produces usable aliasing.
  • linear amplitude coefficients a_p, a_r, a_y (e.g., 0.27, 0.27, 2.63)
    Fitted by amplitude sweep + linear regression (R²≈0.997); scale the commanded angular velocity in the response model.
  • residual motion noise ε[t] (Gaussian parameters from spectrum analysis)
    Parameterized from physical traces and injected into simulation; affects realism of the planner’s expectation-over-transformation.
  • phase-switch history N and period T
    Hand-tuned feedback thresholds that keep directional bias stable under sampling-phase drift.
  • planning-execution cycle time (default 4 Hz) and EoT sample count (3)
    Chosen for real-time feasibility; ablations show they materially affect success rate.
axioms (5)
  • domain assumption MEMS gyroscopes respond to acoustic drive near their natural frequency as a driven harmonic oscillator whose digitized alias appears at low frequency and is treated as real angular velocity by the gimbal controller.
    Standard model from prior acoustic-injection literature (Walnut, Rocking Drones, etc.); invoked throughout §4.1.
  • domain assumption Commercial UAV visual trackers (both motion-based and appearance-aware) rely on inter-frame spatial proximity / search-region assumptions that break under abrupt, directionally biased camera motion.
    Stated in §4.2.1 and used to justify the optimization objective.
  • domain assumption An attacker can obtain an identical commercial gimbal for offline profiling and can place or control a same-category false target at a moderate distance (1–3 m) aligned with the most vulnerable axis.
    Threat-model premise (§3); without it the geometric setup required for high switch probability is unavailable.
  • domain assumption Gimbal acoustic response is independent of instantaneous orientation because the stabilization loop rotates gyroscope readings into the camera body frame.
    Derived from the closed-form rotation matrix in §4.1.2 and validated empirically in §5.1; load-bearing for the online planner.
  • ad hoc to paper Black-box surrogate trackers (SORT-style or SiamRPN-style) that operate on projected 3-D detections are sufficiently faithful for gradient-based planning to transfer to the real onboard tracker.
    Introduced in §4.2.3; transferability is only partially validated (Figure 16).
invented entities (2)
  • Gimbal Acoustic Response Model M̂ independent evidence
    purpose: Black-box mapping from (A_in, f_in, t) to three-axis angular velocity used by the online planner.
    Empirical abstraction fitted from profiling; not a new physical law, but a paper-specific construct that the attack pipeline depends on.
  • Banshee dual-loop online attack (surrogate tracking + planning-execution) independent evidence
    purpose: Runtime optimization of acoustic signals under object-motion uncertainty and latency.
    Algorithmic invention of the paper; evaluated empirically rather than postulated as a physical entity.

pith-pipeline@v1.1.0-grok45 · 32662 in / 3839 out tokens · 29725 ms · 2026-07-14T14:31:22.243727+00:00 · methodology

0 comments
read the original abstract

Gimbal-stabilized visual tracking is critical for modern autonomous systems such as Unmanned Aerial Vehicles (UAVs). While prior work shows acoustic signals can disturb gimbal internals, the impact of such attacks on real-world applications like UAV tracking and following remains underexplored. Existing demonstrations largely overlook practical challenges for real-world attacks, such as object-motion uncertainty and runtime latency. To bridge this gap, we present Banshee, the first physically realizable attack that induces target switching in UAV visual tracking systems by exploiting acoustic vulnerabilities in gimbal-camera systems. Banshee generates carefully crafted acoustic waveforms that induce optimized adversarial gimbal oscillations, causing directionally biased camera-view drifts that break inter-frame target associations. Consequently, the onboard tracker is driven to switch from the original target to an attacker-selected object with high probability, with occasional target loss. Banshee achieves a 93.6% success rate in simulation across two commercial gimbal systems and five trackers. Real-world benchtop and in-flight black-box attacks against a commercial drone across varied scenarios show an overall 95.5% attack success rate. Our results reveal a practical cross-domain vulnerability between acoustics and vision, highlighting the need for robust designs of gimbal systems and applications. Our code is available at: https://github.com/U1ltra/Banshee.

Figures

Figures reproduced from arXiv: 2607.09930 by Jiarui Li, Joseph Brewington, Qingzhao Zhang, Z. Morley Mao.

