Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper introduces Temporal Unlearnable Examples: target-aware noise that makes object trackers trained on protected videos fail on clean test data.

desk verdict First unlearnable-example method for visual object tracking with strong transfer results; the main caveat is unquantified imperceptibility of the perturbations. read the letter →

arxiv 2507.07483 v1 pith:I2IQSVG4 submitted 2025-07-10 cs.CV cs.CR

Qiangqiang Wu , Yi Yu , Chenqi Kong , Ziquan Liu , Jia Wan , Haoliang Li , Alex C. Kot , Antoni B. Chan This is my paper
classification cs.CVcs.CR
keywords unlearnableexamplesdataprivacyprotectionvisualobjecttrackingtemporalmatchinggenerativeperturbationcontrastivelearningvideodatasetpoisoning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that a person can keep uploaded videos from being exploited to train commercial object trackers by adding small, target-aware noise before the videos are collected. It introduces Temporal Unlearnable Examples (TUEs), generated by a lightweight transformer model conditioned on the tracked object's bounding box, which are pasted onto the target region in every frame. Trackers trained on such videos learn to match the noise itself rather than the object, so their performance on clean test videos collapses. If the claim holds, video-data privacy can be protected without ruining the visual content for human viewers, and the protection transfers across trackers, datasets, and even video-object-segmentation models.

What carries the argument

The load-bearing object is the target-aware TUE generator $G_w(\cdot)$, implemented as a lightweight DiT-S/8 model with a fully connected layer that encodes the normalized target state. Given a template patch $z$ and its bounding box, the generator emits a perturbation added directly to the template, and for a search image it emits a perturbation pasted onto the target region through the pasting function $\Phi$. This makes the noise shape- and location-aware, so the tracker can latch onto it as a stable temporal-matching cue. The paper adds a temporal contrastive loss that makes the TUE template and search embeddings agree while pushing clean templates away, widening the gap between perturbed training data and clean test data; the whole system is trained in alternating inner and outer optimization with SiamFC as the surrogate tracker.

What would settle it

Measure the actual perturbation strength on TUE-perturbed frames from GOT-10k and LaSOT: if typical $\|\delta\|_\infty$ exceeds $8/255$ or human-viewer tests notice the changes, the imperceptibility premise fails. Alternatively, run a tracker trained on TUE-videos through simple input cleaning at test time, such as JPEG compression, Gaussian smoothing, or denoising, on clean evaluation frames; if performance jumps back toward the clean-trained level, the shortcut is removable and the privacy protection is fragile.

Watch

Extended reading notes

Core claim

The central claim is that imperceptible perturbations tailored to the tracked target can make video training data unlearnable for visual object tracking: a tracker trained on TUE-perturbed videos relies on the injected noise for temporal matching and consequently performs near-randomly on clean data. The paper proposes to learn a single generator $G_w$, a DiT-S/8 diffusion transformer, that takes a target patch and its normalized bounding box as input and outputs a perturbation; the perturbation is added to the template and pasted onto the target region of the search frame. Training alternates between optimizing the generator and a surrogate SiamFC tracker, with an added temporal contrastive loss that pulls TUE features together and pushes clean frames apart. In the authors' experiments, this drops SiamFC OTB AUC from 58.6 to 11.4 and OSTrack GOT-10k AO from 71.0 to 18.0, degrades state-of-the-art ViT- and ResNet-based trackers across datasets, and transfers zero-shot to unseen video corpora and to video object segmentation.

Load-bearing premise

The paper's practical value rests on the perturbations being invisible to humans and harmless to the video's viewing quality, yet the generator is never constrained to a small noise budget and no PSNR, SSIM, or $\ell_\infty$ measurement is reported, so the imperceptible premise is assumed rather than demonstrated.

Editorial extensions

If this is right

  • A user can protect an entire video corpus offline: a generator trained once on GOT-10k produces TUEs for unseen videos by simple inference, with no retraining per video or per dataset.
  • TUEs trained with the simple SiamFC surrogate transfer to substantially more complex trackers, including ViT-based OSTrack, SeqTrack, MixFormer, and HIPTrack, so the protection does not require owning the attacker's model architecture.
  • The same perturbation recipe degrades dense temporal matching tasks: video object segmentation models (STCN, XMEM) trained on TUE-converted mask-to-box data lose a large share of their J&F performance on DAVIS and YouTube-VOS.
  • Because only the training set is altered, no test-time access or model access is needed, which is what makes the method a practical data-side privacy protection rather than an attack on a deployed tracker.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test whether the protection survives input cleaning; if simple preprocessing such as JPEG compression or blurring removes the noise and restores tracker performance, the shortcut underlying TUEs is fragile.
  • The bounding-box conditioning suggests the recipe could extend to other box-conditioned temporal tasks, such as multi-object tracking or video diffusion models that consume tracks, which the paper mentions but does not evaluate.
  • Because the generator is trained only on SiamFC, the protection strength likely depends on the gap between surrogate and target model; training a tracker on mixed clean and TUE data or with adversarial training might evade the effect, a robustness test the paper does not run.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Temporal Unlearnable Examples (TUEs) to protect personal videos from being used to train visual object tracking models. A DiT-based generator conditioned on target bounding boxes produces target-aware perturbations that are pasted onto training frames; a temporal contrastive loss further encourages trackers to rely on these perturbations. Extensive experiments on GOT-10k, OTB-100, LaSOT, and VOS datasets show large clean-test performance drops across many tracking architectures, along with zero-shot transfer to unseen datasets and tasks.

