Pith. sign in

REVIEW 2 major objections 6 minor 56 references

When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking

T0 review · 2 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adaptive UAV trackers are vulnerable precisely because they skip layers: binary gating decisions have an unbounded local Lipschitz constant at decision boundaries, and the paper's API attack flips those gates to collapse tracking.

desk verdict The API attack is a legitimate empirical contribution, but its 'unbounded Lipschitz singularity' is a tautological property of step-function gating, and the central D>0 assumption is never tested. read the letter →

arxiv 2608.03902 v1 pith:PUHGJ43O submitted 2026-08-04 cs.AI

Shaofeng Liang , Runwei Guan , Wenshuo Chen , Jiemin Wu , Bowen Tian , Haozhe Jia , Kaishen Yuan , Songning Lai
show 2 more authors
Daizong Liu Yutao Yue
This is my paper · ORCID
classification cs.AI
keywords adaptivevisiontransformersdynamicroutingUAVtrackingadversarialattackLipschitzsingularitylayerskippingpathinversionvisualrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adaptive Transformer trackers save computation on UAVs by letting internal gates decide, per input, which transformer blocks to skip. This paper tries to show that this efficiency mechanism carries a structural flaw: at the boundary where a gate switches from "skip" to "run," the mapping from input to output is discontinuous, so the local Lipschitz constant is infinite. Consequently, an infinitesimal perturbation can flip the network onto a completely different computational path, and that path inconsistency can be engineered into an attack. The authors build the Adversarial Path-Inversion (API) framework, which trains a generator to invert gating decisions, and report that it degrades tracking precision by roughly 80% across six UAV benchmarks while running faster than prior attacks. If the argument holds, it reframes adaptive efficiency as an attack surface rather than just a performance trade-off, and sets a requirement for robust design: routing discontinuities must be smoothed, randomized, or otherwise hardened.

What carries the argument

The load-bearing object is the discrete gating decision π(x)=I(g(x)>τ) paired with the piecewise output f(x)=π f_act(x)+(1−π)f_skip(x). Its step discontinuity makes f non-Lipschitz at the threshold manifold, and the ratio D/(2ε)→∞ is the singularity. The attack machinery is the path-inversion objective L_path = (1/(T·K)) Σ η_{t,k} l_adv_{t,k}, where η is the sign of the clean gate logit; minimizing it flips active gates to inactive and vice versa, jointly with response suppression and feature-similarity loss. This objective is what turns the mathematical singularity into a trainable attack.

What would settle it

Sample inputs from actual flight benchmarks that lie on or near gating boundaries (where g(x0)=τ) for AVTrack, measure D=||f_act(x0)−f_skip(x0)||, and check whether API's attack success correlates with D. If boundaries with D≈0 still get attacked successfully, the mechanism is not the Lipschitz singularity; if API attacks fail when gate decisions are frozen to the clean path, path inversion is necessary.

Watch

Extended reading notes

Core claim

The central claim is formal: with gating π(x)=I(g(x)>τ) and output f(x)=π f_act(x)+(1−π)f_skip(x), the paper derives in Eq. (7) that the local Lipschitz constant at a decision boundary x0 is L(x0)=∞, provided the two branches differ by D>0. The mechanism is the finite output jump D between f_act and f_skip divided by an input separation 2ε that goes to zero. The paper calls this a Lipschitz singularity and argues it is exploitable: perturbations that push features across a boundary "invert" the computational path, and because different paths encode features in different subspaces, the tracker loses template-search alignment and drifts. The API framework operationalizes this: a generator prod

Load-bearing premise

The argument depends on the activated and skipped branches producing measurably different outputs at the gating boundary (D > 0 in Eq. 6); if the branches converge there, flipping the gate changes nothing and the infinite Lipschitz constant never translates into tracking failure.