Figure 1
Figure 1. Figure 1: Illustration of Banshee in UAV target following. Crafted acoustic signals induce the UAV’s visual tracker to switch to an incorrect target or lose track. tracking and following on a selected mobile target [1], [2], [3], [4], [5], [6]. Gimbal-stabilized visual tracking enables applications such as autonomous filming, surveillance, and infrastructure inspection, but also creates a single point of failure: co… view at source ↗
Figure 2
Figure 2. Figure 2: Overview of Banshee attack. adaptation [38], [39] Real-time attacks using projectors or adversarial trajectories [21], [23] struggle with real-world uncertainty and latency. Acoustic attacks on object detec￾tion [19], [40] do not extend to the more complex tracking pipeline. FlyTrap [24] disrupts tracking via physical patches but under a different threat model. To date, no prior work demonstrates a physica… view at source ↗
Figure 3
Figure 3. Figure 3: Illustration of phase-based directional bias in [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Illustration of how visual tracking is compromised [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Accuracy of spectral analysis for 7744 Hz. Reconstructed signal (bottom) is close to raw gyroscope readings (top). 0 20 40 60 80 100 Injected Signal Power (%) 0 100 200 Amplitude (°/s) Roll Pitch Yaw [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 8
Figure 8. Figure 8: Time domain recording of intermediate gimbal states during acoustic injection. Execution latency. A potential concern is latency between acoustic injection and gimbal response. In our experiments, latency was negligible, consistent with expectations: the proof mass responds instantaneously, and gimbals must react in real time to support image stabilization. Time domain demonstration. To expose intermediate… view at source ↗
Figure 9
Figure 9. Figure 9: Orientation independence: dif￾ference from neutral orientation in am￾plitude, averaged across pitch/roll/yaw over various orientations. 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Time (s) 100 50 0 50 100 A n g ula r V elo cit y (° / s) Roll Pitch Yaw [PITH_FULL_IMAGE:figures/full_fig_p010_9.png] view at source ↗
Figure 12
Figure 12. Figure 12: Demonstration of successful simulated target [PITH_FULL_IMAGE:figures/full_fig_p010_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Time domain demonstration of injected gimbal motion induces target switch in simulation. 5.2.2. Attack Effectiveness [PITH_FULL_IMAGE:figures/full_fig_p011_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Simulation results analysis. Filled bars: target [PITH_FULL_IMAGE:figures/full_fig_p011_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Target switch success rate w/ various conditions. [PITH_FULL_IMAGE:figures/full_fig_p012_15.png] view at source ↗
Figure 17
Figure 17. Figure 17: Benchtop direct-contact (left), benchtop contact [PITH_FULL_IMAGE:figures/full_fig_p013_17.png] view at source ↗
Figure 18
Figure 18. Figure 18: Before/after target switch HighEndDrone’s track [PITH_FULL_IMAGE:figures/full_fig_p014_18.png] view at source ↗
Figure 20
Figure 20. Figure 20: Injected signal frequency vs. yaw oscillation am [PITH_FULL_IMAGE:figures/full_fig_p018_20.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

86 extracted references · 8 linked inside Pith

  1. [1]

    Fast-tracker: A robust aerial system for tracking agile target in cluttered environments,

    Z. Han, R. Zhang, N. Pan, C. Xu, and F. Gao, “Fast-tracker: A robust aerial system for tracking agile target in cluttered environments,” in2021 IEEE international conference on robotics and automation (ICRA). IEEE, 2021, pp. 328–334

    2021

  2. [2]

    An autonomous vision-based target tracking system for rotorcraft unmanned aerial vehicles,

    H. Cheng, L. Lin, Z. Zheng, Y . Guan, and Z. Liu, “An autonomous vision-based target tracking system for rotorcraft unmanned aerial vehicles,” in2017 IEEE/RSJ international conference on intelligent robots and systems (IROS). IEEE, 2017, pp. 1732–1738

    2017

  3. [3]

