Pith. sign in

REVIEW 3 major objections 6 minor 56 references

When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Hard-threshold layer skipping gives adaptive trackers an unbounded local sensitivity, and path-inversion attacks exploit it.

desk verdict A solid empirical attack paper with a thin theoretical frame; the path-inversion mechanism is plausible and mostly supported by ablations, but the 'singularity' is just a step function and the binary-gate assumption is unverified. read the letter →

arxiv 2608.03902 v2 pith:PUHGJ43O submitted 2026-08-04 cs.AI

Shaofeng Liang , Runwei Guan , Wenshuo Chen , Jiemin Wu , Bowen Tian , Haozhe Jia , Kaishen Yuan , Songning Lai
show 2 more authors
Daizong Liu Yutao Yue
This is my paper · ORCID
classification cs.AI
keywords ObjecttrackingFeatureDeceptionDynamicNeuralNetworksAdversarialAttackEfficientVisualLipschitzsingularityPathinversion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that adaptive Transformer trackers—networks that save computation by letting each input decide which Transformer blocks to skip—carry a structural flaw. Because the skip decision is a hard binary threshold, the network's local Lipschitz constant is infinite at every decision boundary, so an infinitesimal perturbation can flip the computational path. The paper proposes Adversarial Path-Inversion (API), a perturbation generator that deliberately flips the gates, and reports that this collapses tracking precision by over 80% and success rate by over 85% on the AVTrack baseline across six UAV benchmarks. If true, the finding turns computation-on-demand from a pure efficiency win into a security liability: conditional computation must be treated as an attack surface, not just a speed device.

What carries the argument

The load-bearing object is the step-function gate $\pi(x)=\mathbb{I}(g(x)>\tau)$ that switches between an active branch $f_{\mathrm{act}}(x)$ and a skip branch $f_{\mathrm{skip}}(x)$. Because the gate is an indicator, sitting on the boundary manifold $D_b=\{x:g(x)=\tau\}$ gives a finite output gap $D=\|f_{\mathrm{act}}(x_0)-f_{\mathrm{skip}}(x_0)\|_p$ over an input gap that goes to zero, so the local Lipschitz constant $L(x_0)\ge \lim_{\epsilon\to0^+}D/(2\epsilon)$ is infinite. API exploits this by training a perturbation generator with the path-inversion objective $\mathcal{L}_{\text{path}}$ that flips the sign of pre-sigmoid gating logits, guided by the saliency module SGPF and completed by response-suppression and reconstruction terms.

What would settle it

Record actual routing behavior near a gating boundary in AVTrack by computing the output difference for inputs on opposite sides of a real decision boundary as the perturbation size shrinks to machine precision. If the ratio stays bounded, or if the deployed model uses soft routing or stochastic sampling at inference, the unbounded-Lipschitz claim is false; if the ratio diverges as the singularity equation predicts, the claim is confirmed.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the efficiency mechanism itself is the vulnerability. The gate $\pi(x)=\mathbb{I}(g(x)>\tau)$ makes the network's overall map piecewise discontinuous: an adversarial point pair straddling the decision boundary has vanishing input distance but a non-vanishing output distance $D=\|f_{\mathrm{act}}(x_0)-f_{\mathrm{skip}}(x_0)\|_p$, which makes the local Lipschitz constant $L(x_0)\ge \lim_{\epsilon\to 0^+}D/(2\epsilon)=\infty$. The paper then shows this singularity is directly exploitable. The Adversarial Path-Inversion framework learns a perturbation generator whose path-inversion objective pushes pre-sigmoid gating logits across zero, so active blocks are skipped and skipped blocks are activated, while a response-suppression objective collapses the localization map. Across six UAV benchmarks, AVTrack's average precision drops by over 80% and success rate by over 85%, and counterfactual path experiments—restoring clean routing to an adversarial input recovers most of the performance, while injecting adversarial routing into a clean input alone reproduces about 40.8% of the damage—support the claim that topology inversion, not pixel-level semantic corruption, is the dominant cause.