Editorial extensions

If this is right

  • Binary layer-skipping in any adaptive tracker inherits the same discontinuity; the vulnerability is architectural, not a quirk of one implementation.
  • Attacks that manipulate routing decisions can dominate attacks that only corrupt features within a fixed path, because they change both the inference graph and the features it carries.
  • A generator-based attack can be both strong and fast: the paper reports 62.5 FPS attack inference versus 4.6 FPS for an optimization-based baseline, so real-time exploitation on drones is plausible.
  • Hardening adaptive trackers requires addressing the decision boundary itself—randomizing gates, softening thresholds, or training with topology-aware adversarial loss—rather than only denoising inputs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same Lipschitz-singularity argument applies to any hard-gated dynamic network (classification, detection, segmentation), so the paper's security warning is broader than tracking; what changes is how easy the boundaries are to reach from real inputs.
  • A defense that makes activation and skip branches agree near the boundary—e.g., distilling f_skip toward f_act—could remove the exploit without sacrificing adaptive efficiency; the paper notes defense directions but does not test this one.
  • The paper's observed ordering (weaker attack on LGTrack, which gates fewer blocks) suggests a testable dose-response: attack efficacy should increase monotonically with the number and depth of gated blocks.
  • Because the generator is trained on clean data and frozen victim, API's success may partly reflect standard output-space corruption rather than path inversion; a control that freezes gates while applying the same perturbation would quantify the topology-specific contribution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper studies adversarial attacks on adaptive Transformer trackers that use input-dependent layer skipping. It claims that hard binary gating induces an unbounded local Lipschitz constant at decision boundaries (Eqs. 6–7), creating a new 'topology-path-based' attack surface. The authors formalize this with a piecewise network model (Eq. 3) and propose the Adversarial Path-Inversion (API) framework, a learned perturbation generator combining path-inversion, feature disruption, response suppression, and reconstruction losses. Experiments on AVTrack, SGLATrack, and LGTrack over six UAV benchmarks report significantly larger precision/success-rate degradations than existing attacks, with a lower perturbation budget and higher inference speed in several comparisons.

Significance. If the empirical results hold, the paper provides a valuable contribution to the security analysis of efficient dynamic-routing trackers for UAV applications. The API framework shows strong, consistent attack performance across multiple architectures and benchmarks, and the ablations support the importance of the path-inversion objective. However, the theoretical centerpiece is mathematically elementary: any hard threshold with a positive output jump yields an infinite local Lipschitz constant. The real novelty lies in testing this phenomenon in adaptive trackers and demonstrating that routing decisions can be adversarially flipped. Because the practical exploitability depends on the unmeasured magnitude of the branch-output discrepancy D, the theoretical framing currently overreaches the evidence. The experimental study is extensive but lacks direct measurements linking the claimed singularity to the attack mechanism.

major comments (2)
  1. [§3.2, Eq. (6) and §4.5, Table 4] The proof of L(x0)=∞ rests entirely on Eq. (6), which assumes D=||f_act(x0)-f_skip(x0)||_p>0. This quantity is never measured or bounded for AVTrack, SGLATrack, or LGTrack. In the residual parameterization of Eq. (8), D=||B_l(x0)-x0||; if the branch update is small near gating boundaries, the discontinuity has negligible practical impact. The ablation in Table 4 shows that removing L_path weakens the attack, but it does not isolate the discontinuity as the operative mechanism; the loss could simply provide a stronger optimization signal. Please report the distribution of D at decision boundaries and the actual output change induced by a single gate flip within the ε=0.025 budget. Without this, the claim that the Lipschitz singularity is the direct cause of attack success is not secured.
  2. [§3.2, Eq. (7) and §5] The unbounded local Lipschitz constant follows immediately from choosing the hard indicator in Eq. (2); it is not an independent structural discovery. Moreover, Eq. (7) only shows that the local ratio diverges as ε→0. For a fixed bounded perturbation of size ε, the output difference across the boundary is at most D, not infinite. The abstract and conclusion state that 'infinitesimal input perturbations can be amplified' and that this 'proves inherent instability,' which overstates what Eq. (7) establishes. I recommend reframing the theoretical analysis as motivation, and pairing it with direct empirical evidence that D is large relative to ε in the victim networks, rather than presenting the infinity result as a standalone proof of exploitability.
minor comments (6)
  1. [Eq. (18)] The target response \hat{R}_i is not defined. Please state whether it is a uniform map, the clean response map, or a target Gaussian, since this determines the behavior of L_resp.
  2. [Tables 1–2] Table 1 does not report the perturbation bound used for each attack method. Table 2 shows API at ε=2.5 while several baselines use ε=3.1. Please add the ε values to Table 1 and discuss the fairness implications, or state clearly that all methods in Table 1 use their original configurations.
  3. [§4.2] The text says API achieves 'average precision degradation of over 80%.' From Table 1, the UAVDT precision drop is (82.1-18.2)/82.1 ≈ 77.8%, so the average across the six benchmarks is not over 80%. Please recompute or qualify the statement.
  4. [Eq. (9)] The constraint is written as δ_t ≤ ε. Use ||δ_t||_∞ ≤ ε for consistency with Eq. (17) and the later statement that the perturbation is bounded in the L∞ norm.
  5. [§4.2, LGTrack discussion] The phrase '30% of AVTrack's attackable branch space' is informal. Please state the actual number of gated blocks in LGTrack and AVTrack so the comparison is concrete.
  6. [Eq. (19)] The value λ_resp=1e4 is very large relative to the other weights. Please explain how L_resp is normalized (e.g., the scale of response maps or the loss magnitude) so that the composite loss is not dominated by one term.