    Follow anything: Open- set detection, tracking, and following in real-time,

    A. Maalouf, N. Jadhav, K. M. Jatavallabhula, M. Chahine, D. M. V ogt, R. J. Wood, A. Torralba, and D. Rus, “Follow anything: Open- set detection, tracking, and following in real-time,”IEEE Robotics and Automation Letters, vol. 9, no. 4, pp. 3283–3290, 2024

    2024

  4. [4]

    Best drones that follow you automatically (2024),

    DJI, “Best drones that follow you automatically (2024),” https://stor e.dji.com/content/camera-drone-that-follows-you, 2024, accessed: 2025-08-08

    2024

  5. [5]

    The best follow me drone in 2022,

    Skydio, “The best follow me drone in 2022,” https://www.skydio.c om/blog/10-reasons-skydio-makes-the-best-follow-me-drone, 2022, accessed: 2025-02-25

    2022

  6. [6]

    Autel evo ii drone dynamic track mode full review,

    Autel, “Autel evo ii drone dynamic track mode full review,” https: //www.autelpilot.com/blogs/buying-guides/autel-evo-ii-drone-dynam ic-tracking-mode, 2020, accessed: 2025-02-25

    2020

  7. [7]

    Feder- ated reinforcement learning approach for detecting uncertain decep- tive target using autonomous dual uav system,

    H. B. Salameh, M. Alhafnawi, A. Masadeh, and Y . Jararweh, “Feder- ated reinforcement learning approach for detecting uncertain decep- tive target using autonomous dual uav system,”Information Process- ing & Management, vol. 60, no. 2, p. 103149, 2023

    2023

  8. [8]

    Wip: Hijacking attacks on uav follow-me systems in realistic scenarios

    J. Li, J. Brewington, Q. Zhang, and Z. M. Mao, “Wip: Hijacking attacks on uav follow-me systems in realistic scenarios.”

  9. [9]

    Using drones for peeping, burglaries on rise: “it’s gotten dramatically worse

    J. Hibberd, “Using drones for peeping, burglaries on rise: “it’s gotten dramatically worse”,” https://www.hollywoodreporter.com/lifestyle/li festyle-news/drones-spying-robberies-solutions-hollywood-1236166 714/, 2025, accessed: 2025-08-13

    2025

  10. [10]

    Like moths to a false flame: Lethality and protection through deception operations,

    P. Dolan, “Like moths to a false flame: Lethality and protection through deception operations,” https://www.army.mil/article/286 861/like moths to a false flame lethality and protection through deception operations, 2025, accessed: 2025-08-13

    2025

  11. [11]

    Con- trolling{UA Vs}with sensor input spoofing attacks,

    D. Davidson, H. Wu, R. Jellinek, V . Singh, and T. Ristenpart, “Con- trolling{UA Vs}with sensor input spoofing attacks,” in10th USENIX workshop on offensive technologies (WOOT 16), 2016

    2016

  12. [12]

    System for multi-axial mechanical stabilization of digital camera,

    D. Bereska, K. Daniec, S. Fra ´s, K. Jedrasiak, M. Malinowski, and A. Nawrat, “System for multi-axial mechanical stabilization of digital camera,” inVision Based Systems for UAV Applications. Springer, 2013, pp. 177–189

    2013

  13. [13]

    Model predictive control of three-axis gimbal system mounted on uav for real-time target tracking under external disturbances,

    A. Altan and R. Hacıo ˘glu, “Model predictive control of three-axis gimbal system mounted on uav for real-time target tracking under external disturbances,”Mechanical Systems and Signal Processing, vol. 138, p. 106548, 2020

    2020

  14. [14]

    Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,

    T. Trippel, O. Weisse, W. Xu, P. Honeyman, and K. Fu, “Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injection attacks,” in2017 IEEE European symposium on security and privacy (EuroS&P). IEEE, 2017, pp. 3–18

    2017

  15. [15]

    Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,

    Y . Tu, Z. Lin, I. Lee, and X. Hei, “Injected and delivered: Fabricating implicit control over actuation systems by spoofing inertial sensors,” in27th USENIX Security Symposium (USENIX Security 18). Baltimore, MD: USENIX Association, Aug. 2018, pp. 1545–1562. [Online]. Available: https://www.usenix.org/confere nce/usenixsecurity18/presentation/tu

    2018

  16. [16]