Significance. If the imperceptibility claim holds, TUEs would be a practically relevant privacy tool: they are far more efficient than per-video iterative optimization (7 hours vs 33 hours, 124 MB vs 3.4 GB for GOT-10k), transfer across trackers, datasets, and temporal matching tasks, and are validated by large, consistent performance degradations on held-out clean test sets. The paper is honest about its limitations in some places, and the central evaluation on clean test data is not circular. The main weakness is that the paper's defining premise—that the perturbations are imperceptible—is not quantitatively supported.

major comments (3)
  1. [Section 3.3, Eq. (4) and Section 1] The generator output Gw(z, e_bi) in Eq. (4) is not constrained to any norm ball, yet the abstract and introduction claim the perturbations are 'imperceptible to the human eye' and 'do not compromise the data utility for human consumption.' No PSNR, SSIM, L_infinity, or any other distortion metric is reported in the main text; the only evidence cited is qualitative supplementary visualizations. Since the performance drops in Table 4 are equally consistent with a genuine imperceptible unlearnable-example mechanism and with simple destructive corruption of the training videos, the experiments as presented cannot discriminate between these alternatives. The authors should report distortion statistics for the generated TUEs, and ideally train a bounded or perceptually regularized version of the generator, comparing performance drops at matched distortion levels.
  2. [Section 3.1 and Table 4] The comparison with EM and other UE baselines is not on an equal footing. The EM formulation in Eq. (3) inherits the bounded noise constraint delta in Delta (Section 3.1, Delta = {delta | ||delta||_p <= sigma}), while TUEs are unconstrained. If the TUE perturbations are much larger than the baseline budgets, the strong results in Table 4 may reflect a distortion advantage rather than a superior privacy mechanism. At minimum, the authors should report the achieved perturbation norms and perceptual similarity for every method, and should include a baseline where TUEs are clipped or projected to the same budget as EM.
  3. [Section 4.2 and Section 5] The claim that TUEs preserve visual quality for human viewing is load-bearing for the paper's stated use case, but it is supported only by the sentence in Section 5 that 'Qualitative results confirm that the generated perturbations are imperceptible.' A quantitative evaluation—e.g., PSNR/SSIM on perturbed frames, LPIPS, or a small human study—should be added, since the privacy-protection value proposition collapses if the protected video is no longer watchable.
minor comments (5)
  1. [Algorithm 1] The algorithm lists 'learning rates alpha_s and alpha_g' but the two uses are labeled 'Optimize perturbators Gw using alpha_s' and 'Optimize the surrogate model f_theta using alpha_g'; the roles of the two learning rates should be clarified, especially because Section 4.1 mentions only a single Adam learning rate for the generator.
  2. [References] Reference [4] contains an obvious author typo: 'P.H.S. Vedaldi' should be corrected.
  3. [Table 5] The OTB-100 column in Table 5 cites [69], but the OTB benchmark is introduced as reference [79] in Section 4.1 and used in Table 1; the citation numbering appears inconsistent.
  4. [Section 4.2] The text says 'we remove the target stage condition' in the '- Condi.' ablation; this should read 'target state condition' to match Eq. (4).
  5. [Tables 4 and 5] The evaluation metrics 'AUC', 'P', 'Norm P', 'SR 0.5', and 'SR0.75' are not defined in the main text; a brief definition or pointer to the benchmark papers would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the TUE generator is optimized on training data only and the privacy claim is evaluated on held-out clean trackers and benchmarks.

full rationale

The paper's derivation chain is self-contained against external benchmarks. Equation (4) trains the generator G_w by minimizing the surrogate tracker loss on perturbed training videos, and Eq. (5) adds a temporal contrastive loss that separates TUE representations from clean representations; neither objective uses clean test performance as a fitting signal. The reported drops in Tables 4-6 are measured on held-out clean test sets (GOT-10k, OTB-100, LaSOT, DAVIS-17, YTVOS-19) after training independent trackers under their official protocols, so the central claim is not equivalent to its inputs by construction. The TCL explicitly creates a train/test distribution gap, but that is the intended mechanism of an unlearnable-example method rather than a circular prediction. Self-citations appear only as related work or as architecture/design references (e.g., DropTrack for context-aware matching) and are not load-bearing for the TUE derivation. The reviewer concern about the absence of an explicit norm bound or reported PSNR/SSIM for G_w's outputs is a correctness and evidence-completeness issue, not a circularity issue: even if the perturbations were visually destructive, the evaluation would still be an empirical test of an external claim rather than a reduction of the conclusion into the training objective.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central method relies on a generator and a contrastive loss trained with a surrogate tracker. The main free choices are the TCL weight, learning rate, and architecture dimensions. The most fragile assumptions are that test-performance drop measures privacy, that the noise is imperceptible without a bound, and that transfer from SiamFC holds. No new physical entities are introduced.