Circularity Check

1 steps flagged · score 8.0 of 10

The central theoretical claim—unbounded local Lipschitz constant at layer-skipping boundaries—is entailed by the paper's own indicator-function model of gating; Eq. (7) restates the discontinuity built into Eq. (2), so the 'theoretical discovery' is definitional rather than an independent result.

  1. self definitional [Section 3.2, Eq. (2) and Eq. (7)]
    "The decision function π(·) can be abstracted as a discrete step function: π(x)=I(g(x)>τ) (2) ... L(x0)=lim_{ε→0+} ∥f(x+)−f(x−)∥_p / ∥x+−x−∥_p ≥ lim_{ε→0+} D/(2ε)=∞ (7)"

    The 'Lipschitz singularity' is not an independently derived property of adaptive trackers; it is a formal consequence of the paper's own modeling choice that gating is a hard indicator step. Given π(x)=I(g(x)>τ), the output f(x)=π(x)f_act(x)+(1−π(x))f_skip(x) is discontinuous at the threshold, so the local Lipschitz constant is infinite at that point by definition. Eq. (7) merely restates the discontinuity of a step-modulated function; it adds no content about actual trained gating networks. Moreover, Eq. (6) asserts D>0 without measurement; if the two branches produce nearly identical output at the boundary, the limit in Eq. (7) would be 0, not ∞. Thus the central theoretical warning reduces to the indicator-function ansatz plus an unverified positivity assumption.

full rationale

The paper's empirical attack (API) is evaluated against multiple baselines and ablations, and those experiments are self-contained; they are not circular. However, the paper's central theoretical contribution—the 'unbounded local Lipschitz constant' at decision boundaries—is definitional. The derivation begins by abstracting gating as a discrete indicator step (Eq. 2), which already builds in the discontinuity. Eq. (6) then assumes the jump magnitude D is strictly positive, and Eq. (7) computes L(x0)=∞. But any piecewise function of the form π f_act + (1−π) f_skip with an indicator π has an infinite local Lipschitz constant at a threshold where the two branches differ; this is a tautology of the model, not a discovered vulnerability. The singularity is therefore forced by the paper's own construction, not derived from the trained adaptive trackers. The unmeasured D>0 assumption further weakens the claim: if D≈0, the 'singularity' disappears. Because the load-bearing theoretical result reduces to the definition of the gating model, the circularity score is high, though the attack engineering and empirical comparisons retain independent value.

Assumptions & free parameters 7 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. The key assumptions are the hard threshold gating model, the positivity of D, and the propagation of input perturbations to gating logits. The free parameters are all hyperparameters of the attack generator and loss weighting.

free parameters (7)
  • λ_path (path-inversion loss weight) = 2.0
    Hand-set in Section 4.1; chosen empirically to balance the composite loss.
  • λ_resp (response suppression weight) = 1×10^4
    Hand-set in Section 4.1; high value to enforce response suppression.
  • λ_feat (feature disruption weight) = 1.0
    Hand-set in Section 4.1.
  • λ_recon (reconstruction constraint weight) = 1.0
    Hand-set in Section 4.1.
  • ε (perturbation bound) = 0.025
    Chosen for visual imperceptibility in Section 4.1; affects attack strength and stealth.
  • γ (noise scaling for non-salient tokens) = 0.5
    Set in Eq. (15) to suppress background perturbation magnitude.
  • T (frames per training segment) = 9
    Set in Section 3.3 for temporal attack consistency.
assumptions (3)
  • domain assumption The gating decision is a hard indicator function π(x) = I(g(x) > τ) (Eq. 2).
    The paper assumes all victim adaptive trackers use a deterministic hard threshold for layer skipping; in practice, some may use stochastic sampling or softened probabilities, which would weaken the singularity.
  • domain assumption The output difference D = ||f_act(x0) - f_skip(x0)|| is non-zero at the decision boundary (Eq. 6).
    The vulnerability claim requires that flipping a gate produces a measurable output difference; if D were near zero, the discontinuity would have no practical impact.
  • domain assumption The perturbation is applied before patch embedding and propagates through the network to influence the gating logits (Eqs. 9-10).
    The attack assumes the generator can inject noise into the search region and that the gating modules are sensitive to such pixel-level perturbations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking." pith.science (2026). https://pith.science/paper/PUHGJ43O