    Rocking drones with intentional sound noise on gyroscopic sensors,

    Y . Son, H. Shin, D. Kim, Y . Park, J. Noh, K. Choi, J. Choi, and Y . Kim, “Rocking drones with intentional sound noise on gyroscopic sensors,” in24th USENIX security symposium (USENIX Security 15), 2015, pp. 881–896

    2015

  17. [17]

    Kite: Exploring the practical threat from acoustic transduction attacks on inertial sensors,

    M. Gao, L. Zhang, L. Shen, X. Zou, J. Han, F. Lin, and K. Ren, “Kite: Exploring the practical threat from acoustic transduction attacks on inertial sensors,” inProceedings of the 20th ACM conference on embedded networked sensor systems, 2022, pp. 696–709

    2022

  18. [18]

    Wip: Threat modeling laser-induced acoustic interference in computer vision-assisted vehicles

    N. Shamsi, K. Chandrasekar, Y . Long, C. Limbach, K. Rebello, and K. Fu, “Wip: Threat modeling laser-induced acoustic interference in computer vision-assisted vehicles.”

  19. [19]

    Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,

    X. Ji, Y . Cheng, Y . Zhang, K. Wang, C. Yan, W. Xu, and K. Fu, “Poltergeist: Acoustic adversarial machine learning against cameras and computer vision,” in2021 IEEE Symposium on Security and Privacy (SP), 2021

    2021

  20. [20]

    Fooling detection alone is not enough: Adversarial attack against multiple object tracking,

    Y . J. Jia, Y . Lu, J. Shen, Q. A. Chen, H. Chen, Z. Zhong, and T. W. Wei, “Fooling detection alone is not enough: Adversarial attack against multiple object tracking,” inInternational Conference on Learning Representations (ICLR’20), 2020

    2020

  21. [21]

    Physical hijacking attacks against object trackers,

    R. Muller, Y . Man, Z. B. Celik, M. Li, and R. Gerdes, “Physical hijacking attacks against object trackers,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2309–2322

    2022

  22. [22]

    Controlloc: Physical-world hijacking attack on visual perception in autonomous driving,

    C. Ma, N. Wang, Z. Zhao, Q. Wang, Q. A. Chen, and C. Shen, “Controlloc: Physical-world hijacking attack on visual perception in autonomous driving,”arXiv preprint arXiv:2406.05810, 2024

    Pith/arXiv arXiv 2024

  23. [23]

    Physical id-transfer attacks against multi-object tracking via adversarial trajectory

    C. Wang, Y . Man, R. Muller, M. Li, Z. B. Celik, R. Gerdes, and J. Petit, “Physical id-transfer attacks against multi-object tracking via adversarial trajectory.”

  24. [24]

    Flytrap: Physical distance-pulling attack towards camera-based autonomous target tracking systems,

    S. Xie, M. H. Fakih, J. Lu, F. Alshammari, N. Wang, T. Sato, H. Bouzidi, M. A. A. Faruque, and Q. A. Chen, “Flytrap: Physical distance-pulling attack towards camera-based autonomous target tracking systems,” 2025. [Online]. Available: https://arxiv.org/abs/2509.20362

    arXiv 2025

  25. [25]

    Elastic tracker: A spatio-temporal trajectory planner for flexible aerial tracking,

    J. Ji, N. Pan, C. Xu, and F. Gao, “Elastic tracker: A spatio-temporal trajectory planner for flexible aerial tracking,” in2022 International Conference on Robotics and Automation (ICRA). IEEE, 2022, pp. 47–53

    2022

  26. [26]

    Adaptive tracking and perching for quadrotor in dynamic scenarios,

    Y . Gao, J. Ji, Q. Wang, R. Jin, Y . Lin, Z. Shang, Y . Cao, S. Shen, C. Xu, and F. Gao, “Adaptive tracking and perching for quadrotor in dynamic scenarios,”IEEE Transactions on Robotics, vol. 40, pp. 499–519, 2023

    2023

  27. [27]

    Multi-object tracking meets moving uav,

    S. Liu, X. Li, H. Lu, and Y . He, “Multi-object tracking meets moving uav,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 8876–8885

    2022

  28. [28]

