FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems

TL;DR

This work defines distance-pulling attacks (DPA) against camera-based Autonomous Target Tracking (ATT) drones and introduces FlyTrap, which employs a physically deployable adversarial umbrella to progressively shrink the tracked target and pull the drone toward the attacker in a closed-loop setting. The approach combines a progressive distance-pulling (PDP) framework with a controllable attack target generator (ATG) to enforce spatial-temporal consistency across multiple perception models, enabling robust, real-world attacks that culminate in capture, sensor compromise, or crash. It provides a comprehensive evaluation on white-box and commercial drones, including open-loop digital tests, physical closed-loop experiments, and end-to-end demonstrations, plus defense evaluations (PercepGuard, VOGUES, VisionGuard) and a user study on stealth. The findings reveal substantial system-level risks for ATT deployments, demonstrate strong cross-model generalization and real-world feasibility, and underscore the urgent need for robust defenses and secure deployment practices in camera-based ATT systems.

Abstract

Autonomous Target Tracking (ATT) systems, especially ATT drones, are widely used in applications such as surveillance, border control, and law enforcement, while also being misused in stalking and destructive actions. Thus, the security of ATT is highly critical for real-world applications. Under the scope, we present a new type of attack: distance-pulling attacks (DPA) and a systematic study of it, which exploits vulnerabilities in ATT systems to dangerously reduce tracking distances, leading to drone capturing, increased susceptibility to sensor attacks, or even physical collisions. To achieve these goals, we present FlyTrap, a novel physical-world attack framework that employs an adversarial umbrella as a deployable and domain-specific attack vector. FlyTrap is specifically designed to meet key desired objectives in attacking ATT drones: physical deployability, closed-loop effectiveness, and spatial-temporal consistency. Through novel progressive distance-pulling strategy and controllable spatial-temporal consistency designs, FlyTrap manipulates ATT drones in real-world setups to achieve significant system-level impacts. Our evaluations include new datasets, metrics, and closed-loop experiments on real-world white-box and even commercial ATT drones, including DJI and HoverAir. Results demonstrate FlyTrap's ability to reduce tracking distances within the range to be captured, sensor attacked, or even directly crashed, highlighting urgent security risks and practical implications for the safe deployment of ATT systems.

Figures (29)

• Figure 1: Overview of the Autonomous Target Tracking (ATT) system data flow and our proposed distance-pulling attack (DPA) propagation path. We treat the camera as a physical entry point and use the adversarial umbrella to attack the Single Object Tracking (SOT) model and then the distance control algorithm to cause system-level distance-pulling effects, achieving attack goals including drone capturing, range-limited sensor attacks, or direct crashing.
• Figure 2: Left: Single Object Tracking (SOT) depends on the initialization as the template frame and tracks the target in search frames. Right: The drone adjusts its position to keep the box at the center and the same size as the template frame.
• Figure 3: Illustration of distance-pulling attack (DPA) and attack goals targeted in this work. We target to dangerously shorten the tracking distance of ATT drones, which can be exploited to cause the drone to be A1: captured; A2: under range-limited sensor attacks; or even A3: crashed into the attack umbrella.
• Figure 4: FlyTrap overall pipeline. We design an adversarial umbrella as a domain-specific and deployable attack vector. The progressive distance-pulling (PDP) achieves the closed-loop distance-pulling effects while the attack target generation (ATG) constrains the spatial-temporal consistency.
• Figure 5: Design for progressive distance-pulling via physical modeling. We propose to leverage computer graphics to simulate the closed-loop dynamics of the DPA process. We further derive the upper bound to set the shrink rate for each stage.

Theorems & Definitions (2)

• Theorem 1
• proof