@misc{pith2026260803902,
  author       = {Pith},
  title        = {Pith review of: When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PUHGJ43O}},
  note         = {Machine review of arXiv:2608.03902}
}
read the original abstract

Resource constraints on UAV platforms have driven a paradigm shift in aerial tracking, from pursuing performance toward balancing accuracy with efficiency. Adaptive Transformer Trackers, which leverage an input-dependent dynamic routing architecture, have emerged as a representative solution to this challenge. However, we reveal that behind this computation-on-demand flexibility hides a critical structural flaw: the Lipschitz singularity of computational path decisions, which has an unbounded local Lipschitz constant at discrete layer-skipping decision boundaries. This mathematical discontinuity renders adaptive tracking networks inherently unstable: tiny input perturbations can be amplified at the gating modules, causing dramatic changes in the inference topology. We formally characterize this singularity in the context of adaptive tracking architectures and, for the first time, identify it as a directly exploitable new attack surface. This insight reveals a previously overlooked and highly vulnerable topological path space attack surface. Based on this, we propose the Adversarial Path-Inversion (API) framework. API generates imperceptible perturbations to precisely manipulate the gating decisions, forcing the inference onto altered computational paths. The severe inconsistency between the original and the inverted paths dismantles the representation capability of the model. Extensive experiments on state-of-the-art adaptive trackers demonstrate that API achieves superior perturbation stealthiness, more effective attack, and faster inference speeds. This work opens a new dimension for the security analysis of dynamic tracking networks and provides a theoretical warning for constructing robust adaptive tracking architectures in the future.

Figures

Figures reproduced from arXiv: 2608.03902 by the authors.

Figure 1
Figure 1. Core motivation and theoretical foundation of the Adversarial Path-Inversion (API) framework. Unlike traditional [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the Adversarial Path-Inversion (API) framework. The perturbation generator (bottom) synthesizes [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Empirical validation of the path-inversion effect [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Qualitative tracking results of the representative [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Spatio-temporal trajectory comparison. The attack [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 49 canonical work pages

  1. [1]

    U Benchmark. 2016. A benchmark and simulator for uav tracking. InEuropean conference on computer vision, Vol. 7

    work page 2016

  2. [2]

    Goutam Bhat, Martin Danelljan, Luc Van Gool, and Radu Timofte. 2019. Learning discriminative model prediction for tracking. InProceedings of the IEEE/CVF international conference on computer vision. 6182–6191

    work page 2019

  3. [3]

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2021. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology6, 1 (2021), 25–45

    work page 2021

  4. [4]

    Chenglizhao Chen, Shaofeng Liang, Runwei Guan, Xiaolou Sun, Haocheng Zhao, Haiyun Jiang, Tao Huang, Henghui Ding, and Qing-Long Han. 2026. Aerialmind: Towards referring multi-object tracking in UAV scenarios. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 2805–2813

    work page 2026

  5. [5]

    Chenglizhao Chen, Shaofeng Liang, Luming Li, Mengke Song, Xu Yu, and Shanchen Pang. 2026. Adapting Visual Trackers to Dynamic View Transitions with Shift-view Prompt Tuning.IEEE Transactions on Circuits and Systems for Video Technology(2026)

    work page 2026

  6. [6]

    Xin Chen, Bin Yan, Jiawen Zhu, Dong Wang, Xiaoyun Yang, and Huchuan Lu

    work page

  7. [7]

    Xuesong Chen, Xiyu Yan, Feng Zheng, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Rongrong Ji. 2020. One-shot adversarial attacks on visual tracking with dual attention. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10176–10185

    work page 2020

  8. [8]