    Autotrack: Towards high-performance visual tracking for uav with automatic spatio- temporal regularization,

    Y . Li, C. Fu, F. Ding, Z. Huang, and G. Lu, “Autotrack: Towards high-performance visual tracking for uav with automatic spatio- temporal regularization,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 11 923–11 932

    2020

  29. [29]

    Multi-regularized correlation filter for uav tracking and self-localization,

    J. Ye, C. Fu, F. Lin, F. Ding, S. An, and G. Lu, “Multi-regularized correlation filter for uav tracking and self-localization,”IEEE Trans- actions on Industrial Electronics, vol. 69, no. 6, pp. 6004–6014, 2021

    2021

  30. [30]

    Siamese trans- former pyramid networks for real-time uav tracking,

    D. Xing, N. Evangeliou, A. Tsoukalas, and A. Tzes, “Siamese trans- former pyramid networks for real-time uav tracking,” inProceedings of the IEEE/CVF winter conference on applications of computer vision, 2022, pp. 2139–2148

    2022

  31. [31]

    Tctrack: Tem- poral contexts for aerial tracking,

    Z. Cao, Z. Huang, L. Pan, S. Zhang, Z. Liu, and C. Fu, “Tctrack: Tem- poral contexts for aerial tracking,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 14 798–14 808

    2022

  32. [33]

    Available: https://arxiv.org/abs/2103.17154

    [Online]. Available: https://arxiv.org/abs/2103.17154

    Pith/arXiv arXiv

  33. [34]

    ATOM: accurate tracking by overlap maximization,

    M. Danelljan, G. Bhat, F. S. Khan, and M. Felsberg, “ATOM: accurate tracking by overlap maximization,”CoRR, vol. abs/1811.07628, 2018. [Online]. Available: http://arxiv.org/abs/1811.07628

    Pith/arXiv arXiv 2018

  34. [36]

    Available: http://arxiv.org/abs/1904.07220

    [Online]. Available: http://arxiv.org/abs/1904.07220

    Pith/arXiv arXiv 1904

  35. [37]

    Giaotracker: A comprehensive framework for mcmot with global information and optimizing strategies in visdrone 2021,

    Y . Du, J. Wan, Y . Zhao, B. Zhang, Z. Tong, and J. Dong, “Giaotracker: A comprehensive framework for mcmot with global information and optimizing strategies in visdrone 2021,” inProceedings of the IEEE/CVF International conference on computer vision, 2021, pp. 2809–2819

    2021

  36. [38]

    Un- rocking drones: Foundations of acoustic injection attacks and recovery thereof

    J. Jeong, D. Kim, J.-H. Jang, J. Noh, C. Song, and Y . Kim, “Un- rocking drones: Foundations of acoustic injection attacks and recovery thereof.” inNDSS, 2023

    2023

  37. [39]

    Wip: Towards the practicality of the adversarial attack on object tracking in autonomous driving,

    C. Ma, N. Wang, Q. A. Chen, and C. Shen, “Wip: Towards the practicality of the adversarial attack on object tracking in autonomous driving,” inISOC Symposium on Vehicle Security and Privacy (Vehi- cleSec), 2023

    2023

  38. [40]

    Rpau: Fooling the eyes of uavs via physical adversarial patches,

    T. Liu, C. Yang, X. Liu, R. Han, and J. Ma, “Rpau: Fooling the eyes of uavs via physical adversarial patches,”IEEE Transactions on Intelligent Transportation Systems, vol. 25, no. 3, pp. 2586–2598, 2023

    2023

  39. [41]

    Physical adversarial textures that fool visual object tracking,

    R. R. Wiyatno and A. Xu, “Physical adversarial textures that fool visual object tracking,” inProceedings of the IEEE/CVF International Conference on computer vision, 2019, pp. 4822–4831

    2019

  40. [42]

    TPatch: A triggered physical adversarial patch,

    W. Zhu, X. Ji, Y . Cheng, S. Zhang, and W. Xu, “TPatch: A triggered physical adversarial patch,” in32nd USENIX Security Symposium (USENIX Security 23). Anaheim, CA: USENIX Association, Aug. 2023, pp. 661–678. [Online]. Available: https: //www.usenix.org/conference/usenixsecurity23/presentation/zhu