Load-bearing premise

The entire argument rests on the assumption that the victim trackers route with a deterministic hard threshold on a gate score at inference time, and that the attacker can read the pre-threshold gate logits; the paper asserts this binary behavior for AVTrack, SGLATrack, and LGTrack but does not verify their exact inference-time gating or treat black-box access.

Editorial extensions

If this is right

  • Path inversion is the causal driver of the attack: when the original routing is restored to an adversarial input, most tracking performance returns, so the topology switch itself, not the pixel noise, is what breaks the tracker.
  • Any adaptive tracker that bases routing on a hard threshold is brittle exactly at inputs that sit near its decision boundaries, meaning efficiency-oriented gating creates a new security surface.
  • The attack generalizes across adaptive architectures: API degrades AVTrack, SGLATrack, and LGTrack on six UAV benchmarks, with a weaker effect on LGTrack because it routes only three blocks.
  • Defenses proposed in the paper target the gate itself: randomizing gating decisions, softening the routing boundary, or using topology-aware adversarial training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the unbounded-Lipschitz argument is generic to hard-switch computation, so API-style path inversion should transfer to other conditional networks such as early-exit classifiers, hard-gated mixtures of experts, or input-dependent LLM routing.
  • Editorial inference: because the attack needs pre-sigmoid gate logits, a natural next test is a black-box variant that probes gate decisions only through final outputs or timing; the present experiments do not rule that out.
  • Editorial inference: softening the gate, for example with a sigmoid of finite temperature, would bound the local Lipschitz constant, so a testable prediction of the paper is that API's advantage shrinks as the gate becomes softer.
  • Editorial inference: the reported lead-lag correlation between route flips and IoU drops suggests an online attack that anticipates boundary crossings, or a defense that monitors flip rates as an early-warning signal.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This paper studies adversarial attacks against adaptive transformer trackers whose layer execution is input-dependent. The authors argue that deterministic binary gating decisions produce discontinuous input-output mappings with unbounded local Lipschitz constants at decision boundaries (Section 3.2), and they exploit this with the Adversarial Path-Inversion (API) framework, a generator trained with gate-logit inversion, response-map suppression, feature-space disruption, and reconstruction losses. The main experiments report large precision and success-rate drops on AVTrack, SGLATrack, and LGTrack across six UAV benchmarks, with ablations and a counterfactual route-restoration experiment in Appendix A.1 indicating that the path-inversion objective is the main driver of attack strength.

Significance. If the claimed mechanism is verified, the paper identifies a practically relevant attack surface for adaptive trackers and demonstrates an attack that dominates existing baselines in both potency and speed. The empirical study is unusually thorough: three victim architectures, six benchmarks, baseline attacks retrained for AVTrack, efficiency comparisons, cross-architecture transfer analysis, a causal decomposition experiment, and multiple ablations. The main weakness is that the theoretical preamble is largely a restatement of the fact that step functions are discontinuous, and its applicability to the named trackers depends on an unverified hard-gate assumption. The empirical contribution is plausible and well structured, but the explanatory claim about a new 'Lipschitz singularity' needs to be either verified or substantially reframed.

