FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems
Published:
Autonomous Target Tracking (ATT) systems, especially in drones, are becoming increasingly common for surveillance and photography. However, their reliance on visual tracking algorithms introduces significant security vulnerabilities. A new paper titled “FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems” exposes a critical flaw that allows attackers to manipulate drones into dangerous proximity.
The Concept: Distance-Pulling Attack (DPA)
The core of this research is the Distance-Pulling Attack (DPA). The goal is simple but dangerous: deceive the drone into believing the target is further away than it actually is. This causes the drone’s control system to move closer to maintain the “correct” tracking distance, potentially leading to capture or collision.
Design: The Adversarial Umbrella
The researchers proposed a novel attack vector: an Adversarial Umbrella.
Why an umbrella?
- Deployable: It’s a common object, effectively hiding the attack in plain sight.
- Inconspicuous: Unlike obvious adversarial patches, a patterned umbrella doesn’t raise immediate suspicion.
- Control: It allows the attacker to easily manipulate the visual input presented to the drone.
Logic & Methodology
To achieve a robust attack, the system, dubbed FlyTrap, uses two key components:
1. Progressive Distance-Pulling (PDP) Strategy
Attacking a moving drone is difficult because the visual perspective changes constantly. The PDP strategy addresses this by simulating the attack’s effects under gradually decreasing distances. It uses physical modeling to estimate the distance and generates adversarial patterns that remain effective as the drone moves closer.
2. Attack Target Generator (ATG)
A major challenge in physical adversarial attacks is maintaining consistency across different viewing angles and frames (spatial-temporal consistency). The ATG solves this by explicitly encoding these constraints during the optimization process. It ensures that the generated adversarial pattern looks plausible to the drone’s tracking algorithm from multiple angles and over time, bypassing consistency-checking defenses.
Real-World Impact
The effectiveness of FlyTrap is alarming. Evaluations demonstrated that it works against real-world commercial ATT drones, including widely used models from DJI and HoverAir. The attack successfully reduced tracking distances to the point where drones could be:
- Captured: Physically grabbed by the attacker.
- Sensor Attacked: Brought close enough for other short-range attacks.
- Crashed: Tricked into colliding with the target or obstacles.
This research highlights a urgent need for robust defense mechanisms in autonomous systems, as simple visual deception can lead to physical safety risks.