research-article

Open access

Physical Hijacking Attacks against Object Trackers

Authors:

Raymond Muller,

Z. Berkay Celik,

Ryan GerdesAuthors Info & Claims

CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

Pages 2309 - 2322

https://doi.org/10.1145/3548606.3559390

Published: 07 November 2022 Publication History

Abstract

Modern autonomous systems rely on both object detection and object tracking in their visual perception pipelines. Although many recent works have attacked the object detection component of autonomous vehicles, these attacks do not work on full pipelines that integrate object tracking to enhance the object detector's accuracy. Meanwhile, existing attacks against object tracking either lack real-world applicability or do not work against a powerful class of object trackers, Siamese trackers. In this paper, we present AttrackZone, a new physically-realizable tracker hijacking attack against Siamese trackers that systematically determines valid regions in an environment that can be used for physical perturbations. AttrackZone exploits the heatmap generation process of Siamese Region Proposal Networks in order to take control of an object's bounding box, resulting in physical consequences including vehicle collisions and masked intrusion of pedestrians into unauthorized areas. Evaluations in both the digital and physical domain show that AttrackZone achieves its attack goals 92% of the time, requiring only 0.3-3 seconds on average.

References

[1]

Na An and Wei Qi Yan. Multitarget tracking using siamese neural networks. ACM Transactions on Multimidia Computing Communications and Applications, 2021.

Digital Library

[2]

Federico Boniardi, Abhinav Valada, Wolfram Burgard, and Gian Diego Tipaldi. Autonomous indoor robot navigation using a sketch interface for drawing maps and routes. In IEEE International Conference on Robotics and Automation, 2016.

Digital Library

[3]

Yulong Cao, Ningfei Wang, Chaowei Xiao, Dawei Yang, Jin Fang, Ruigang Yang, Qi Alfred Chen, Mingyan Liu, and Bo Li. Invisible for both Camera and LiDAR: Security of multi-sensor fusion based perception in autonomous driving under physical-world attacks. IEEE Symposium on Security and Privacy (S&P), 2021.

[4]

Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based perception in autonomous driving. In ACM Conference on Computer and Communications Security (CCS), 2019.

Digital Library

[5]

Subhash Challa, Mark R Morelande, Darko Muicki, and Robin J Evans. Fundamentals of object tracking. Cambridge University Press, 2011.

[6]

Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer, 2018.

[7]

Xi Chen, Xiao Wang, and Jianhua Xuan. Tracking multiple moving objects using unscented kalman filtering techniques. In International Conference on Engineering and Applied Science, 2012.

[8]

Xuesong Chen, Canmiao Fu, Feng Zheng, Yong Zhao, Hongsheng Li, Ping Luo, and Guo-Jun Qi. A unified multi-scenario attacking network for visual object tracking. In AAAI Conference on Artificial Intelligence, 2021.

[9]

Aman Dhar. Object tracking for autonomous driving systems. Master's thesis, EECS Department, University of California, Berkeley, May 2020.

[10]

Li Ding, Yongwei Wang, Kaiwen Yuan, Minyang Jiang, Ping Wang, Hua Huang, and Z Jane Wang. Towards universal physical attacks on single object tracking. In AAAI Conference on Artificial Intelligence, 2021.

[11]

Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical-world attacks on machine learning models. Computer Vision and Pattern Recognition (CVPR), 2018.

[12]

Abhiram Gnanasambandam, Alex M Sherman, and Stanley H Chan. Optical adversarial attack. In IEEE/CVF International Conference on Computer Vision, 2021.

[13]

Google earth. https://earth.google.com/, 2022. [Online; Accessed 27-August- 2022]

[14]

Lie Guo, Linhui Li, Yibing Zhao, and Zongyan Zhao. Pedestrian tracking based on camshift with kalman prediction for autonomous vehicles. International Journal of Advanced Robotic Systems, 2016.

[15]

Song Han, William Shen, and Zuozhen Liu. Deep drone: Object detection and tracking for smart drones on embedded system. PhD thesis, Stanford University, 2016.

[16]

Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross B. Girshick. Mask R-CNN. CoRR, abs/1703.06870, 2017.