major comments (3)
  1. [Section 3.2, Eq. (2)] The central theoretical claim is built entirely on the assumption that each routing decision is a deterministic hard binary threshold, pi(x)=I(g(x)>tau). The paper states this abstraction for AVTrack, SGLATrack, and LGTrack but does not verify the inference-time gating behavior of the released implementations. If any of these trackers uses soft routing, stochastic gates, or a differentiable relaxation at inference, Eq. (7) does not hold for that tracker, and the attack would reduce to ordinary feature-level sensitivity rather than a topological singularity. Because the ablation in Table 4 and the counterfactual path experiment in Appendix A.1 attribute the damage specifically to path inversion, this assumption is load-bearing. Please inspect the official code, report the exact gating function used at inference for each victim, and either prove hard gating or narrow the theoretical claim to trackers with hard gates.
  2. [Section 3.2, Eqs. (5)-(7)] Eq. (7) is a correct observation about any hard-switch function: a step discontinuity yields an unbounded supremum of output-change over input-change in the limit. As a statement, however, it is a restatement of the definition of discontinuity rather than a tracking-specific theorem, so the claimed 'formal characterization' of adaptive tracking adds little beyond the abstraction in Eq. (2). Moreover, the unbounded local Lipschitz constant is a local property on the boundary manifold, and the paper does not show that clean tracking inputs typically lie close enough to gating boundaries for an epsilon=0.025 perturbation to cross them. To make the theoretical claim load-bearing, the authors should report the distribution of gating margins g(x)-tau, relate the margin distribution to flip rates under the API objective, and present this as the actual instability mechanism.
  3. [Section 4.3 and Appendix A.2] The 'cascade amplification' mechanism is asserted rather than demonstrated. The depth-stratified flip rates in Table 6 (shallow ~4.8%, deep ~89.9%) are consistent with a cascade, but they are also consistent with depth-dependent gate thresholds, different feature sensitivities, or simply larger margins in shallow gates. The paper even labels the process 'mathematically proven' without providing a proof. Please add an intervention that isolates the cascade: for example, freeze or randomize the early gates, measure whether deep flip rates change accordingly, and quantify how much of the deep flip rate survives when early flips are suppressed. Without such evidence, the explanatory story in Section 4.3 should be weakened.
minor comments (6)
  1. [Section 3.3, Eq. (13)] The path-inversion objective uses the pre-sigmoid gating logits of the frozen victim and therefore requires white-box access to every gating module. This is a legitimate threat model, but it should be stated explicitly and prominently, including the absence of a black-box or query-based variant, so that the scope of the claimed attack surface is clear.
  2. [Section 3.3, Eq. (18)] In Eq. (18), the notation \hat R_i is used as the target response map but is not defined, and the text says the response map is suppressed 'toward a uniform distribution' while the formula appears to use a fixed reference; please clarify the definition of \hat R_i and \hat x_i.
  3. [Tables 4 and 9] The 'Full API' row differs between Table 4 (DTB70 Succ. 8.2) and Table 9 (DTB70 Succ. 10.11) despite both being described as the full model under comparable budgets; please explain the discrepancy or match the reporting conditions.
  4. [Appendix A.1] There is a broken reference 'Figure??' in the text describing the distribution of Recovery and Injection Ratios; please fix the reference and ensure all appendix figures have descriptive captions.
  5. [Experimental Settings] The paper repeatedly mentions supplementary materials and claims reproducible experimental design, but no code or supplementary document is provided; please state the release plan for code and trained generators, which is particularly important for a security paper.
  6. [Tables 1 and 3] All numerical results are single-run values without standard deviations or confidence intervals; given the strength of the claims, reporting variance across at least a few seeds or benchmarks would improve reliability.

Circularity Check

1 steps flagged · score 6.0 of 10

The unbounded-Lipschitz 'singularity' is a restatement of the paper's hard-threshold gating definition; the empirical attack results are independent.

  1. self definitional [Section 3.2, Eqs. (2)-(7) and Abstract]
    "The decision function π(·) can be abstracted as a discrete step function: π(x)=I(g(x)>τ) ... L(x0)=lim_{epsilon->0+} D/(2 epsilon)=∞"

    The claimed prediction of an unbounded local Lipschitz constant follows by defining π as an indicator function in Eq. (2); Eq. (7)'s infinity is exactly the discontinuity of a step function. The 'structural flaw' is therefore equivalent to the paper's own gating abstraction, not an independent result established about AVTrack, SGLATrack, or LGTrack, and the abstract's inference that this 'renders adaptive tracking networks inherently unstable' transfers a property of the assumed model to real trackers without verification. The empirical attack measurements (Tables 1-4 and Table 5) are separate and not circular.

full rationale

The only load-bearing theoretical step that reduces by construction is the Lipschitz-singularity argument: once gating is defined as a hard indicator (Eq. 2), Eq. (7)'s infinite local Lipschitz constant is an immediate restatement of the step function's discontinuity. The paper presents this as a revealed vulnerability, but it is a consequence of the chosen abstraction; whether the victim trackers implement hard binary gates at inference is asserted, not verified, so this part is self-definitional. The empirical contribution is independent: API is trained to invert gates (Eq. 13), and the resulting precision/success drops (Tables 1-4), plus the counterfactual restoration experiment (Table 5), are measured against real trackers. The causal path experiment is not circular because it intervenes on routing decisions and measures recovery rather than re-using the training objective as evidence. Self-citations (e.g., refs. [4] and [28]) appear but are not load-bearing. The unverified hard-gate assumption is a correctness risk, not itself circularity.

