ML Security PapersOut of Sight, Out of Track: Adversarial Attacks on Propagation-based Multi-Object Trackers via Query State Manipulation
Halima Bouzidi , Haoyu Liu , Yonatan Gizachew Achamyeleh , Praneetsai Vasu Iddamsetty , Mohammad Abdullah Al Faruque
Published on arXiv
2604.00452
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Causes significant identity switches and track terminations against state-of-the-art TBP trackers on MOT17 and MOT20 benchmarks
FADE
Novel technique introduced
Recent Tracking-by-Query-Propagation (TBP) methods have advanced Multi-Object Tracking (MOT) by enabling end-to-end (E2E) pipelines with long-range temporal modeling. However, this reliance on query propagation introduces unexplored architectural vulnerabilities to adversarial attacks. We present FADE, a novel attack framework designed to exploit these specific vulnerabilities. FADE employs two attack strategies targeting core TBP mechanisms: (i) Temporal Query Flooding: Generates spurious temporally consistent track queries to exhaust the tracker's limited query budget, forcing it to terminate valid tracks. (ii) Temporal Memory Corruption: Directly attacks the query updater's memory by severing temporal links via state de-correlation and erasing the learned feature identity of matched tracks. Furthermore, we introduce a differentiable pipeline to optimize these attacks for physical-world realizability by leveraging simulations of advanced perception sensor spoofing. Experiments on MOT17 and MOT20 benchmarks demonstrate that FADE is highly effective against state-of-the-art TBP trackers, causing significant identity switches and track terminations.
Key Contributions
- Novel attack framework (FADE) exploiting architectural vulnerabilities in Tracking-by-Query-Propagation methods
- Two attack strategies: Temporal Query Flooding (exhausts query budget) and Temporal Memory Corruption (severs temporal links)
- Differentiable optimization pipeline for physical-world realizability via perception sensor spoofing simulations
🛡️ Threat Analysis
FADE generates adversarial perturbations at inference time to manipulate multi-object tracking behavior through two attack strategies: temporal query flooding and temporal memory corruption. The attacks cause misclassification/misdetection by exploiting the tracker's query propagation mechanism, and are optimized for physical-world realizability through sensor spoofing simulations.