    2023

  41. [43]

    Long-range acoustic device,

    wikipedia, “Long-range acoustic device,” https://en.wikipedia.org/w iki/Long-range acoustic device, 2025, accessed: 2025-08-24

    2025

  42. [44]

    Scrdet: Towards more robust detection for small, cluttered and rotated objects,

    X. Yang, J. Yang, J. Yan, Y . Zhang, T. Zhang, Z. Guo, X. Sun, and K. Fu, “Scrdet: Towards more robust detection for small, cluttered and rotated objects,” inProceedings of the IEEE/CVF international conference on computer vision, 2019, pp. 8232–8241

    2019

  43. [45]

    Dynamic coarse-to-fine learning for oriented tiny object detection,

    C. Xu, J. Ding, J. Wang, W. Yang, H. Yu, L. Yu, and G.-S. Xia, “Dynamic coarse-to-fine learning for oriented tiny object detection,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 7318–7328

    2023

  44. [46]

    Storm32bgc gimbal controller,

    OlliW, “Storm32bgc gimbal controller,” https://www.olliw.eu/storm 32bgc-v1-wiki/Tuning Guide, 2015, accessed: 2025-11-07

    2015

  45. [47]

    Simplebgc gimbal controller,

    BaseCam, “Simplebgc gimbal controller,” https://www.basecamelect ronics.com/, 2025, accessed: 2025-11-07

    2025

  46. [48]

    Mpu-6000 and mpu-6050 product specification,

    InvenSense, “Mpu-6000 and mpu-6050 product specification,” https: //invensense.tdk.com/wp-content/uploads/2015/02/MPU-6000-Datas heet1.pdf, 2025, accessed: 2025-11-10

    2015

  47. [49]

    L3g4200d product specification,

    STMicroelectronic, “L3g4200d product specification,” http://wikitron ica.labc.usb.ve/images/f/fc/L3G4200D.pdf, 2025, accessed: 2025-11- 10

    2025

  48. [50]

    Bmi160 data sheet,

    BOSCH, “Bmi160 data sheet,” https://www.bosch-sensortec.com/m edia/boschsensortec/downloads/datasheets/bst-bmi160-ds000.pdf, 2025, accessed: 2025-11-10

    2025

  49. [51]

    Lsm6ds3tr-c data sheet,

    STMicroelectronic, “Lsm6ds3tr-c data sheet,” https://www.st.com/res ource/en/datasheet/lsm6ds3tr-c.pdf, 2025, accessed: 2025-11-10

    2025

  50. [52]

    Camera gimbal stabilization using conventional pid controller and evolutionary algorithms,

    R. J. Rajesh and P. Kavitha, “Camera gimbal stabilization using conventional pid controller and evolutionary algorithms,” in2015 International Conference on Computer, Communication and Control (IC4), 2015, pp. 1–6

    2015

  51. [53]

    Simple online and realtime tracking,

    A. Bewley, Z. Ge, L. Ott, F. Ramos, and B. Upcroft, “Simple online and realtime tracking,” in2016 IEEE international conference on image processing (ICIP). Ieee, 2016, pp. 3464–3468

    2016

  52. [54]

    High-speed tracking with kernelized correlation filters,

    J. F. Henriques, R. Caseiro, P. Martins, and J. Batista, “High-speed tracking with kernelized correlation filters,”IEEE transactions on pattern analysis and machine intelligence, vol. 37, no. 3, pp. 583– 596, 2014

    2014

  53. [55]

    High performance visual tracking with siamese region proposal network,

    B. Li, J. Yan, W. Wu, Z. Zhu, and X. Hu, “High performance visual tracking with siamese region proposal network,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 8971–8980

    2018

  54. [56]

    A new approach to linear filtering and prediction problems,

    R. E. Kalman, “A new approach to linear filtering and prediction problems,” 1960

    1960

  55. [57]

    Design and use paradigms for gazebo, an open-source multi-robot simulator,

    N. Koenig and A. Howard, “Design and use paradigms for gazebo, an open-source multi-robot simulator,” inIEEE/RSJ International Conference on Intelligent Robots and Systems, Sendai, Japan, Sep 2004, pp. 2149–2154