Assumptions & free parameters 8 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new physical entities or conserved quantities. Its theoretical contribution is a standard mathematical observation about step functions. The main assumptions are the hard-threshold gating model and white-box access to gating logits, which are load-bearing for the formal claim. The cascade-amplification explanation is an ad hoc mechanism introduced to match the observed depth-dependent flip rates.

free parameters (8)
  • lambda_path = 2.0
    Weight of the path-inversion loss in Ltotal (Eq. 19), tuned empirically on benchmarks.
  • lambda_resp = 1e4
    Weight of the response suppression loss, tuned for attack efficacy.
  • lambda_feat = 1.0
    Weight of the feature disruption loss, tuned experimentally.
  • lambda_recon = 1.0
    Weight of the reconstruction constraint, tuned for stealthiness.
  • gamma (SGPF non-salient scaling) = 0.5
    Controls perturbation energy on non-salient tokens; ablation shows 0.5 is optimal.
  • epsilon (perturbation budget) = 0.025
    Maximum L_infinity perturbation magnitude, chosen to balance stealth and attack strength.
  • T (training segment length) = 9
    Number of frames per training segment, set as a hyperparameter.
  • SGPF top-K saliency threshold = not stated
    The number of salient tokens retained is a free design choice but the paper never reports its value.
assumptions (4)
  • domain assumption The gating decision is a deterministic hard threshold, pi(x) = I(g(x) > tau), with no stochasticity at inference.
    Used in Eq. (2) and throughout Section 3.2 to derive the unbounded Lipschitz constant. The paper does not verify that all victim trackers use hard binary gating at inference.
  • domain assumption The attacker has white-box access to the pre-sigmoid gating logits of the victim tracker.
    Required to compute the path-inversion objective Lpath in Eq. (13). The paper never discusses black-box or partially-observable settings.
  • standard math A step function with different output branches on each side has a jump discontinuity with positive magnitude D.
    This is the mathematical content of Eq. (6)-(7). It is a standard property of indicator-weighted sums.
  • ad hoc to paper The 'cascade amplification' mechanism: flipping early gates amplifies perturbation magnitude so deep gates flip en masse.
    Invoked in Section 4.3 and Appendix A.2 to explain the depth-stratified flip rates (Table 6). No proof is given, and the explanation is post hoc rather than derived or independently validated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking." pith.science (2026). https://pith.science/paper/PUHGJ43O

@misc{pith2026260803902,
  author       = {Pith},
  title        = {Pith review of: When Efficiency Becomes Fragility: Exploiting Dynamic Routing Vulnerabilities in Adaptive UAV Tracking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PUHGJ43O}},
  note         = {Machine review of arXiv:2608.03902}
}
read the original abstract

Resource constraints on UAV platforms have driven a paradigm shift in aerial tracking, from pursuing performance toward balancing accuracy with efficiency. Adaptive Transformer Trackers, which leverage an input-dependent dynamic routing architecture, have emerged as a representative solution to this challenge. However, we reveal that behind this computation-on-demand flexibility hides a critical structural flaw: the Lipschitz singularity of computational path decisions, which has an unbounded local Lipschitz constant at discrete layer-skipping decision boundaries. This mathematical discontinuity renders adaptive tracking networks inherently unstable: tiny input perturbations can be amplified at the gating modules, causing dramatic changes in the inference topology. We formally characterize this singularity in the context of adaptive tracking architectures and, for the first time, identify it as a directly exploitable new attack surface. This insight reveals a previously overlooked and highly vulnerable topological path space attack surface. Based on this, we propose the Adversarial Path-Inversion (API) framework. API generates imperceptible perturbations to precisely manipulate the gating decisions, forcing the inference onto altered computational paths. The severe inconsistency between the original and the inverted paths dismantles the representation capability of the model. Extensive experiments on state-of-the-art adaptive trackers demonstrate that API achieves superior perturbation stealthiness, more effective attack, and faster inference speeds. This work opens a new dimension for the security analysis of dynamic tracking networks and provides a theoretical warning for constructing robust adaptive tracking architectures in the future.