    Zedu Chen, Bineng Zhong, Guorong Li, Shengping Zhang, and Rongrong Ji. 2020. Siamese box adaptive network for visual tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6668–6677

    work page 2020

Show all 56 references
  1. [9]

    Yutao Cui, Cheng Jiang, Limin Wang, and Gangshan Wu. 2022. Mixformer: End- to-end tracking with iterative mixed attention. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 13608–13618

    2022

  2. [10]

    Martin Danelljan, Goutam Bhat, Fahad Shahbaz Khan, and Michael Felsberg

  3. [11]

    Martin Danelljan, Gustav Hager, Fahad Shahbaz Khan, and Michael Felsberg

  4. [12]

    Wenbiao Du, Jingfeng Xue, Xiuqi Yang, Wenjie Guo, Dujuan Gu, and Weijie Han. 2025. TransfficFormer: A novel Transformer-based framework to generate evasive malicious traffic.Knowledge-Based Systems319 (2025), 113546

    2025

  5. [13]

    Wenbiao Du, Tengfei Yang, Zhihan Sun, Xiuqi Yang, Zeyang Liu, and Jingfeng Xue. 2025. A Comprehensive Survey on White-Box Security Threats for Large Language Models. InInternational Conference on Knowledge Science, Engineering and Management. Springer, 74–86

    2025

  6. [14]

    Heng Fan, Hexin Bai, Liting Lin, Fan Yang, Peng Chu, Ge Deng, Sijia Yu, Harshit, Mingzhen Huang, Juehuan Liu, et al . 2021. Lasot: A high-quality large-scale single object tracking benchmark.International Journal of Computer Vision129, 2 (2021), 439–461

    2021

  7. [15]

    Changhong Fu, Ziang Cao, Yiming Li, Junjie Ye, and Chen Feng. 2021. Onboard real-time aerial tracking with efficient Siamese anchor proposal network.IEEE Transactions on Geoscience and Remote Sensing60 (2021), 1–13

    2021

  8. [16]

    Changhong Fu, Sihang Li, Xinnan Yuan, Junjie Ye, Ziang Cao, and Fangqiang Ding. 2022. Ad 2 attack: Adaptive adversarial attack on real-time uav tracking. In 2022 International conference on robotics and automation (ICRA). IEEE, 5893–5899

    2022

  9. [17]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    2014 arXiv

  10. [18]

    Dongyan Guo, Jun Wang, Ying Cui, Zhenhua Wang, and Shengyong Chen. 2020. SiamCAR: Siamese fully convolutional classification and regression for visual tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6269–6277

    2020

  11. [19]

    João F Henriques, Rui Caseiro, Pedro Martins, and Jorge Batista. 2014. High-speed tracking with kernelized correlation filters.IEEE transactions on pattern analysis and machine intelligence37, 3 (2014), 583–596

    2014

  12. [20]

    Sanghyun Hong, Yiğitcan Kaya, Ionuţ-Vlad Modoranu, and Tudor Dumitraş. 2020. A panda? no, it’s a sloth: Slowdown attacks on adaptive multi-exit neural network inference.arXiv preprint arXiv:2010.02432(2020)

    2020 arXiv

  13. [21]

    Xingsen Huang, Deshui Miao, Hongpeng Wang, Yaowei Wang, and Xin Li. 2024. Context-guided black-box attack for visual tracking.IEEE Transactions on Multi- media26 (2024), 8824–8835

    2024

  14. [22]

    Shuai Jia, Chao Ma, Yibing Song, Xiaokang Yang, and Ming-Hsuan Yang. 2025. Robust deep object tracking against adversarial attacks.International Journal of Computer Vision133, 3 (2025), 1238–1257

    2025

  15. [23]

    Shuai Jia, Yibing Song, Chao Ma, and Xiaokang Yang. 2021. Iou attack: Towards temporally coherent black-box adversarial attack for visual object tracking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6709–6718

    2021

  16. [24]

    Ben Kang, Xin Chen, Dong Wang, Houwen Peng, and Huchuan Lu. 2023. Explor- ing lightweight hierarchical vision transformers for efficient visual tracking. In MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil Liang et al. Proceedings of the IEEE/CVF international conference o...