[17]

Cabell Hodge, Konrad Hauck, Shivam Gupta, and Jesse C Bennett. Vehicle cybersecurity threats and mitigation approaches. Technical report, National Renewable Energy Lab.(NREL), OSTI, 2019.

[18]

Shahar Hoory, Tzvika Shapira, Asaf Shabtai, and Yuval Elovici. Dynamic adversarial patch for evading object detection models. arXiv preprint arXiv:2010.13070, 2020.

[19]

Saurabh Jha, Shengkun Cui, Subho Banerjee, James Cyriac, Timothy Tsai, Zbigniew Kalbarczyk, and Ravishankar K Iyer. Ml-driven malware that targets av safety. In Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2020.

[20]

Xiaoyu Ji, Yushi Cheng, Yuepeng Zhang, Kai Wang, Chen Yan, Wenyuan Xu, and Kevin Fu. Poltergeist: Acoustic adversarial machine learning against cameras and computer vision. In IEEE Symposium on Security and Privacy (S&P), 2021.

[21]

Shuai Jia, Chao Ma, Yibing Song, and Xiaokang Yang. Robust tracking against adversarial attacks. In European Conference on Computer Vision, 2020.

Digital Library

[22]

Yunhan Jia Jia, Yantao Lu, Junjie Shen, Qi Alfred Chen, Hao Chen, Zhenyu Zhong, and Tao Wei Wei. Fooling detection alone is not enough: Adversarial attack against multiple object tracking. In International Conference on Learning Representations (ICLR), 2020.

[23]

Sebastian Köhler, Giulio Lovisotto, Simon Birnbach, Richard Baker, and Ivan Martinovic. They see me rollin': Inherent vulnerability of the rolling shutter in cmos image sensors. In Annual Computer Security Applications Conference (ACSAC), 2021.

Digital Library

[24]

Matej Kristan, Jiri Matas, Ale? Leonardis, Tomas Vojir, Roman Pflugfelder, Gustavo Fernandez, Georg Nebehay, Fatih Porikli, and Luka Čehovin. A novel performance evaluation methodology for single-target trackers. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2016.

Digital Library

[25]

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems. Curran Associates, Inc., 2012.

[26]

Bo Li, Junjie Yan, Wei Wu, Zheng Zhu, and Xiaolin Hu. High performance visual tracking with siamese region proposal network. Conference on Computer Vision and Pattern Recognition (CVPR), 2018.

[27]

Shaoshan Liu, Jie Tang, Zhe Zhang, and Jean-Luc Gaudiot. Computer architectures for autonomous driving. IEEE Computer Magazine, 2017.

[28]

Logical inst. screen resolution. https://www.logicalincrements.com/articles/ resolution, 2021. [Online; Accessed 27-August-2022].

[29]

Jiajun Lu, Hussein Sibai, and Evan Fabry. Adversarial examples that fool detectors. CoRR, abs/1712.02494, 2017.

[30]

Yuzhe Ma, Jon A Sharp, Ruizhe Wang, Earlence Fernandes, and Xiaojin Zhu. Sequential attacks on kalman filter-based forward collision warning systems. In AAAI Conference on Artificial Intelligence, 2021.

[31]

Yanmao Man, Ming Li, and Ryan Gerdes. Ghost Image: Remote perception attacks against camera-based image classification systems. In International Symposium on Research in Attacks, Intrusions and Defenses, 2020.

[32]

Shervin Minaee, Yuri Y Boykov, Fatih Porikli, Antonio J Plaza, Nasser Kehtarnavaz, and Demetri Terzopoulos. Image segmentation using deep learning: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.

[33]

Raymond Muller, Yanmao Man, Z. Berkay Celik, Ming Li, and Ryan Gerdes. DriveTruth: Automated autonomous driving dataset generation for security applications. In International Workshop on Automotive and Autonomous Vehicle Security (AutoSec) collocated with NDSS, 2022.

[34]

Shoei Nashimoto, Daisuke Suzuki, Takeshi Sugawara, and Kazuo Sakiyama. Sensor con-fusion: Defeating kalman filter in signal injection attack. In Asia Conference on Computer and Communications Security, 2018.

