Bilateral Adversarial Patch Generating Network for the Object Tracking Algorithm

Round 1

Reviewer 1 Report

This paper proposes a bilateral adversarial patch generating network and push the frontier of adversarial patch generation for SOT networks. The network utilizes the Focus structure to incorporate both template and search region information, generating adversarial patches for both using two separate branches. The DeFocus structure is also proposed to solve the size discrepancy between the template and search region of the tracking network.

 

The following issues are suggested to be addressed to further improve the quality of this work.

 

1). Line 47, “Current adversarial patch generation algorithms for object tracking networks didn’t incorporate template information, only generating patches for the search region.” Some references are needed to be added here, with a clear explanation of which algorithms.

 

2). The authors claim that template information can be used for adversarial patch generation. Why this information is important? (i.e., the motivation and benefits by using this information is not clear). Can we think this is a simplified setting of previous attack methods?

 

3). The following works focus on generation or adversarial based tracking are missing in the related works. The authors need to review and discuss with these trackers.

[a] Song, Y., Ma, C., Wu, X., Gong, L., Bao, L., Zuo, W., Shen, C., Lau, R.W. and Yang, M.H., 2018. Vital: Visual tracking via adversarial learning. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 8990-8999).

[b] Wang, X., Li, C., Luo, B. and Tang, J., 2018. Sint++: Robust visual tracking via adversarial positive instance generation. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 4864-4873).

[c] Wang, X., Chen, Z., Tang, J., Luo, B., Wang, Y., Tian, Y. and Wu, F., 2021. Dynamic attention guided multi-trajectory analysis for single object tracking. IEEE Transactions on Circuits and Systems for Video Technology, 31(12), pp.4895-4908.

 

 

4). Recently, the Transformer-based tracking is a hot research topic, how about the effects on the Transformer based tracking frameworks. Related analysis or experimental validations suggested to be discussed. Does the attacking algorithm still work well when facing trackers equipped with pre-trained big models, like the InternImage?

 

 

5). The caption of Fig. 3 is too short. More detailed introductions are needed. Brief introductions to the Fig. 2 and other figures are also needed. What does the rectangle mean in the Eq. 1? “Where the Ip, Ia, I is the patched image” should be “where the Ip, Ia, I is the patched image”. There are also same issues in other sentences.

 

 

 

6). The experiments are conducted based on UAV123 and UAVDT dataset, which are relatively old for the SOT task. Large-scale datasets like the LaSOT and TNL2K are suggested for the evaluation.

Please further polish this paper. 

Author Response

We are very grateful for your review and the affirmation of our work. All of your comments are very valuable to our work. After carefully studying your comments, we tried our best to improve our research. Detailed responses to those comments are presented in the response file.

Author Response File: Author Response.pdf

Reviewer 2 Report

This work presents a novel adversarial patch generation architecture used to combat Single Object Tracking systems and novel metrics that can be used to evaluate performance of these systems, without being biased towards larger patches. This is a well written manuscript and the experimental coverage is more than adequate in my opinion. I would recommend accepting this manuscript with a few minor edits:

1) Improve the descrivptiveness of image captions
2) There appears to be a formatting issue in Equation 1
3) Minor English editing, as noted below.
4) Improve the formatting of list in section 3.3
5) Provide further discussion on the limitations noted in the conclusion. These limitations should be noted in the discussion of approach and/or within the experimental results
6) You should note that alpha, beta, and gamma from equation 8 are user-set hyperparameters. You should also note how optimal values for each were found for your experiments.

There are a few areas where minor English editing should be applied, but overall it reads nicely.

Author Response

We deeply appreciate your review and the recognition of our work. Your comments have been invaluable in guiding us towards further improvements. After thorough consideration of your feedback, we have diligently worked to enhance our research. We now present the refined version of our paper, incorporating the necessary revisions based on your insightful comments. The detailed responses to your comments are presented in the response file.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors generally addressed my concerns well, and the newly conducted experiments are suggested to be added in the new version. 

Author Response

Thank you for reviewing our paper and providing your valuable feedback. In the previous review, you requested two experiments to be conducted: 1) investigating the impact of pre-trained models on attack performance, and 2) validating the algorithm using new datasets. We have performed the experiments as requested and obtained the results. Regarding the first experiment, we have included the results in the revised version of the paper this time. However, for the second experiment, as our algorithm is suitable for attacking aerial view object tracking algorithms, we conducted experiments using UAV datasets. Therefore, including the results of the second experiment (conducted on non-UAV datasets) in the paper may affect the overall intention of the paper. Before incorporating the second experimental content into the paper, we will discuss it with the editor to ensure the consistency of the paper's content and its consistency with the journal.

Author Response File: Author Response.pdf