# Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises

arXiv: https://arxiv.org/abs/2003.09595 · HTML: https://mlsanity.com/paper/2003.09595/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Mar 2020.

## Built on by (most cited first, 30 of 32)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Towards More Flexible and Accurate Object Tracking with Natural Language: Algorithms and Benchmark](https://mlsanity.com/paper/2103.16746/) (2021)
- [Visual Object Tracking with Discriminative Filters and Siamese Networks: A Survey and Outlook](https://mlsanity.com/paper/2112.02838/) (2021)
- [IoU Attack: Towards Temporally Coherent Black-Box Adversarial Attack for Visual Object Tracking](https://mlsanity.com/paper/2103.14938/) (2021)
- [Fooling LiDAR Perception via Adversarial Trajectory Perturbation](https://mlsanity.com/paper/2103.15326/) (2021)
- [Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices](https://mlsanity.com/paper/2106.15202/) (2021)
- [Learning to Adversarially Blur Visual Object Tracking](https://mlsanity.com/paper/2107.12085/) (2021)
- [Efficient universal shuffle attack for visual object tracking](https://mlsanity.com/paper/2203.06898/) (2022)
- [SiamMask: A Framework for Fast Online Object Tracking and Segmentation](https://mlsanity.com/paper/2207.02088/) (2022)
- [Siamese Object Tracking for Unmanned Aerial Vehicle: A Review and Comprehensive Analysis](https://mlsanity.com/paper/2205.04281/) (2022)
- [DIMBA: Discretely Masked Black-Box Attack in Single Object Tracking](https://mlsanity.com/paper/2207.08044/) (2022)
- [A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking](https://mlsanity.com/paper/2105.02480/) (2021)
- [Fast Gradient Non-sign Methods](https://mlsanity.com/paper/2110.12734/) (2021)
- [Adversarial Attacks on Video Object Segmentation with Hard Region Discovery](https://mlsanity.com/paper/2309.13857/) (2023)
- [Temporal Unlearnable Examples: Preventing Personal Video Data from Unauthorized Exploitation by Object Tracking](https://mlsanity.com/paper/2507.07483/) (2025)
- [Fooling Object Detectors: Adversarial Attacks by Half-Neighbor Masks](https://mlsanity.com/paper/2101.00989/) (2021)
- [Ad2Attack: Adaptive Adversarial Attack on Real-Time UAV Tracking](https://mlsanity.com/paper/2203.01516/) (2022)
- [Emerging Threats in Deep Learning-Based Autonomous Driving: A Comprehensive Survey](https://mlsanity.com/paper/2210.11237/) (2022)
- [Reproducibility Study on Adversarial Attacks Against Robust Transformer Trackers](https://mlsanity.com/paper/2406.01765/) (2024)
- [TrackPGD: Efficient Adversarial Attack using Object Binary Masks against Robust Transformer Trackers](https://mlsanity.com/paper/2407.03946/) (2024)
- [Single Object Tracking Research: A Survey](https://mlsanity.com/paper/2204.11410/) (2022)
- [Physical ID-Transfer Attacks against Multi-Object Tracking via Adversarial Trajectory](https://mlsanity.com/paper/2512.01934/) (2025)
- [Tracklet-Switch Adversarial Attack against Pedestrian Multi-Object Tracking Trackers](https://mlsanity.com/paper/2111.08954/) (2021)
- [Enhancing Tracking Robustness with Auxiliary Adversarial Defense Networks](https://mlsanity.com/paper/2402.17976/) (2024)
- [LRR: Language-Driven Resamplable Continuous Representation against Adversarial Tracking Attacks](https://mlsanity.com/paper/2404.06247/) (2024)
- [Adversarial Attacks on LiDAR-Based Tracking Across Road Users: Robustness Evaluation and Target-Aware Black-Box Method](https://mlsanity.com/paper/2410.20893/) (2024)
- [Adversarial Bounding Boxes Generation (ABBG) Attack against Visual Object Trackers](https://mlsanity.com/paper/2411.17468/) (2024)
- [Towards Adaptive Meta-Gradient Adversarial Examples for Visual Tracking](https://mlsanity.com/paper/2505.08999/) (2025)
- [Mind Your Clever Neighbours: Unsupervised Person Re-identification via Adaptive Clustering Relationship Modeling](https://mlsanity.com/paper/2112.01839/) (2021)
- [Person Monitoring by Full Body Tracking in Uniform Crowd Environment](https://mlsanity.com/paper/2209.01274/) (2022)

## Abstract (arXiv)

Adversarial attack of CNN aims at deceiving models to misbehave by adding imperceptible perturbations to images. This feature facilitates to understand neural networks deeply and to improve the robustness of deep learning models. Although several works have focused on attacking image classifiers and object detectors, an effective and efficient method for attacking single object trackers of any target in a model-free way remains lacking. In this paper, a cooling-shrinking attack method is proposed to deceive state-of-the-art SiameseRPN-based trackers. An effective and efficient perturbation generator is trained with a carefully designed adversarial loss, which can simultaneously cool hot regions where the target exists on the heatmaps and force the predicted bounding box to shrink, making the tracked target invisible to trackers. Numerous experiments on OTB100, VOT2018, and LaSOT datasets show that our method can effectively fool the state-of-the-art SiameseRPN++ tracker by adding small perturbations to the template or the search regions. Besides, our method has good transferability and is able to deceive other top-performance trackers such as DaSiamRPN, DaSiamRPN-UpdateNet, and DiMP. The source codes are available at https://github.com/MasterBin-IIAU/CSA.