Siamese trackers are shown to be vulnerable to adversarial attacks recently. However, the existing attack methods craft the perturbations for each video independently, which comes at a non-negligible computational cost. In this paper, we show the existence of universal perturbations that can enable the targeted attack, e.g., forcing a tracker to follow the ground-truth trajectory with specified offsets, to be video-agnostic and free from inference in a network. Specifically, we attack a tracker by adding a universal imperceptible perturbation to the template image and adding a fake target, i.e., a small universal adversarial patch, into the search images adhering to the predefined trajectory, so that the tracker outputs the location and size of the fake target instead of the real target. Our approach allows perturbing a novel video to come at no additional cost except the mere addition operations -- and not require gradient optimization or network inference. Experimental results on several datasets demonstrate that our approach can effectively fool the Siamese trackers in a targeted attack manner. We show that the proposed perturbations are not only universal across videos, but also generalize well across different trackers. Such perturbations are therefore doubly universal, both with respect to the data and the network architectures. We will make our code publicly available.

中文翻译：

---

一个简单而强大的基准，可以对暹罗视觉跟踪进行普遍的有针对性的攻击

最近显示，暹罗追踪器容易受到对抗性攻击。但是，现有的攻击方法独立地为每个视频制作干扰，这在计算上是不可忽略的。在本文中，我们展示了通用扰动的存在，该扰动可以使有针对性的攻击成为可能，例如，强制跟踪器以指定的偏移量遵循地面真相的轨迹，使其与视频无关，并且不受网络中的推理影响。具体来说，我们通过向模板图像添加通用的不可感知的扰动并向遵循预定轨迹的搜索图像中添加假目标（即小的通用对抗补丁）来攻击跟踪器，以便跟踪器输出目标的位置和大小假目标而不是真实目标。我们的方法允许仅通过加法运算就可以摄制新颖的视频而无需支付额外费用-无需进行梯度优化或网络推理。在多个数据集上的实验结果表明，我们的方法可以以有针对性的攻击方式有效地欺骗暹罗跟踪器。我们表明，提出的摄动不仅在视频中通用，而且在不同的跟踪器中也能很好地泛化。因此，就数据和网络架构而言，这种扰动是双重普遍的。我们将使我们的代码公开可用。我们表明，提出的摄动不仅在视频中通用，而且在不同的跟踪器中也能很好地推广。因此，就数据和网络架构而言，这种扰动是双重普遍的。我们将使我们的代码公开可用。我们表明，提出的摄动不仅在视频中通用，而且在不同的跟踪器中也能很好地泛化。因此，就数据和网络架构而言，这种扰动是双重普遍的。我们将使我们的代码公开可用。