free parameters (3)
  • TCL weight lambda = 0.05
    Chosen by hand in Section 4.1 to balance tracker loss and contrastive loss; no sensitivity analysis is reported, so the value is a free choice.
  • Generator learning rate = 5e-6
    Set in Section 4.1 without a sweep or justification beyond training stability.
  • DiT-S/8 architecture dimensions = 12 layers, 6 heads, hidden 384
    Model hyperparameters chosen in Section 4.1; these affect the capacity of the generator and are not derived from first principles.
assumptions (4)
  • domain assumption Low performance on clean test data is a valid measure of data-privacy protection.
    The paper equates test accuracy drops with the inability to exploit personal data, but a tracker could still memorize identity or other attributes even if it tracks poorly. This interpretive assumption underlies the entire evaluation in Section 4.
  • ad hoc to paper The generator output is imperceptible even without an explicit norm constraint.
    Eq. (4) does not include an Lp bound or perceptual loss on Gw, yet the paper asserts imperceptibility and utility preservation. No epsilon, PSNR, or SSIM is reported, making this an unverified premise.
  • domain assumption A simple surrogate tracker (SiamFC) suffices to learn noise that transfers to arbitrary deep trackers.
    The method relies on noise learned with SiamFC transferring to ViT/ResNet trackers. This is empirically tested on several trackers and fails partially for HIPTrack (Section 4.3), so it is an empirical assumption, not a guarantee.
  • domain assumption TUEs remain effective under standard video preprocessing and compression.
    The paper does not evaluate robustness to compression, resizing, or re-encoding that social media platforms apply. If the noise is removed by such transforms, the privacy protection may disappear.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking." pith.science (2026). https://pith.science/paper/I2IQSVG4

@misc{pith2026250707483,
  author       = {Pith},
  title        = {Pith review of: Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I2IQSVG4}},
  note         = {Machine review of arXiv:2507.07483}
}
read the original abstract

With the rise of social media, vast amounts of user-uploaded videos (e.g., YouTube) are utilized as training data for Visual Object Tracking (VOT). However, the VOT community has largely overlooked video data-privacy issues, as many private videos have been collected and used for training commercial models without authorization. To alleviate these issues, this paper presents the first investigation on preventing personal video data from unauthorized exploitation by deep trackers. Existing methods for preventing unauthorized data use primarily focus on image-based tasks (e.g., image classification), directly applying them to videos reveals several limitations, including inefficiency, limited effectiveness, and poor generalizability. To address these issues, we propose a novel generative framework for generating Temporal Unlearnable Examples (TUEs), and whose efficient computation makes it scalable for usage on large-scale video datasets. The trackers trained w/ TUEs heavily rely on unlearnable noises for temporal matching, ignoring the original data structure and thus ensuring training video data-privacy. To enhance the effectiveness of TUEs, we introduce a temporal contrastive loss, which further corrupts the learning of existing trackers when using our TUEs for training. Extensive experiments demonstrate that our approach achieves state-of-the-art performance in video data-privacy protection, with strong transferability across VOT models, datasets, and temporal matching tasks.

Figures

Figures reproduced from arXiv: 2507.07483 by the authors.

Figure 1
Figure 1. Illustration of our TUEs for preventing video data [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. (a) Depiction of our TUEs; (b) Architecture of the TUE generator; (c) The temporal contrastive learning scheme. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Overall workflow of our proposed TUEs. \label {tue_context_gen_cl} \begin {split} &\min _{\mathbf {w}}[\mathcal {L}(f_{\theta }(\hat {\bz })*f_{\theta }(\hat {\bx }),y)+\lambda \mathcal {L}_{cl}(f_{\theta }(\hat {\bz }),f_{\theta }(\hat {\mathbf {e}}))],\\[-2pt] &\text {s.t.} \quad \hat {\mathbf {e}}=c(\bx ,{\bb _{j}})+G_{\mathbf {w}}(c(\bx ,{\bb _{j}}),\widetilde {\bb }_{j}), \end {split} (5) where eˆ is the TUE in… view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: Training loss of OSTracker w/ and w/o our TUEs. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 7
Figure 7. Figure 7: Template-to-search attention visualization from [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 6
Figure 6. Figure 6: AUC scores of different attributes on LaSOT [ [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. StegaFFD: Privacy-Preserving Face Forgery Detection via Fine-Grained Steganographic Domain Lifting

    cs.CV 2026-03 conditional novelty 5.0 of 10

    StegaFFD hides face images inside innocent cover photos and performs face-forgery detection directly on the stego image, preserving accuracy while hiding the face.

