FlyTrap

KO | EN

gitlite — search

#python #ai #android #machine-learning #rust #docker #macos #nodejs #kubernetes #awesome-list #vue #security #mcp #ios

(★ 20)

[NDSS 2026] FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems

FlyTrap Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h2 align="center"> 
 ☂️ FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems
 </h2>

<a href="https://daniel-xsy.github.io/" target="_blank">Shaoyuan Xie</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://mofakih.com/index.html" target="_blank">Mohamad Habib Fakih</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://github.com/Ljc-NTU" target="_blank">Junchi Lu</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://scholar.google.com/citations?user=049lxtUAAAAJ&hl=en" target="_blank">Fayzah Alshammari</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://me.ningfei.org/" target="_blank">Ningfei Wang</a> 
 <a href="https://tkm2261.github.io/" target="_blank">Takami Sato</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://halimabouzidi.github.io/" target="_blank">Halima Bouzidi</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://www.cecs.uci.edu/people/mohammad-a-al-faruque-3/" target="_blank">Mohammad Al Faruque</a>&nbsp;&nbsp;&nbsp;&nbsp;
 <a href="https://ics.uci.edu/~alfchen/" target="_blank">Qi Alfred Chen</a>
 
 University of California, Irvine

## About

Autonomous Target Tracking (ATT) systems, especially ATT drones, are widely used in applications such as surveillance, border control, and law enforcement, while also being misused in stalking and destructive actions. Thus, the security of ATT is highly critical for real-world applications. Under the scope, we present a new type of attack: distance-pulling attacks (DPA) and a systematic study of it, which exploits vulnerabilities in ATT systems to dangerously reduce tracking distances, leading to drone capturing, increased susceptibility to sensor attacks, or even physical collisions. To achieve these goals, we present FlyTrap, a novel physical-world attack framework that employs an adversarial umbrella as a deployable and domain-specific attack vector. In this artifact, we provide the instructions to reproduce the main results in the paper to support our main claim and main contribution.

## Citation

```bib
@inproceedings{xie2026flytrap,
  title={{FlyTrap: Physical Distance-Pulling Attack Towards Camera-based Autonomous Target Tracking Systems}},
  author={Xie, Shaoyuan and Fakih, Mohamad Habib and Lu, Junchi and Alshammari, Fayzah and Wang, Ningfei and Sato, Takami and Bouzidi, Halima and Al Faruque, Mohammad Abdullah and Chen, Qi Alfred},
  booktitle={ISOC Network and Distributed System Security Symposium (NDSS)},
  year={2026}
}
```

## Table of Contents

- [Installation](#installation)
- [Reproduction](#reproduction)
  - [Attack Evaluation](#1-attack-evaluation)
    - [FlyTrap Evaluation](#-11-flytrap-evaluation)
    - [TGT Evaluation](#-12-tgt-evaluation)
  - [Defense Evaluation](#2-defense-evaluation)
    - [PercepGuard Evaluation](#-21-percepguard-evaluation-table-iv-2-hours)
    - [VOGUES Evaluation](#-22-vogues-evaluation-table-v-8-hours)
- [Acknowledgments](#acknowledgments)

## Installation

Please refer to the [INSTALL.md](docs/INSTALL.md) for the installation instructions.

## Reproduction

All the time estimation is based on a single NVIDIA RTX 3090 GPU. You can run each of the following experiments in parallel.

### 1. Attack Evaluation

#### 🚀 1.1 FlyTrap Evaluation

We provide three options to evaluate the FlyTrap attack based on the available resources and time requirements.

- **Option 1: Full evaluation (~5 hours)**:

```sh
bash scripts/eval_flytrap.sh
```

- **Option 2: Partial evaluation (~1 hour)**:

You can select the following config files inside [`config/final`](./config/final):

| Model Name         | w/o PDP | w/ PDP |
|--------------------|:-------:|:------:|
| MixFormer          |   [`config/final/mixformer.py`](./config/final/mixformer.py)     |   [`config/final/mixformer_pdp.py`](./config/final/mixformer_pdp.py)    |
| SiamRPN-AlexNet    |   [`config/final/siamrpn_alex.py`](./config/final/siamrpn_alex.py)     |   [`config/final/siamrpn_alex_pdp.py`](./config/final/siamrpn_alex_pdp.py)    |
| SiamRPN-ResNet50   |   [`config/final/siamrpn_resnet.py`](./config/final/siamrpn_resnet.py)     |   [`config/final/siamrpn_resnet_pdp.py`](./config/final/siamrpn_resnet_pdp.py)    |
| SiamRPN-MobileV2   |   [`config/final/siamrpn_mob.py`](./config/final/siamrpn_mob.py)     |   [`config/final/siamrpn_mob_pdp.py`](./config/final/siamrpn_mob_pdp.py)    |

```sh
python tools/main.py <config_file>
```

