TY - GEN
T1 - Physical Hijacking Attacks against Object Trackers
AU - Muller, Raymond
AU - Man, Yanmao
AU - Celik, Z. Berkay
AU - Li, Ming
AU - Gerdes, Ryan
N1 - Publisher Copyright:
© 2022 Owner/Author.
PY - 2022/11/7
Y1 - 2022/11/7
N2 - Modern autonomous systems rely on both object detection and object tracking in their visual perception pipelines. Although many recent works have attacked the object detection component of autonomous vehicles, these attacks do not work on full pipelines that integrate object tracking to enhance the object detector's accuracy. Meanwhile, existing attacks against object tracking either lack real-world applicability or do not work against a powerful class of object trackers, Siamese trackers. In this paper, we present AttrackZone, a new physically-realizable tracker hijacking attack against Siamese trackers that systematically determines valid regions in an environment that can be used for physical perturbations. AttrackZone exploits the heatmap generation process of Siamese Region Proposal Networks in order to take control of an object's bounding box, resulting in physical consequences including vehicle collisions and masked intrusion of pedestrians into unauthorized areas. Evaluations in both the digital and physical domain show that AttrackZone achieves its attack goals 92% of the time, requiring only 0.3-3 seconds on average.
AB - Modern autonomous systems rely on both object detection and object tracking in their visual perception pipelines. Although many recent works have attacked the object detection component of autonomous vehicles, these attacks do not work on full pipelines that integrate object tracking to enhance the object detector's accuracy. Meanwhile, existing attacks against object tracking either lack real-world applicability or do not work against a powerful class of object trackers, Siamese trackers. In this paper, we present AttrackZone, a new physically-realizable tracker hijacking attack against Siamese trackers that systematically determines valid regions in an environment that can be used for physical perturbations. AttrackZone exploits the heatmap generation process of Siamese Region Proposal Networks in order to take control of an object's bounding box, resulting in physical consequences including vehicle collisions and masked intrusion of pedestrians into unauthorized areas. Evaluations in both the digital and physical domain show that AttrackZone achieves its attack goals 92% of the time, requiring only 0.3-3 seconds on average.
KW - adversarial machine learning
KW - autonomous driving
KW - neural networks
KW - object tracking
KW - video surveillance
UR - http://www.scopus.com/inward/record.url?scp=85143050765&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85143050765&partnerID=8YFLogxK
U2 - 10.1145/3548606.3559390
DO - 10.1145/3548606.3559390
M3 - Conference contribution
AN - SCOPUS:85143050765
T3 - Proceedings of the ACM Conference on Computer and Communications Security
SP - 2309
EP - 2322
BT - CCS 2022 - Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security
PB - Association for Computing Machinery
T2 - 28th ACM SIGSAC Conference on Computer and Communications Security, CCS 2022
Y2 - 7 November 2022 through 11 November 2022
ER -