Reference graph

Works this paper leans on

96 extracted references · 74 canonical work pages · cited by 1 Pith paper

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. 3

    2016

  2. [2]

    Artrackv2: Prompting autoregressive tracker where to look and how to describe

    Yifan Bai, Zeyang Zhao, Yihong Gong, and Xing Wei. Artrackv2: Prompting autoregressive tracker where to look and how to describe. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2

    2024

  3. [3]

    Bertinetto, J

    L. Bertinetto, J. Valmadre, S. Golodetz, O. Miksik, and P. Torr. Staple: Complementary learners for real-time tracking. In CVPR, pages 1401–1409, 2016. 2

    2016

  4. [4]

    Bertinetto, J

    L. Bertinetto, J. Valmadre, J.F. Henriques, A. Vedaldi, and P.H.S. Vedaldi. Fully-convolutional siamese net- works for object tracking. In ECCV Workshop, pages 850–865, 2016. 2, 3, 4, 6, 7

    2016

  5. [5]

    Hiptrack: Visual tracking with historical prompts

    Wenrui Cai, Qingjie Liu, and Yunhong Wang. Hiptrack: Visual tracking with historical prompts. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. 2, 7, 8

    2024

  6. [6]

    T. Chen, S. Kornblith, and M. Norouzi. A simple frame- work for contrastive learning of visual representations. In International Conference on Machine Learning, 2020. 5

    2020

  7. [7]

    One-shot adversarial attacks on visual tracking with dual atten- tion

    Xuesong Chen, Xiyu Yan, Feng Zheng, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Rongrong Ji. One-shot adversarial attacks on visual tracking with dual atten- tion. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 10176– 10185, 2020. 2

    2020

  8. [8]

    X. Chen, B. Yan, J. Zhu, D. Wang, X. Yang, and H. Lu. Transformer tracking. InCVPR, pages 8126–8135, 2021. 2

    2021

Show all 96 references
  1. [9]

    Seqtrack: Sequence to sequence learning for visual object tracking

    Xin Chen, Houwen Peng, Dong Wang, Huchuan Lu, and Han Hu. Seqtrack: Sequence to sequence learning for visual object tracking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 14572–14581, 2023. 2, 4, 6, 7, 8

    2023

  2. [10]

    H. K. Cheng and A G. Schwing. Xmem: Long- term video object segmentation with an atkinson-shiffrin memory model. In ECCV, 2022. 9

    2022

  3. [11]

    H. K. Cheng, Y . W. Tai, and C. K. Tang. Rethink- ing space-time networks with improved memory cover- age for efficient video object segmentation. In NeurIPS, pages 11781–11794, 2021. 9

    2021

  4. [12]

    Mixformer: End-to-end tracking with iterative mixed attention

    Yutao Cui, Cheng Jiang, Limin Wang, and Gangshan Wu. Mixformer: End-to-end tracking with iterative mixed attention. In CVPR, 2022. 2, 7, 8

    2022

  5. [13]

    Danelljan, G

    M. Danelljan, G. Hager, F. S. Khan, and M. Felsberg. Convolutional features for correlation filter based visual tracking. In ICCVW, pages 58–66, 2015. 2

    2015

  6. [14]

    Danelljan, G

    M. Danelljan, G. Hager, F. S. Khan, and M. Felsberg. Learning spatially regularized correlation filters for vi- sual tracking. In ICCV, pages 4310–4318, 2015. 2

    2015

  7. [15]

    Danelljan, A

    M. Danelljan, A. Robinson, F. S. Khan, and M. Felsberg. Beyond correlation filters: learning continuous convolu- tion operators for visual tracking. In ECCV, pages 472– 488, 2016. 2

    2016

  8. [16]

    Danelljan, G

    M. Danelljan, G. Bhat, F. S. Khan, and M. Felsberg. Eco: Efficient convolution operators for tracking. In CVPR, pages 21–26, 2017. 2

    2017

  9. [17]

    Danelljan, G

    M. Danelljan, G. H ¨ager, F. S. Khan, and M. Felsberg. Discriminative scale space tracking. IEEE Transactions on Pattern Analysis and Machine Intelligence , 39(8): 1561–1575, 2017. 2

    2017

  10. [18]

    Dosovitskiy, L

    A. Dosovitskiy, L. Beyer, and A. Kolesnikov. An image is worth 16x16 words: Transformers for image recogni- tion at scale. In ICLR, 2021. 2

    2021

  11. [19]

    H. Fan, L. Lin, and F. Yang. Lasot: A high-quality bench- mark for large-scale single object tracking. In CVPR, pages 5374–5383, 2019. 1, 2, 6, 7, 8

    2019

  12. [20]

    H. Fan, H. Bai, L. Lin, F. Yang, P. Chu, G. Deng, S. Yu, M. Huang, J. Liu, and Y . Xu. Lasot: A high-quality large- scale single object tracking benchmark. In IJCV, 2021. 1, 2, 7

    2021

  13. [21]

    Learning to con- fuse: generating training time adversarial data with auto- encoder

    Ji Feng, Qi-Zhi Cai, and Zhi-Hua Zhou. Learning to con- fuse: generating training time adversarial data with auto- encoder. NeurIPS, 32, 2019. 3

    2019

  14. [22]

    Adversar- ial examples make strong poisons

    Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. Adversar- ial examples make strong poisons. NeurIPS, 34:30339– 30351, 2021. 3, 7, 8

    2021

  15. [23]