    2023

  17. [25]

    Songning Lai, Yu Huang, Jiayu Yang, Gaoxiang Huang, Wenshuo Chen, and Yutao Yue. 2024. Guarding the gate: Conceptguard battles concept-level backdoors in concept bottleneck models.arXiv preprint arXiv:2411.16512(2024)

    2024 arXiv

  18. [26]

    Songning Lai, Jiayu Yang, Yu Huang, Lijie Hu, Tianlang Xue, Zhangyi Hu, Jiaxu Li, Haicheng Liao, and Yutao Yue. 2024. Cat: Concept-level backdoor attacks for concept bottleneck models.arXiv preprint arXiv:2410.04823(2024)

    2024 arXiv

  19. [27]

    Siyi Li and Dit-Yan Yeung. 2017. Visual object tracking for unmanned aerial vehicles: A benchmark and new motion models. InProceedings of the AAAI conference on artificial intelligence, Vol. 31

    2017

  20. [28]

    Shaofeng Liang, Runwei Guan, Wangwang Lian, Daizong Liu, Xiaolou Sun, Dongming Wu, Yutao Yue, Weiping Ding, and Hui Xiong. 2025. Cognitive Disentanglement for Referring Multi-Object Tracking.INFFUS(2025), 103349

    2025

  21. [29]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal adversarial perturbations. InProceedings of the IEEE conference on computer vision and pattern recognition. 1765–1773

    2017

  22. [30]

    Krishna Kanth Nakka and Mathieu Salzmann. 2022. Universal, transferable adversarial perturbations for visual object trackers. InEuropean Conference on Computer Vision. Springer, 413–429

    2022

  23. [31]

    KL Navaneet, Soroush Abbasi Koohpayegani, Essam Sleiman, and Hamed Pirsi- avash. 2024. Slowformer: Adversarial attack on compute and energy consumption of efficient vision transformers. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 24786–24797

    2024

  24. [32]

    Fatemeh Nourilenjan Nokabadi, Yann Batiste Pequignot, Jean-François Lalonde, and Christian Gagné. 2024. TrackPGD: Efficient Adversarial Attack using Object Binary Masks against Robust Transformer Trackers. InThe 3rd New Frontiers in Adversarial Machine Learning (AdvML Frontier...

    2024

  25. [33]

    Yongming Rao, Wenliang Zhao, Benlin Liu, Jiwen Lu, Jie Zhou, and Cho-Jui Hsieh

  26. [34]

    Xiaolou Sun, Wufei Si, Wenhui Ni, Yuntian Li, Dongming Wu, Fei Xie, Run- wei Guan, He-Yang Xu, Henghui Ding, Yuan Wu, et al. 2026. AutoFly: Vision- Language-Action Model for UAV Autonomous Navigation in the Wild.arXiv preprint arXiv:2602.09657(2026)

    2026

  27. [35]

    Wattanapong Suttapak, Jianfu Zhang, and Liqing Zhang. 2022. Diminishing- feature attack: The adversarial infiltration on visual tracking.Neurocomputing 509 (2022), 21–33

    2022

  28. [36]

    Jiahao Wang, Fang Liu, Licheng Jiao, Hao Wang, Shuo Li, Lingling Li, Puhua Chen, Xu Liu, and Xinyi Wang. 2025. FA3T: Feature-Aware Adversarial Attacks for Multi-modal Tracking. InProceedings of the 33rd ACM International Conference on Multimedia. 1376–1385

    2025

  29. [37]

    Advances in neural information processing systems34 (2021), 13937–13949

    Dynamicvit: Efficient vision transformers with dynamic token sparsification. Advances in neural information processing systems34 (2021), 13937–13949

    2021

  30. [38]

    You Wu, Yongxin Li, Mengyuan Liu, Xucheng Wang, Xiangyang Yang, Hengzhou Ye, Dan Zeng, Qijun Zhao, and Shuiwang Li. 2025. Learning an adaptive and view-invariant vision transformer for real-time UAV tracking.IEEE Transactions on Circuits and Systems for Video Technology(2025)

    2025

  31. [39]

    Xinyu Xiang, Xuying Wu, Shengxiang Li, Qinglong Yan, Tong Zou, Hao Zhang, and Jiayi Ma. 2026. Adversarial perturbation for RGB-T tracking via intra-modal excavation and cross-modal collusion.Information Fusion(2026), 104183

    2026

  32. [40]

    Xinyu Xiang, Qinglong Yan, Hao Zhang, Jianfeng Ding, Han Xu, Zhongyuan Wang, and Jiayi Ma. 2025. Cross-modal stealth: A coarse-to-fine attack framework for rgb-t tracker. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 8620–8627

    2025

  33. [41]

    Tingyu Wang, Yujiao Shi, Fabian Deuser, Shaofei Huang, Guosheng Hu, Si Liu, Zhedong Zheng, and Roger Zimmermann. 2025. The 3rd workshop on uavs in multimedia: Capturing the world from a new perspective. InProceedings of the 3rd International Workshop on UA Vs in Multimedia: Ca...

