  Adversarial attacks of deep neural networks have been intensively studied on
image, audio, natural language, patch, and pixel classification tasks.
Nevertheless, as a typical, while important real-world application, the
adversarial attacks of online video object tracking that traces an object's
moving trajectory instead of its category are rarely explored. In this paper,
we identify a new task for the adversarial attack to visual tracking: online
generating imperceptible perturbations that mislead trackers along an incorrect
(Untargeted Attack, UA) or specified trajectory (Targeted Attack, TA). To this
end, we first propose a \textit{spatial-aware} basic attack by adapting
existing attack methods, i.e., FGSM, BIM, and C&W, and comprehensively analyze
the attacking performance. We identify that online object tracking poses two
new challenges: 1) it is difficult to generate imperceptible perturbations that
can transfer across frames, and 2) real-time trackers require the attack to
satisfy a certain level of efficiency. To address these challenges, we further
propose the spatial-aware online incremental attack (a.k.a. SPARK) that
performs spatial-temporal sparse incremental perturbations online and makes the
adversarial attack less perceptible. In addition, as an optimization-based
method, SPARK quickly converges to very small losses within several iterations
by considering historical incremental perturbations, making it much more
efficient than basic attacks. The in-depth evaluation on state-of-the-art
trackers (i.e., SiamRPN++ with AlexNet, MobileNetv2, and ResNet-50, and SiamDW)
on OTB100, VOT2018, UAV123, and LaSOT demonstrates the effectiveness and
transferability of SPARK in misleading the trackers under both UA and TA with
minor perturbations.