    Robust unlearnable examples: Protecting data privacy against adversarial learning

    Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data privacy against adversarial learning. In ICLR, 2022. 1, 3

    2022

  16. [24]

    Galoogahi, A

    H. Galoogahi, A. Fagg, and S. Lucey. Learning background-aware correlation filters for visual tracking. In ICCV, 2017. 2

    2017

  17. [25]

    Gener- alized relation modeling for transformer tracking

    Shenyuan Gao, Chunluan Zhou, and Jun Zhang. Gener- alized relation modeling for transformer tracking. InPro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition, pages 18686–18695, 2023. 2

    2023

  18. [26]

    Spark: Spatial-aware online incremental attack against visual tracking

    Qing Guo, Xiaofei Xie, Felix Juefei-Xu, Lei Ma, Zhong- guo Li, Wanli Xue, Wei Feng, and Yang Liu. Spark: Spatial-aware online incremental attack against visual tracking. In European conference on computer vision , pages 202–219. Springer, 2020. 2

    2020

  19. [27]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, pages 770–778, 2016. 2

    2016

  20. [28]

    J. F. Henriques, R. Caseiro, P. Martins, and J. Batista. High-speed tracking with kernelized correlation filters. IEEE Transactions on Pattern Analysis and Machine In- telligence, 37(3):583–596, 2015. 2

    2015

  21. [29]

    Onetracker: Unifying vi- sual object tracking with foundation models and efficient tuning

    Lingyi Hong, Shilin Yan, Renrui Zhang, Wanyun Li, Xinyu Zhou, Pinxue Guo, Kaixun Jiang, Yiting Chen, Jinglun Li, and Zhaoyu Chen. Onetracker: Unifying vi- sual object tracking with foundation models and efficient tuning. In Proceedings of the IEEE/CVF Conference on Computer Vi...

    2024

  22. [30]

    Badtrack: a poison-only backdoor attack on visual object tracking

    Bin Huang, Jiaqian Yu, Yiwei Chen, Siyang Pan, Qiang Wang, and Zhi Wang. Badtrack: a poison-only backdoor attack on visual object tracking. Advances in Neural In- formation Processing Systems, 36, 2024. 2

    2024

  23. [31]

    Unlearnable examples: Making personal data unexploitable

    Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearnable examples: Making personal data unexploitable. In ICLR, 2021. 1, 2, 3, 6, 7, 8, 9

    2021

  24. [32]

    Huang, X

    L. Huang, X. Zhao, and K. Huang. Got-10k: A large high-diversity benchmark for generic object tracking in the wild. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2019. 1, 2, 4, 6, 7, 8

    2019

  25. [33]

    Robust tracking against adversarial attacks

    Shuai Jia, Chao Ma, Yibing Song, and Xiaokang Yang. Robust tracking against adversarial attacks. In Computer Vision–ECCV 2020: 16th European Conference, Glas- gow, UK, August 23–28, 2020, Proceedings, Part XIX 16, pages 69–84. Springer, 2020. 2

    2020

  26. [34]

    Kingma and Jimmy Lei Ba

    Diederik P. Kingma and Jimmy Lei Ba. Adam: A method for stochastic optimization. In arXiv:1412.6980, 2014. 6

    2014 arXiv

  27. [35]

    Krizhevsky, S

    A. Krizhevsky, S. Ilya, and G. Hinton. Imagenet clas- sification with deep convolutional neural networks. In Communications of the ACM, pages 84–90, 2017. 2

    2017

  28. [36]

    B. Li, W. Wu, Z. Zhu, and J. Yan. High performance visual tracking with siamese region proposal network. In Proceedings of the CVPR, pages 8971–8980, 2018. 2

    2018

  29. [37]

    B. Li, W. Wu, Q. Wang, F. Zhang, J. Xing, and J. Yan. Siamrpn++: Evolution of siamese visual tracking with very deep networks. In CVPR, 2019. 2

    2019

  30. [38]

    Mem- ory mechanism for unsupervised anomaly detection

    Jiahao Li, Yiqiang Chen, and Yunbing Xing. Mem- ory mechanism for unsupervised anomaly detection. In Uncertainty in Artificial Intelligence , pages 1219–1229. PMLR, 2023. 3

    2023

  31. [39]

    Cascade memory for unsupervised anomaly detection

    Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. Cascade memory for unsupervised anomaly detection. In ECAI, pages 2854–2861. IOS Press, 2024

    2024

  32. [40]

    Contrast memory for unsupervised anomaly detection

    Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. Contrast memory for unsupervised anomaly detection. In IEEE International Conference on Acoustics, Speech and Signal Processing, pages 1–5. IEEE, 2025

    2025

  33. [41]

    Hyman: Hybrid memory and attention network for unsupervised anomaly detection

    Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. Hyman: Hybrid memory and attention network for unsupervised anomaly detection. In IEEE International Conference on Acoustics, Speech and Sig- nal Processing, pages 1–5. IEEE, 2025

    2025

  34. [42]

    K-space bispectrum steganography for robust unlearnable data

    Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. K-space bispectrum steganography for robust unlearnable data. In Proceedings of the 33rd ACM International Conference on Multimedia. Association for Computing Machinery, 2025