    2004

  56. [58]

    Siamrpn++: Evolution of siamese visual tracking with very deep networks,

    B. Li, W. Wu, Q. Wang, F. Zhang, J. Xing, and J. Yan, “Siamrpn++: Evolution of siamese visual tracking with very deep networks,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4282–4291

    2019

  57. [59]

    Distractor- aware siamese networks for visual object tracking,

    Z. Zhu, Q. Wang, B. Li, W. Wu, J. Yan, and W. Hu, “Distractor- aware siamese networks for visual object tracking,” inProceedings of the European conference on computer vision (ECCV), 2018, pp. 101–117

    2018

  58. [60]

    Siamese object tracking for unmanned aerial vehicle: A review and compre- hensive analysis,

    C. Fu, K. Lu, G. Zheng, J. Ye, Z. Cao, B. Li, and G. Lu, “Siamese object tracking for unmanned aerial vehicle: A review and compre- hensive analysis,”Artificial Intelligence Review, vol. 56, no. Suppl 1, pp. 1417–1477, 2023

    2023

  59. [61]

    Quick start guide: Nvidia jetson with ultralytics yolo11,

    Ultralytics, “Quick start guide: Nvidia jetson with ultralytics yolo11,” https://docs.ultralytics.com/guides/nvidia-jetson/#nvidia-jetson-agx-o rin-developer-kit-64gb, 2025, accessed: 2025-07-04

    2025

  60. [62]

    Ucm- ctrack: Multi-object tracking with uniform camera motion compensa- tion,

    K. Yi, K. Luo, X. Luo, J. Huang, H. Wu, R. Hu, and W. Hao, “Ucm- ctrack: Multi-object tracking with uniform camera motion compensa- tion,” inProceedings of the AAAI conference on artificial intelligence, vol. 38, no. 7, 2024, pp. 6702–6710

    2024

  61. [63]

    Imagenet large scale visual recognition challenge,

    O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernsteinet al., “Imagenet large scale visual recognition challenge,”International journal of computer vision, vol. 115, no. 3, pp. 211–252, 2015

    2015

  62. [64]

    Youtube-boundingboxes: A large high-precision human-annotated data set for object detection in video,

    E. Real, J. Shlens, S. Mazzocchi, X. Pan, and V . Vanhoucke, “Youtube-boundingboxes: A large high-precision human-annotated data set for object detection in video,” inproceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017, pp. 5296–5305

    2017

  63. [65]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean conference on computer vision. Springer, 2014, pp. 740–755

    2014

  64. [66]

    Px4 autopilot,

    P. D. Team, “Px4 autopilot,” https://github.com/PX4/PX4-Autopilot, 2025, accessed: 2025-08-26

    2025

  65. [67]

    The OpenCV Library,

    G. Bradski, “The OpenCV Library,”Dr. Dobb’s Journal of Software Tools, 2000

    2000

  66. [68]

    The walking behaviour of pedestrian social groups and its impact on crowd dynamics,

    M. Moussa ¨ıd, N. Perozo, S. Garnier, D. Helbing, and G. Theraulaz, “The walking behaviour of pedestrian social groups and its impact on crowd dynamics,”PloS one, vol. 5, no. 4, p. e10047, 2010

    2010

  67. [69]

    A social force based pedes- trian motion model considering multi-pedestrian interaction with a ve- hicle,

    D. Yang, ¨U. ¨Ozg¨uner, and K. Redmill, “A social force based pedes- trian motion model considering multi-pedestrian interaction with a ve- hicle,”ACM Transactions on Spatial Algorithms and Systems (TSAS), vol. 6, no. 2, pp. 1–27, 2020

    2020

  68. [70]

    Savior: securing autonomous vehicles with robust physical invariants,

    R. Quinonez, J. Giraldo, L. Salazar, E. Bauman, A. Cardenas, and Z. Lin, “Savior: securing autonomous vehicles with robust physical invariants,” inProceedings of the 29th USENIX Conference on Secu- rity Symposium, ser. SEC’20. USA: USENIX Association, 2020

    2020

  69. [71]

