While deep convolutional neural networks (CNNs) are vulnerable to adversarial
attacks, considerably few efforts have been paid to construct robust deep
tracking algorithms against adversarial attacks. Current studies on adversarial
attack and defense mainly reside in a single image. In this work, we first
attempt to generate adversarial examples on top of video sequences to improve
the tracking robustness against adversarial attacks. To this end, we take
temporal motion into consideration when generating lightweight perturbations
over the estimated tracking results frame-by-frame. On one hand, we add the
temporal perturbations into the original video sequences as adversarial
examples to greatly degrade the tracking performance. On the other hand, we
sequentially estimate the perturbations from input sequences and learn to
eliminate their effect for performance restoration. We apply the proposed
adversarial attack and defense approaches to state-of-the-art deep tracking
algorithms. Extensive evaluations on the benchmark datasets demonstrate that
our defense method not only eliminates the large performance drops caused by
adversarial attacks, but also achieves additional performance gains when deep
trackers are not under adversarial attacks.

本文提出了一种基于视频序列的对抗攻击和防御方法，通过考虑时间运动并生成轻量级扰动，有效提高了深度跟踪算法的鲁棒性，结果表明该方法不仅能消除对抗攻击带来的大幅性能下降，同时在未受到攻击时也能获得额外的性能增益。

对抗攻击下的稳健跟踪

Robust Tracking against Adversarial Attacks

We study the robustness of image classifiers to temporal perturbations
derived from videos. As part of this study, we construct two datasets,
ImageNet-Vid-Robust and YTBB-Robust , containing a total 57,897 images grouped
into 3,139 sets of perceptually similar images. Our datasets were derived from
ImageNet-Vid and Youtube-BB respectively and thoroughly re-annotated by human
experts for image similarity. We evaluate a diverse array of classifiers
pre-trained on ImageNet and show a median classification accuracy drop of 16
and 10 on our two datasets. Additionally, we evaluate three detection models
and show that natural perturbations induce both classification as well as
localization errors, leading to a median drop in detection mAP of 14 points.
Our analysis demonstrates that perturbations occurring naturally in videos pose
a substantial and realistic challenge to deploying convolutional neural
networks in environments that require both reliable and low-latency predictions

本文研究图像分类器对视频时序扰动的鲁棒性。我们构建了两个数据集，ImageNet-Vid-Robust 和 YTBB-Robust，包含 57,897 张图像，分为 3,139 组感知相似图像，并对其进行了重新注释以进行相似性分析。我们评估了各种经过 ImageNet 预训练的分类器，结果显示在两个数据集上的中位分类准确性分别下降了 16 和 10。此外，我们还评估了三个检测模型，并显示自然扰动会引起分类和定位误差，导致检测 mAP 中位数下降 14 个点。我们的分析表明，视频中自然发生的扰动对于在需要可靠和低延迟预测的环境中部署卷积神经网络是一个实际而重大的挑战。