Digital Library

[35]

Ben Nassi, Yisroel Mirsky, Dudi Nassi, Raz Ben-Netanel, Oleg Drokin, and Yuval Elovici. Phantom of the adas: Securing advanced driver-assistance systems from split-second phantom attacks. In ACM Conference on Computer and Communications Security (CCS), 2020.

Digital Library

[36]

Dinh-Luan Nguyen, Sunpreet S Arora, Yuhang Wu, and Hao Yang. Adversarial light projection attacks on face recognition systems: A feasibility study. In IEEE/CVF conference on computer vision and pattern recognition workshops, 2020.

[37]

Milan Ondrasovic and Peter Tarabek. Siamese visual object tracking: A survey. IEEE Access, 2021.

[38]

Optoma. Optoma lv130 ultra-portable projector. https://www.optoma.com/vn/ product/lv130/, 2021. [Online; Accessed 27-August-2022].

[39]

Margarita Osadchy, Julio Hernandez-Castro, Stuart Gibson, Orr Dunkelman, and Daniel Perez-Cabo. No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation. IEEE Transactions on Information Forensics and Security, 2017.

Digital Library

[40]

Joseph Redmon, Santosh Kumar Divvala, Ross B. Girshick, and Ali Farhadi. You only look once: Unified, real-time object detection. CoRR, abs/1506.02640, 2015.

[41]

Shaoqing Ren, Kaiming He, Ross Girshick, and Jian Sun. Faster R-CNN: Towards real-time object detection with region proposal networks. Advances in Neural Information Processing Systems, 2015.

[42]

Junjie Shen, Jun Yeon Won, Zeyuan Chen, and Qi Alfred Chen. Drift with devil: Security of multi-sensor fusion based localization in high-level autonomous driving under gps spoofing. In USENIX Security Symposium, 2020.

[43]

Bing Shuai, Andrew G. Berneshawi, Xinyu Li, Davide Modolo, and Joseph Tighe. Siammot: Siamese multi-object tracking. Computer Vision and Pattern Recognition (CVPR), 2021.

[44]

P.F. Sturm and S.J. Maybank. On plane-based camera calibration: A general algorithm, singularities, applications. In IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 1999.

[45]

United states geological survey explorer. https://earthexplorer.usgs.gov/, 2022. [Online; Accessed 27-August-2022].

[46]

Open Source Computer Vision. Opencv: Kalmanfilter reference. https://docs. opencv.org/3.4.1/dd/d6a/classcv_1_1KalmanFilter.html, 2022. [Online; Accessed 27-August-2022].

[47]

Wei Wang, Yao Yao, Xin Liu, Xiang Li, Pei Hao, and Ting Zhu. I can see the light: Attacks on autonomous vehicles using invisible lights. In ACM Conference on Computer and Communications Security, 2021.

Digital Library

[48]

Xiaoyu Wang, Ming Yang, Shenghuo Zhu, and Yuanqing Lin. Regionlets for generic object detection. In IEEE International Conference on Computer Vision, 2013.

Digital Library

[49]

Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In IEEE international conference on computer vision, 2017.

[50]

Bin Yan, Dong Wang, Huchuan Lu, and Xiaoyun Yang. Cooling-shrinking attack: Blinding the tracker with imperceptible noises. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.

[51]

Xiyu Yan, Xuesong Chen, Yong Jiang, Shu-Tao Xia, Yong Zhao, and Feng Zheng. Hijacking tracker: A powerful adversarial attack on visual tracking. In IEEE International Conference on Acoustics, Speech and Signal Processing, 2020.

[52]

Ekim Yurtsever, Jacob Lambert, Alexander Carballo, and Kazuya Takeda. A survey of autonomous driving: Common practices and emerging technologies. IEEE access, 2020.

[53]

Qi Zang and Reinhard Klette. Object classification and tracking in video surveil- lance. In Lecture Notes in Computer Science, volume 2756, pages 198--205, 2003.

[54]

Yue Zhao, Hong Zhu, Ruigang Liang, Qintao Shen, Shengzhi Zhang, and Kai Chen. Seeing isn't believing: Towards more robust adversarial attack against real world object detectors. In ACM Conference on Computer and Communications Security (CCS), 2019.