Figures

Figures reproduced from arXiv: 2608.03902 by the authors.

Figure 1
Figure 1. Core motivation and theoretical foundation of the Adversarial Path-Inversion (API) framework. Unlike traditional [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the Adversarial Path-Inversion (API) framework. The perturbation generator (bottom) synthesizes [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Empirical validation of the path-inversion effect [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Qualitative tracking results of the representative [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Spatio-temporal trajectory comparison. The attack [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 8
Figure 8. Figure 8: The path flip and frame IoU temporal causality [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 7
Figure 7. Figure 7: Time-to-Failure cumulative distribution on [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 9
Figure 9. Figure 9: Comparison of feature activation heatmaps for [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]
Figure 10
Figure 10. Figure 10: Spatial distribution of API perturbations on representative search patches. From left to right, the columns show [PITH_FULL_IMAGE:figures/full_fig_p014_10.png]
Figure 11
Figure 11. Figure 11: Cross-architecture transfer performance on [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 2 canonical work pages

  1. [1]

    U Benchmark. 2016. A benchmark and simulator for uav tracking. InEuropean conference on computer vision, Vol. 7

    2016

  2. [2]

    Goutam Bhat, Martin Danelljan, Luc Van Gool, and Radu Timofte. 2019. Learning discriminative model prediction for tracking. InProceedings of the IEEE/CVF international conference on computer vision. 6182–6191

    2019

  3. [3]

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2021. A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology6, 1 (2021), 25–45

    2021

  4. [4]

    Chenglizhao Chen, Shaofeng Liang, Runwei Guan, Xiaolou Sun, Haocheng Zhao, Haiyun Jiang, Tao Huang, Henghui Ding, and Qing-Long Han. 2026. Aerialmind: Towards referring multi-object tracking in UAV scenarios. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 40. 2805–2813

    2026

  5. [5]

    Chenglizhao Chen, Shaofeng Liang, Luming Li, Mengke Song, Xu Yu, and Shanchen Pang. 2026. Adapting Visual Trackers to Dynamic View Transitions with Shift-view Prompt Tuning.IEEE Transactions on Circuits and Systems for Video Technology(2026)

    2026

  6. [6]

    Xin Chen, Bin Yan, Jiawen Zhu, Dong Wang, Xiaoyun Yang, and Huchuan Lu

  7. [7]

    Xuesong Chen, Xiyu Yan, Feng Zheng, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Rongrong Ji. 2020. One-shot adversarial attacks on visual tracking with dual attention. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10176–10185

    2020

  8. [8]

    Zedu Chen, Bineng Zhong, Guorong Li, Shengping Zhang, and Rongrong Ji. 2020. Siamese box adaptive network for visual tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6668–6677

    2020

Show all 56 references
  1. [9]

    Yutao Cui, Cheng Jiang, Limin Wang, and Gangshan Wu. 2022. Mixformer: End- to-end tracking with iterative mixed attention. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 13608–13618

    2022

  2. [10]

    Martin Danelljan, Goutam Bhat, Fahad Shahbaz Khan, and Michael Felsberg

  3. [11]

    Martin Danelljan, Gustav Hager, Fahad Shahbaz Khan, and Michael Felsberg

  4. [12]

    Wenbiao Du, Jingfeng Xue, Xiuqi Yang, Wenjie Guo, Dujuan Gu, and Weijie Han. 2025. TransfficFormer: A novel Transformer-based framework to generate evasive malicious traffic.Knowledge-Based Systems319 (2025), 113546

    2025

  5. [13]