    2025

  35. [43]

    A survey on unlearnable data, 2025

    Jiahao Li, Yiqiang Chen, Yunbing Xing, Yang Gu, and Xiangyuan Lan. A survey on unlearnable data, 2025. 3

    2025

  36. [44]

    Few-shot backdoor attacks on visual object tracking

    Yiming Li, Haoxiang Zhong, Xingjun Ma, Yong Jiang, and Shu-Tao Xia. Few-shot backdoor attacks on visual object tracking. arXiv preprint arXiv:2201.13178, 2022. 2

    2022 arXiv

  37. [45]

    Efficient adversarial attacks for visual object track- ing

    Siyuan Liang, Xingxing Wei, Siyuan Yao, and Xiaochun Cao. Efficient adversarial attacks for visual object track- ing. In ECCV, pages 34–50, 2020. 2

    2020

  38. [46]

    Liang, Q

    Y . Liang, Q. Wu, Y . Liu, Y . Yan, and H. Wang. Deep cor- relation filter tracking with shepherded instance-aware proposals. In IEEE Transactions on Intelligent Trans- portation Systems, 2021. 2

    2021

  39. [47]

    Exposing image splicing traces in scientific publications via uncertainty- guided refinement

    Xun Lin, Wenzhong Tang, Haoran Wang, Yizhong Liu, Yakun Ju, Shuai Wang, and Zitong Yu. Exposing image splicing traces in scientific publications via uncertainty- guided refinement. Patterns, 5(9):101038, 2024. 3

    2024

  40. [48]

    Safeguarding medical image seg- mentation datasets against unauthorized training via contour-and texture-aware perturbations

    Xun Lin, Yi Yu, Song Xia, Jue Jiang, Haoran Wang, Zitong Yu, Yizhong Liu, Ying Fu, Shuai Wang, Wen- zhong Tang, et al. Safeguarding medical image seg- mentation datasets against unauthorized training via contour-and texture-aware perturbations. arXiv preprint arXiv:2403.14250, 2024. 3

    2024 arXiv

  41. [49]

    Hidemia: Hidden wavelet mining for privacy-enhancing medical image analysis

    Xun Lin, Yi Yu, Zitong Yu, Ruohan Meng, Jiale Zhou, Ajian Liu, Yizhong Liu, Shuai Wang, Wenzhong Tang, Zhen Lei, et al. Hidemia: Hidden wavelet mining for privacy-enhancing medical image analysis. InACM MM, pages 8110–8119, 2024. 3

    2024

  42. [50]

    A new framework for multiple deep correlation filters based object tracking

    Yi Liu, Yanjie Liang, Qiangqiang Wu, Liming Zhang, and Hanzi Wang. A new framework for multiple deep correlation filters based object tracking. InIEEE Interna- tional Conference on Acoustics, Speech and Signal Pro- cessing, pages 1670–1674, 2022. 2

    2022

  43. [51]

    Image shortcut squeezing: Countering perturbative availability poisons with compression

    Zhuoran Liu, Zhengyu Zhao, and Martha Larson. Image shortcut squeezing: Countering perturbative availability poisons with compression. International Conference on Machine Learning, 2023. 3

    2023

  44. [52]

    Lukezic and T

    A. Lukezic and T. V ojir. Discriminative correlation filter woth channel and spatial reliability. In CVPR, 2017. 2

    2017

  45. [53]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. 3

    2018

  46. [54]

    Semantic deep hid- ing for robust unlearnable examples

    Ruohan Meng, Chenyu Yi, Yi Yu, Siyuan Yang, Bingquan Shen, and Alex C Kot. Semantic deep hid- ing for robust unlearnable examples. IEEE Transactions on Information Forensics and Security, 2024. 3

    2024

  47. [55]

    Muller, A

    M. Muller, A. Bibi, and Giancola S. Trackingnet: A large-scale dataset and benchmark for object tracking in the wild. In ECCV, pages 300–317, 2018. 1, 7

    2018

  48. [56]

    Temporally-transferable perturbations: Efficient, one-shot adversarial attacks for online visual object trackers

    Krishna Kanth Nakka and Mathieu Salzmann. Temporally-transferable perturbations: Efficient, one-shot adversarial attacks for online visual object trackers. arXiv preprint arXiv:2012.15183, 2020. 2

    2012 arXiv

  49. [57]

    Scalable diffu- sion models with transformers

    William Peebles and Saining Xie. Scalable diffu- sion models with transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 4195–4205, 2023. 4, 6

    2023

  50. [58]

    Differential privacy preservation for deep auto-encoders: an application of human behavior prediction

    NhatHai Phan, Yue Wang, Xintao Wu, and Dejing Dou. Differential privacy preservation for deep auto-encoders: an application of human behavior prediction. InProceed- ings of the AAAI Conference on Artificial Intelligence ,

  51. [59]

    Pont-Tuset, F

    J. Pont-Tuset, F. Perazzi, S. Caelles, P. Arbel ´aez, A. Sorkine-Hornung, and L. Van Gool. The 2017 davis challenge on video object segmentation. In arXiv:1704.00675, 2017. 6, 9

