FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems

2025-09-24

AI Summary

This work identifies and systematically investigates Distance-Pulling Attack (DPA), a novel physical-domain attack against camera-based autonomous target-tracking drones. DPA employs an adversarial umbrella as a controllable physical perturbation to induce closed-loop feedback that drives the drone abnormally close to its target—significantly reducing tracking distance and risking capture, sensor blinding, or collision. Unlike conventional digital-domain adversarial examples, this paper introduces the first deployable DPA paradigm ensuring spatiotemporal consistency and closed-loop efficacy. We design a progressive distance-regulation strategy and a robust optimization method, validated through both white-box and black-box experiments on commercial DJI and HoverAir drones. Results demonstrate that DPA reliably triggers safety-critical failures in real-world settings, exposing a critical vulnerability in vision-based tracking systems at the physical interaction level.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Application Domains: Mobility, Driving & Flight
• Multiagent Systems: Adversarial Agents

Application Category

• Security and Privacy: Tracking, profiling, and countermeasures against them
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Human-perceived consequences of algorithmic deployment on the web

Abstract

Autonomous Target Tracking (ATT) systems, especially ATT drones, are widely used in applications such as surveillance, border control, and law enforcement, while also being misused in stalking and destructive actions. Thus, the security of ATT is highly critical for real-world applications. Under the scope, we present a new type of attack: distance-pulling attacks (DPA) and a systematic study of it, which exploits vulnerabilities in ATT systems to dangerously reduce tracking distances, leading to drone capturing, increased susceptibility to sensor attacks, or even physical collisions. To achieve these goals, we present FlyTrap, a novel physical-world attack framework that employs an adversarial umbrella as a deployable and domain-specific attack vector. FlyTrap is specifically designed to meet key desired objectives in attacking ATT drones: physical deployability, closed-loop effectiveness, and spatial-temporal consistency. Through novel progressive distance-pulling strategy and controllable spatial-temporal consistency designs, FlyTrap manipulates ATT drones in real-world setups to achieve significant system-level impacts. Our evaluations include new datasets, metrics, and closed-loop experiments on real-world white-box and even commercial ATT drones, including DJI and HoverAir. Results demonstrate FlyTrap's ability to reduce tracking distances within the range to be captured, sensor attacked, or even directly crashed, highlighting urgent security risks and practical implications for the safe deployment of ATT systems.

Problem

• Exploiting ATT system vulnerabilities to dangerously reduce tracking distances
• Developing physical attacks causing drone capture, sensor compromise, or collisions
• Creating deployable attack framework using adversarial umbrella as attack vector

Innovation

• Adversarial umbrella as domain-specific attack vector
• Progressive distance-pulling strategy for drone manipulation
• Controllable spatial-temporal consistency designs for real-world effectiveness