    Wenbiao Du, Tengfei Yang, Zhihan Sun, Xiuqi Yang, Zeyang Liu, and Jingfeng Xue. 2025. A Comprehensive Survey on White-Box Security Threats for Large Language Models. InInternational Conference on Knowledge Science, Engineering and Management. Springer, 74–86

    2025

  6. [14]

    Heng Fan, Hexin Bai, Liting Lin, Fan Yang, Peng Chu, Ge Deng, Sijia Yu, Harshit, Mingzhen Huang, Juehuan Liu, et al . 2021. Lasot: A high-quality large-scale single object tracking benchmark.International Journal of Computer Vision129, 2 (2021), 439–461

    2021

  7. [15]

    Changhong Fu, Ziang Cao, Yiming Li, Junjie Ye, and Chen Feng. 2021. Onboard real-time aerial tracking with efficient Siamese anchor proposal network.IEEE Transactions on Geoscience and Remote Sensing60 (2021), 1–13

    2021

  8. [16]

    Changhong Fu, Sihang Li, Xinnan Yuan, Junjie Ye, Ziang Cao, and Fangqiang Ding. 2022. Ad 2 attack: Adaptive adversarial attack on real-time uav tracking. In 2022 International conference on robotics and automation (ICRA). IEEE, 5893–5899

    2022

  9. [17]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    2014 arXiv

  10. [18]

    Dongyan Guo, Jun Wang, Ying Cui, Zhenhua Wang, and Shengyong Chen. 2020. SiamCAR: Siamese fully convolutional classification and regression for visual tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6269–6277

    2020

  11. [19]

    João F Henriques, Rui Caseiro, Pedro Martins, and Jorge Batista. 2014. High-speed tracking with kernelized correlation filters.IEEE transactions on pattern analysis and machine intelligence37, 3 (2014), 583–596

    2014

  12. [20]

    Sanghyun Hong, Yiğitcan Kaya, Ionuţ-Vlad Modoranu, and Tudor Dumitraş. 2020. A panda? no, it’s a sloth: Slowdown attacks on adaptive multi-exit neural network inference.arXiv preprint arXiv:2010.02432(2020)

    2020 arXiv

  13. [21]

    Xingsen Huang, Deshui Miao, Hongpeng Wang, Yaowei Wang, and Xin Li. 2024. Context-guided black-box attack for visual tracking.IEEE Transactions on Multi- media26 (2024), 8824–8835

    2024

  14. [22]

    Shuai Jia, Chao Ma, Yibing Song, Xiaokang Yang, and Ming-Hsuan Yang. 2025. Robust deep object tracking against adversarial attacks.International Journal of Computer Vision133, 3 (2025), 1238–1257

    2025

  15. [23]

    Shuai Jia, Yibing Song, Chao Ma, and Xiaokang Yang. 2021. Iou attack: Towards temporally coherent black-box adversarial attack for visual object tracking. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6709–6718

    2021

  16. [24]

    Ben Kang, Xin Chen, Dong Wang, Houwen Peng, and Huchuan Lu. 2023. Explor- ing lightweight hierarchical vision transformers for efficient visual tracking. In MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil Shaofeng Liang et al. Proceedings of the IEEE/CVF international con...

    2023

  17. [25]

    Songning Lai, Yu Huang, Jiayu Yang, Gaoxiang Huang, Wenshuo Chen, and Yutao Yue. 2024. Guarding the gate: Conceptguard battles concept-level backdoors in concept bottleneck models.arXiv preprint arXiv:2411.16512(2024)

    2024 arXiv

  18. [26]

    Songning Lai, Jiayu Yang, Yu Huang, Lijie Hu, Tianlang Xue, Zhangyi Hu, Jiaxu Li, Haicheng Liao, and Yutao Yue. 2024. Cat: Concept-level backdoor attacks for concept bottleneck models.arXiv preprint arXiv:2410.04823(2024)

    2024 arXiv

  19. [27]

    Siyi Li and Dit-Yan Yeung. 2017. Visual object tracking for unmanned aerial vehicles: A benchmark and new motion models. InProceedings of the AAAI conference on artificial intelligence, Vol. 31