    2017 arXiv

  52. [60]

    Au- toregressive perturbations for data poisoning

    Pedro Sandoval-Segura, Vasu Singla, Jonas Geiping, Micah Goldblum, Tom Goldstein, and David Jacobs. Au- toregressive perturbations for data poisoning. NeurIPS, 35:27374–27386, 2022. 7, 8, 9

    2022

  53. [61]

    Fawkes: Protecting privacy against unauthorized deep learning models

    Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX security symposium (USENIX Security 20), pages 1589–1604, 2020. 3

    2020

  54. [62]

    Privacy-preserving deep learning

    Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC conference on computer and communications security , pages 1310–1321, 2015

    2015

  55. [63]

    Membership inference attacks against machine learning models

    Reza Shokri, Marco Stronati, Congzheng Song, and Vi- taly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017. 3

    2017

  56. [64]

    Unseg: One universal unlearnable exam- ple generator is enough against all image segmentation

    Ye Sun, Hao Zhang, Tiehua Zhang, Xingjun Ma, and Yu- Gang Jiang. Unseg: One universal unlearnable exam- ple generator is enough against all image segmentation. arXiv preprint arXiv:2410.09909, 2024. 3

    2024 arXiv

  57. [65]

    A survey of multiple pedes- trian tracking based on tracking-by-detection framework

    Zhihong Sun, Jun Chen, Liang Chao, Weijian Ruan, and Mithun Mukherjee. A survey of multiple pedes- trian tracking based on tracking-by-detection framework. IEEE Transactions on Circuits and Systems for Video Technology, 31(5):1819–1833, 2021. 2

    2021

  58. [66]

    R. Tao, E. Gavves, and A. W.M. Smeulders. Siamese instance search for tracking. InCVPR, pages 1420–1429,

  59. [67]

    Valmadre, L

    J. Valmadre, L. Bertinetto, J. Henriques, A. Vedaldi, and P. H. S. Torr. End-to-end representation learning for cor- relation filter based tracking. In CVPR, pages 5000– 5008, 2017. 2

    2017

  60. [68]

    Q. Wang, J. Gao, and J. Xing. Dcfnet: Discrimi- nant correlation filters network for visual tracking. In arXiv:1704.04057, 2017. 2

    2017 arXiv

  61. [69]

    X. Wang, X. Shu, Z. Zhang, B. Jiang, Y . Wang, Y . Tian, and F. Wu. Towards more flexible and accurate object tracking with natural language: Algorithms and bench- mark. In CVPR, 2021. 7

    2021

  62. [70]

    Unlearnable 3d point clouds: Class-wise transformation is all you need

    Xianlong Wang, Minghui Li, Wei Liu, Hangtao Zhang, Shengshan Hu, Yechao Zhang, Ziqi Zhou, and Hai Jin. Unlearnable 3d point clouds: Class-wise transformation is all you need. arXiv preprint arXiv:2410.03644, 2024. 3

    2024 arXiv

  63. [71]

    Autoregressive visual tracking

    Xing Wei, Yifan Bai, Yongchao Zheng, Dahu Shi, and Yihong Gong. Autoregressive visual tracking. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), 2023. 2

    2023

  64. [72]

    Meta-graph adap- tation for visual object tracking

    Qiangqiang Wu and Antoni B Chan. Meta-graph adap- tation for visual object tracking. In 2021 IEEE Inter- national Conference on Multimedia and Expo (ICME) , pages 1–6, 2021. 2

    2021

  65. [73]

    Q. Wu, Y . Yan, Y . Liang, Y . Liu, and H. Wang. Dsnet: Deep and shallow feature learning for efficient visual tracking. In ACCV, pages 119–134, 2018. 2

    2018

  66. [74]

    Dsnet: Deep and shallow feature learn- ing for efficient visual tracking

    Qiangqiang Wu, Yan Yan, Yanjie Liang, Yi Liu, and Hanzi Wang. Dsnet: Deep and shallow feature learn- ing for efficient visual tracking. In Asian Conference on Computer Vision, pages 119–134, 2019. 2

    2019

  67. [75]

    Qiangqiang Wu, Tianyu Yang, Ziquan Liu, Baoyuan Wu, Ying Shan, and Antoni B. Chan. Dropmae: Masked autoencoders with spatial-attention dropout for tracking tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 14561–14571, 20...