[55]

Yi Zhu, Chenglin Miao, Tianhang Zheng, Foad Hajiaghajani, Lu Su, and Chunming Qiao. Can we use arbitrary objects to attack lidar perception in autonomous driving? In ACM Conference on Computer and Communications Security (CCS), 2021.

Digital Library

[56]

Zheng Zhu, Qiang Wang, Li Bo, Wei Wu, Junjie Yan, and Weiming Hu. Distractor aware siamese networks for visual object tracking. In European Conference on Computer Vision, 2018.

Digital Library

Cited By

Zhang WYang FGuan Z(2024)Dual-Dimensional Adversarial Attacks: A Novel Spatial and Temporal Attack Strategy for Multi-Object Tracking2024 International Joint Conference on Neural Networks (IJCNN)10.1109/IJCNN60899.2024.10650801(1-10)Online publication date: 30-Jun-2024
https://doi.org/10.1109/IJCNN60899.2024.10650801
Song ROzmen MKim HMuller RCelik ZBianchi ACalandrino JTroncoso C(2023)Discovering adversarial driving maneuvers against autonomous vehiclesProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620403(2957-2974)Online publication date: 9-Aug-2023
https://dl.acm.org/doi/10.5555/3620237.3620403

Index Terms

Physical Hijacking Attacks against Object Trackers
1. Computing methodologies
  1. Machine learning
    1. Machine learning algorithms
2. Security and privacy
  1. Systems security

Recommendations

Object Inter-camera Tracking with Non-overlapping Views: A New Dynamic Approach
CRV '10: Proceedings of the 2010 Canadian Conference on Computer and Robot Vision

Disjoint inter-camera object tracking is the task of tracking objects across video-surveillance cameras that have non-overlapping views. Unlike the closely related task of single-camera tracking, disjoint inter-camera tracking is difficult due to the ...
Evasion attacks against machine learning at test time
ECMLPKDD'13: Proceedings of the 2013th European Conference on Machine Learning and Knowledge Discovery in Databases - Volume Part III

In security-sensitive applications, the success of machine learning depends on a thorough vetting of their resistance to adversarial data. In one pertinent, well-motivated attack scenario, an adversary may attempt to evade a deployed system at test time ...
Calibration and object correspondence in camera networks with widely separated overlapping views

This study contributes in two ways to the research of multi‐camera object tracking in the context of visual surveillance. Firstly, a semi‐automatic scene calibration method is proposed to deal with mapping a network of cameras with overlapped fields of ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

November 2022

3598 pages

ISBN:9781450394505

DOI:10.1145/3548606

General Chairs:
Heng Yin
University of California, Riverside
,
Angelos Stavrou
Virginia Tech
,
Program Chairs:
Cas Cremers
CISPA Helmholtz Center for Information Security
,
Elaine Shi
Carnegie Mellon University

Copyright © 2022 Owner/Author.

This work is licensed under a Creative Commons Attribution International 4.0 License.

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 November 2022

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Army Research Office
National Science Foundationoundation

Conference

CCS '22

Sponsor:

SIGSAC

CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security

November 7 - 11, 2022

CA, Los Angeles, USA

Acceptance Rates

Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

Upcoming Conference

CCS '24

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 14 - 18, 2024

Salt Lake City , UT , USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

1
Total Citations
View Citations
1,416
Total Downloads

Downloads (Last 12 months)640
Downloads (Last 6 weeks)92

Reflects downloads up to 03 Oct 2024

Other Metrics

View Author Metrics

Citations

Cited By

Zhang WYang FGuan Z(2024)Dual-Dimensional Adversarial Attacks: A Novel Spatial and Temporal Attack Strategy for Multi-Object Tracking2024 International Joint Conference on Neural Networks (IJCNN)10.1109/IJCNN60899.2024.10650801(1-10)Online publication date: 30-Jun-2024
https://doi.org/10.1109/IJCNN60899.2024.10650801
Song ROzmen MKim HMuller RCelik ZBianchi ACalandrino JTroncoso C(2023)Discovering adversarial driving maneuvers against autonomous vehiclesProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620403(2957-2974)Online publication date: 9-Aug-2023
https://dl.acm.org/doi/10.5555/3620237.3620403

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Media

Figures

Other

Tables

View Table of Contents