    2017

  20. [28]

    Shaofeng Liang, Runwei Guan, Wangwang Lian, Daizong Liu, Xiaolou Sun, Dongming Wu, Yutao Yue, Weiping Ding, and Hui Xiong. 2025. Cognitive Disentanglement for Referring Multi-Object Tracking.INFFUS(2025), 103349

    2025

  21. [29]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal adversarial perturbations. InProceedings of the IEEE conference on computer vision and pattern recognition. 1765–1773

    2017

  22. [30]

    Krishna Kanth Nakka and Mathieu Salzmann. 2022. Universal, transferable adversarial perturbations for visual object trackers. InEuropean Conference on Computer Vision. Springer, 413–429

    2022

  23. [31]

    KL Navaneet, Soroush Abbasi Koohpayegani, Essam Sleiman, and Hamed Pirsi- avash. 2024. Slowformer: Adversarial attack on compute and energy consumption of efficient vision transformers. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 24786–24797

    2024

  24. [32]

    Fatemeh Nourilenjan Nokabadi, Yann Batiste Pequignot, Jean-François Lalonde, and Christian Gagné. 2024. TrackPGD: Efficient Adversarial Attack using Object Binary Masks against Robust Transformer Trackers. InThe 3rd New Frontiers in Adversarial Machine Learning (AdvML Frontier...

    2024

  25. [33]

    Yongming Rao, Wenliang Zhao, Benlin Liu, Jiwen Lu, Jie Zhou, and Cho-Jui Hsieh

  26. [34]

    Xiaolou Sun, Wufei Si, Wenhui Ni, Yuntian Li, Dongming Wu, Fei Xie, Run- wei Guan, He-Yang Xu, Henghui Ding, Yuan Wu, et al. 2026. AutoFly: Vision- Language-Action Model for UAV Autonomous Navigation in the Wild.arXiv preprint arXiv:2602.09657(2026)

    2026

  27. [35]

    Wattanapong Suttapak, Jianfu Zhang, and Liqing Zhang. 2022. Diminishing- feature attack: The adversarial infiltration on visual tracking.Neurocomputing 509 (2022), 21–33

    2022

  28. [36]

    Jiahao Wang, Fang Liu, Licheng Jiao, Hao Wang, Shuo Li, Lingling Li, Puhua Chen, Xu Liu, and Xinyi Wang. 2025. FA3T: Feature-Aware Adversarial Attacks for Multi-modal Tracking. InProceedings of the 33rd ACM International Conference on Multimedia. 1376–1385

    2025

  29. [37]

    Advances in neural information processing systems34 (2021), 13937–13949

    Dynamicvit: Efficient vision transformers with dynamic token sparsification. Advances in neural information processing systems34 (2021), 13937–13949

    2021

  30. [38]

    You Wu, Yongxin Li, Mengyuan Liu, Xucheng Wang, Xiangyang Yang, Hengzhou Ye, Dan Zeng, Qijun Zhao, and Shuiwang Li. 2025. Learning an adaptive and view-invariant vision transformer for real-time UAV tracking.IEEE Transactions on Circuits and Systems for Video Technology(2025)

    2025

  31. [39]

    Xinyu Xiang, Xuying Wu, Shengxiang Li, Qinglong Yan, Tong Zou, Hao Zhang, and Jiayi Ma. 2026. Adversarial perturbation for RGB-T tracking via intra-modal excavation and cross-modal collusion.Information Fusion(2026), 104183

    2026

  32. [40]

    Xinyu Xiang, Qinglong Yan, Hao Zhang, Jianfeng Ding, Han Xu, Zhongyuan Wang, and Jiayi Ma. 2025. Cross-modal stealth: A coarse-to-fine attack framework for rgb-t tracker. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 8620–8627

    2025

  33. [41]

    Tingyu Wang, Yujiao Shi, Fabian Deuser, Shaofei Huang, Guosheng Hu, Si Liu, Zhedong Zheng, and Roger Zimmermann. 2025. The 3rd workshop on uavs in multimedia: Capturing the world from a new perspective. InProceedings of the 3rd International Workshop on UA Vs in Multimedia: Ca...