    2023

  68. [76]

    Scalable video object segmentation with simpli- fied framework

    Qiangqiang Wu, Tianyu Yang, Wei Wu, and Antoni B Chan. Scalable video object segmentation with simpli- fied framework. In Proceedings of the IEEE/CVF inter- national conference on computer vision , pages 13879– 13889, 2023. 2

    2023

  69. [77]

    One-pixel shortcut: On the learning preference of deep neural networks

    Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shortcut: On the learning preference of deep neural networks. In ICLR, 2023. 3

    2023

  70. [78]

    Sta: Adversarial attacks on siamese trackers

    Xugang Wu, Xiaoping Wang, Xu Zhou, and Songlei Jian. Sta: Adversarial attacks on siamese trackers. arXiv preprint arXiv:1909.03413, 2019. 2

    1909 arXiv

  71. [79]

    Y . Wu, J. Lim, and M.-H. Yang. Object tracking bench- mark. IEEE Transactions on Pattern Analysis and Ma- chine Intelligence, 37(9):1834–1848, 2015. 6, 7

    2015

  72. [80]

    Diffusiontrack: Point set diffusion model for visual object tracking

    Fei Xie, Zhongdao Wang, and Chao Ma. Diffusiontrack: Point set diffusion model for visual object tracking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2

    2024

  73. [81]

    Au- toregressive queries for adaptive tracking with spatio- temporal transformers

    Jinxia Xie, Bineng Zhong, Zhiyi Mo, Shengping Zhang, Liangtao Shi, Shuxiang Song, and Rongrong Ji. Au- toregressive queries for adaptive tracking with spatio- temporal transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pages 1...

    2024

  74. [82]

    N. Xu, L. Yang, Y . Fan, D. Yue, Y . Liang, J. Yang, and T. Huang. Youtube-vos: A large-scale video object seg- mentation benchmark. In arXiv:1809.03327, 2018. 6, 9

    2018 arXiv

  75. [83]

    Cooling-shrinking attack: Blinding the tracker with im- perceptible noises

    Bin Yan, Dong Wang, Huchuan Lu, and Xiaoyun Yang. Cooling-shrinking attack: Blinding the tracker with im- perceptible noises. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 990–999, 2020. 2

    2020

  76. [84]

    B. Yan, H. Peng, J. Fu, D. Wang, and H. Lu. Learning spatio-temporal transformer for visual tracking. InICCV, pages 10448–10457, 2021. 7, 8

    2021

  77. [85]

    Hijacking tracker: A pow- erful adversarial attack on visual tracking

    Xiyu Yan, Xuesong Chen, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Feng Zheng. Hijacking tracker: A pow- erful adversarial attack on visual tracking. In ICASSP, pages 2897–2901, 2020. 2

    2020

  78. [86]

    Yang and A

    T. Yang and A. B. Chan. Learning dynamic memory networks for object tracking. In ECCV, pages 152–167,

  79. [87]

    T. Yang, P. Xu, and R. Hu. Roam: Recurrently optimiz- ing tracking model. In CVPR, pages 6718–6727, 2020. 2

    2020

  80. [88]

    B. Ye, H. Chang, B. Ma, and S. Shan. Joint feature learn- ing and relation modeling for tracking: A one-stream framework. In ECCV, pages 341–357, 2022. 2, 4, 7, 8

    2022

  81. [89]

    Availability attacks create shortcuts

    Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie-Yan Liu. Availability attacks create shortcuts. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2367–2376, 2022. 3, 7, 8, 9

    2022

  82. [90]

    Purify unlearnable ex- amples via rate-constrained variational autoencoders

    Yi Yu, Yufei Wang, Song Xia, Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex C Kot. Purify unlearnable ex- amples via rate-constrained variational autoencoders. In International Conference on Machine Learning, ICML 2024, 2024. 1

    2024

  83. [91]

    Unlearnable examples detection via iterative filtering

    Yi Yu, Qichen Zheng, Siyuan Yang, Wenhan Yang, Jun Liu, Shijian Lu, Yap-Peng Tan, Kwok-Yan Lam, and Alex Kot. Unlearnable examples detection via iterative filtering. In International Conference on Artificial Neu- ral Networks, pages 241–256. Springer, 2024. 3

    2024

  84. [92]

    Towards model resistant to transferable adversarial examples via trigger activation

    Yi Yu, Song Xia, Xun Lin, Chenqi Kong, Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex C Kot. Towards model resistant to transferable adversarial examples via trigger activation. IEEE Transactions on Information Forensics and Security, 2025. 8

    2025

  85. [93]

    Mtl- ue: Learning to learn nothing for multi-task learning

    Yi Yu, Song Xia, Siyuan Yang, Chenqi Kong, Wenhan Yang, Shijian Lu, Yap-Peng Tan, and Alex Kot. Mtl- ue: Learning to learn nothing for multi-task learning. In International Conference on Machine Learning. PMLR,

  86. [94]

    Neural tangent generalization attacks

    Chia-Hung Yuan and Shan-Hung Wu. Neural tangent generalization attacks. In International Conference on Machine Learning, pages 12230–12240. PMLR, 2021. 3

    2021

  87. [95]

    Zhang, A

    L. Zhang, A. Gonzalez-Garcia, J. Weijer, M. Danelljan, and F. Khan. Learning the model update for siamese trackers. In ICCV, 2019. 2

    2019

  88. [96]

    Hivit: Hierarchical vision transformer meets masked image modeling

    Xiaosong Zhang, Yunjie Tian, Wei Huang, Qixiang Ye, Qi Dai, Lingxi Xie, and Qi Tian. Hivit: Hierarchical vision transformer meets masked image modeling. arXiv preprint arXiv:2205.14949, 2022. 2

    2022 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.