    2025

  34. [42]

    Yinda Xu, Zeyu Wang, Zuoxin Li, Ye Yuan, and Gang Yu. 2020. SiamFC++: Towards robust and accurate visual tracking with target estimation guidelines. In Proceedings of the AAAI conference on artificial intelligence, Vol. 34. 12549–12556

    2020

  35. [43]

    Chaocan Xue, Bineng Zhong, Qihua Liang, Yaozong Zheng, Ning Li, Yuanliang Xue, and Shuxiang Song. 2025. Similarity-guided layer-adaptive vision trans- former for UAV tracking. InProceedings of the Computer Vision and Pattern Recognition Conference. 6730–6740

    2025

  36. [44]

    Bin Yan, Dong Wang, Huchuan Lu, and Xiaoyun Yang. 2020. Cooling-shrinking attack: Blinding the tracker with imperceptible noises. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 990–999

    2020

  37. [45]

    Xinyu Xiang, Qinglong Yan, Hao Zhang, and Jiayi Ma. 2025. Acattack: Adaptive cross attacking rgb-t tracker via multi-modal response decoupling. InProceedings of the Computer Vision and Pattern Recognition Conference. 22099–22108

    2025

  38. [46]

    Hongxu Yin, Arash Vahdat, Jose M Alvarez, Arun Mallya, Jan Kautz, and Pavlo Molchanov. 2022. A-vit: Adaptive tokens for efficient vision transformer. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10809–10818

    2022

  39. [47]

    Hongyang Yu, Guorong Li, Weigang Zhang, Qingming Huang, Dawei Du, Qi Tian, and Nicu Sebe. 2020. The unmanned aerial vehicle benchmark: Object detection, tracking and baseline.International Journal of Computer Vision128, 5 (2020), 1141–1159

    2020

  40. [48]

    Yuhui Zheng, Yan Zhang, and Bin Xiao. 2023. Target-aware transformer tracking. IEEE Transactions on Circuits and Systems for Video Technology33, 9 (2023), 4542– 4551

    2023

  41. [49]

    Botao Ye, Hong Chang, Bingpeng Ma, Shiguang Shan, and Xilin Chen. 2022. Joint feature learning and relation modeling for tracking: A one-stream framework. In European conference on computer vision. Springer, 341–357

    2022

  42. [50]

    Ze Zhou, Yinghui Sun, Quansen Sun, Chaobo Li, and Zhenwen Ren. 2023. Only once attack: Fooling the tracker with adversarial template.IEEE Transactions on Circuits and Systems for Video Technology33, 7 (2023), 3173–3184

    2023

  43. [51]

    Jiawen Zhu, Xin Chen, Haiwen Diao, Shuai Li, Jun-Yan He, Chenyang Li, Bin Luo, Dong Wang, and Huchuan Lu. 2025. Exploring dynamic transformer for efficient object tracking.IEEE Transactions on Neural Networks and Learning Systems(2025)

    2025

  44. [52]

    Pengfei Zhu, Longyin Wen, Dawei Du, Xiao Bian, Haibin Ling, Qinghua Hu, Qinqin Nie, Hao Cheng, Chenfeng Liu, Xiaoyu Liu, et al. 2018. Visdrone-det2018: The vision meets drone object detection in image challenge results. InProceedings of the European conference on computer visi...

    2018

  45. [53]

    Yang Zhou, Derui Ding, Ran Sun, Ying Sun, and Haohua Zhang. 2026. Layer- Guided UAV Tracking: Enhancing Efficiency and Occlusion Robustness.arXiv preprint arXiv:2602.13636(2026)

    2026 arXiv

  46. [2015]

    In Proceedings of the IEEE international conference on computer vision

    Learning spatially regularized correlation filters for visual tracking. In Proceedings of the IEEE international conference on computer vision. 4310–4318

  47. [2019]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Atom: Accurate tracking by overlap maximization. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4660–4669

  48. [2021]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Transformer tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 8126–8135

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.