    Vimu: Effective physics-based realtime detection and recovery against stealthy attacks on uavs,

    Y . Wang, C. Sun, Q. Liu, B. Su, Z. Zhang, M. Norris, G. Tan, and J. Ma, “Vimu: Effective physics-based realtime detection and recovery against stealthy attacks on uavs,” 2025. [Online]. Available: https://arxiv.org/abs/2504.20569

    Pith/arXiv arXiv 2025

  70. [72]

    Mars: Defending unmanned aerial vehicles from attacks on inertial sensors with model-based anomaly detection and recovery,

    H. Meng, S. Luo, Z. Liang, Q. Huang, A. Khazraei, and M. Pajic, “Mars: Defending unmanned aerial vehicles from attacks on inertial sensors with model-based anomaly detection and recovery,” 2025. [Online]. Available: https://arxiv.org/abs/2505.00924

    Pith/arXiv arXiv 2025

  71. [73]

    Gyro-mag: Attack-resilient system based on sensor estimation,

    S. Lee, “Gyro-mag: Attack-resilient system based on sensor estimation,”Sensors, vol. 25, no. 7, 2025. [Online]. Available: https://www.mdpi.com/1424-8220/25/7/2208

    2025

  72. [74]

    Y . Wang, Y . Tu, S. Rampazzi, Z. Lin, I. Lee, and X. Hei,ADC-Bank: Detecting Acoustic Out-of-Band Signal Injection on Inertial Sensors, 02 2024, pp. 53–72

    2024

  73. [75]

    Gnss spoofing detection based on coupled visual/inertial/gnss navigation system,

    N. Gu, F. Xing, and Z. You, “Gnss spoofing detection based on coupled visual/inertial/gnss navigation system,”Sensors, vol. 21, no. 20, 2021. [Online]. Available: https://www.mdpi.com/1424-822 0/21/20/6769

    2021

  74. [76]

    Spoofing detection of civilian uavs using visual odometry,

    M. Varshosaz, A. Afary, B. Mojaradi, M. Saadatseresht, and E. Ghanbari Parmehr, “Spoofing detection of civilian uavs using visual odometry,”ISPRS International Journal of Geo- Information, vol. 9, no. 1, 2020. [Online]. Available: https: //www.mdpi.com/2220-9964/9/1/6

    2020

  75. [77]

    Attacking optical flow,

    A. Ranjan, J. Janai, A. Geiger, and M. J. Black, “Attacking optical flow,” 2019. [Online]. Available: https://arxiv.org/abs/1910.10053

    Pith/arXiv arXiv 2019

  76. [78]

    A perturbation-constrained adversarial attack for evaluating the robustness of optical flow,

    J. Schmalfuss, P. Scholze, and A. Bruhn, “A perturbation-constrained adversarial attack for evaluating the robustness of optical flow,”

  77. [79]

    Available: https://arxiv.org/abs/2203.13214

    [Online]. Available: https://arxiv.org/abs/2203.13214

    Pith/arXiv arXiv

  78. [80]

    Un- rocking drones: Foundations of acoustic injection attacks and recovery thereof,

    J. Jeong, D. Kim, J. Jang, J. Noh, C. Song, and Y . Kim, “Un- rocking drones: Foundations of acoustic injection attacks and recovery thereof,” 01 2023

    2023

  79. [81]

    An experimental study of{GPS}spoofing and takeover attacks on {UA Vs},

    H. Sathaye, M. Strohmeier, V . Lenders, and A. Ranganathan, “An experimental study of{GPS}spoofing and takeover attacks on {UA Vs},” in31st USENIX security symposium (USENIX security 22), 2022, pp. 3503–3520

    2022

  80. [82]

    Ghost talk: Mitigating emi signal injection attacks against analog sensors,

    D. F. Kune, J. Backes, S. S. Clark, D. Kramer, M. Reynolds, K. Fu, Y . Kim, and W. Xu, “Ghost talk: Mitigating emi signal injection attacks against analog sensors,” in2013 IEEE Symposium on Security and Privacy, 2013, pp. 145–159. Appendix A. Detailed Discussion of Defenses Physical layer. A direct mitigation is to eliminate the attack vector via improved...

    2013

Showing first 80 references.