    2025

  34. [42]

    Yinda Xu, Zeyu Wang, Zuoxin Li, Ye Yuan, and Gang Yu. 2020. SiamFC++: Towards robust and accurate visual tracking with target estimation guidelines. In Proceedings of the AAAI conference on artificial intelligence, Vol. 34. 12549–12556

    2020

  35. [43]

    Chaocan Xue, Bineng Zhong, Qihua Liang, Yaozong Zheng, Ning Li, Yuanliang Xue, and Shuxiang Song. 2025. Similarity-guided layer-adaptive vision trans- former for UAV tracking. InProceedings of the Computer Vision and Pattern Recognition Conference. 6730–6740

    2025

  36. [44]

    Bin Yan, Dong Wang, Huchuan Lu, and Xiaoyun Yang. 2020. Cooling-shrinking attack: Blinding the tracker with imperceptible noises. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 990–999

    2020

  37. [45]

    Xinyu Xiang, Qinglong Yan, Hao Zhang, and Jiayi Ma. 2025. Acattack: Adaptive cross attacking rgb-t tracker via multi-modal response decoupling. InProceedings of the Computer Vision and Pattern Recognition Conference. 22099–22108

    2025

  38. [46]

    Hongxu Yin, Arash Vahdat, Jose M Alvarez, Arun Mallya, Jan Kautz, and Pavlo Molchanov. 2022. A-vit: Adaptive tokens for efficient vision transformer. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10809–10818

    2022

  39. [47]

    Hongyang Yu, Guorong Li, Weigang Zhang, Qingming Huang, Dawei Du, Qi Tian, and Nicu Sebe. 2020. The unmanned aerial vehicle benchmark: Object detection, tracking and baseline.International Journal of Computer Vision128, 5 (2020), 1141–1159

    2020

  40. [48]

    Yuhui Zheng, Yan Zhang, and Bin Xiao. 2023. Target-aware transformer tracking. IEEE Transactions on Circuits and Systems for Video Technology33, 9 (2023), 4542– 4551

    2023

  41. [49]

    Botao Ye, Hong Chang, Bingpeng Ma, Shiguang Shan, and Xilin Chen. 2022. Joint feature learning and relation modeling for tracking: A one-stream framework. In European conference on computer vision. Springer, 341–357

    2022

  42. [50]

    Ze Zhou, Yinghui Sun, Quansen Sun, Chaobo Li, and Zhenwen Ren. 2023. Only once attack: Fooling the tracker with adversarial template.IEEE Transactions on Circuits and Systems for Video Technology33, 7 (2023), 3173–3184

    2023

  43. [51]

    Jiawen Zhu, Xin Chen, Haiwen Diao, Shuai Li, Jun-Yan He, Chenyang Li, Bin Luo, Dong Wang, and Huchuan Lu. 2025. Exploring dynamic transformer for efficient object tracking.IEEE Transactions on Neural Networks and Learning Systems(2025)

    2025

  44. [52]

    Pengfei Zhu, Longyin Wen, Dawei Du, Xiao Bian, Haibin Ling, Qinghua Hu, Qinqin Nie, Hao Cheng, Chenfeng Liu, Xiaoyu Liu, et al. 2018. Visdrone-det2018: The vision meets drone object detection in image challenge results. InProceedings of the European conference on computer visi...

    2018

  45. [53]

    Yang Zhou, Derui Ding, Ran Sun, Ying Sun, and Haohua Zhang. 2026. Layer- Guided UAV Tracking: Enhancing Efficiency and Occlusion Robustness.arXiv preprint arXiv:2602.13636(2026)

    2026 arXiv

  46. [2015]

    In Proceedings of the IEEE international conference on computer vision

    Learning spatially regularized correlation filters for visual tracking. In Proceedings of the IEEE international conference on computer vision. 4310–4318

  47. [2019]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Atom: Accurate tracking by overlap maximization. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4660–4669

  48. [2021]

    InProceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Transformer tracking. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 8126–8135

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.