- **Option 3: Pre-computed results (~10 minutes)**:

[![Google Drive](https://img.shields.io/badge/Google%20Drive-4285F4?logo=google-drive&logoColor=white&style=flat-square)](https://drive.google.com/file/d/1JWd_yHl3pBgPSuHNr-XDkllULAm5TBDK/view?usp=drive_link)

Download the pre-computed results from the above [link](https://drive.google.com/file/d/1JWd_yHl3pBgPSuHNr-XDkllULAm5TBDK/view?usp=drive_link). You can also download using the terminal command:
```bash
bash download/download_flytrap_results.sh
```

---

Finally, run the following command to compute the detailed metric:

- **Option 1 Full Evaluation**:

If you run the full evaluation above (**option 1**) or if you downloaded the pre-computed results (**option 3**), you can run the following command to compute the detailed metric.

```bash
bash scripts/metric_summary.sh
```

- **Option 2 Partial Evaluation**:

If you run the partial evaluation above (**option 2**), you can run the following command to compute the detailed metric. Please replace `<config>` with the config file name you evaluated above.

```bash
python analysis/analyze_result_metric.py --file work_dirs/<config>/json_files/results_epoch-1.json
```

#### 🚀 1.2 TGT Evaluation

We also provide three options to evaluate the TGT attack based on the available resources and time requirements.

- **Option 1: Full Evaluation (~40 hours)**:

Run the following command to evaluate the effectiveness and universality of TGT Images; all the TGT baseline attack patches are located in [`tgt`](./tgt):

```sh
bash scripts/eval_tgt.sh
```

- **Option 2: Partial Evaluation (~10 hours)**:

You can specify the config file from the following list, depending on the victim model you want to evaluate.

- `config/final/mixformer_tgt.py`
- `config/final/siamrpn_alex_tgt.py`
- `config/final/siamrpn_mob_tgt.py`
- `config/final/siamrpn_resnet_tgt.py`

```sh
bash scripts/eval_tgt_partial.sh <config_file>
```

- **Option 3: Pre-computed results (~10 minutes)**:

[![Google Drive](https://img.shields.io/badge/Google%20Drive-4285F4?logo=google-drive&logoColor=white&style=flat-square)](https://drive.google.com/file/d/1JZkyJQy3-EsUkjAC0uxpTP3LQ-_38HQm/view?usp=sharing)

Download the pre-computed results from the above [link](https://drive.google.com/file/d/1JZkyJQy3-EsUkjAC0uxpTP3LQ-_38HQm/view?usp=sharing). You can also download using the terminal command:
```bash
bash download/download_tgt_results.sh
```

---

If you run the full evaluation above (**option 1**) or if you downloaded the pre-computed results (**option 3**), you can run the following command to compute the detailed metric. If you run the partial evaluation above (**option 2**), please use the specific `<config_file>` you evaluated above.

```bash
python analysis/analyze_tgt_metric.py --input_dir work_dirs/mixformer_tgt/json_files
python analysis/analyze_tgt_metric.py --input_dir work_dirs/siamrpn_alex_tgt/json_files
python analysis/analyze_tgt_metric.py --input_dir work_dirs/siamrpn_mob_tgt/json_files
python analysis/analyze_tgt_metric.py --input_dir work_dirs/siamrpn_resnet_tgt/json_files
```

### 2. Defense Evaluation

We provide the code to evaluate the defense methods: Security'23 [`PercepGuard`](https://www.usenix.org/conference/usenixsecurity23/presentation/man) and Security'24 [`VOGUES`](https://www.usenix.org/conference/usenixsecurity24/presentation/muller).

#### 🚀 2.1 PercepGuard Evaluation (Table IV, ~2 hours)

Run the following command one by one to evaluate the defense of FlyTrapATG and vanilla FlyTrap. The results will be saved in `work_dirs/percepguard_results`: `before` means the false alarm rate and `after` means the true alarm rate after the attack.

```sh
# Evaluation MixFormer
bash scripts/eval_percepguard.sh config/final/mixformer_percepguard.py patches/mixformer_flytrap_atg_percepguard.png
bash scripts/eval_percepguard.sh config/final/mixformer_percepguard.py patches/mixformer_flytrap_pdp.png

# Evaluation SiamRPN-ResNet
bash scripts/eval_percepguard.sh config/final/siamrpn_resnet_percepguard.py patches/siamrpn_resnet_flytrap_atg_percepguard.png
bash scripts/eval_percepguard.sh config/final/siamrpn_resnet_percepguard.py patches/siamrpn_resnet_flytrap_pdp.png

# Evaluation SiamRPN-Mobile
bash scripts/eval_percepguard.sh config/final/siamrpn_mob_percepguard.py patches/siamrpn_mobile_flytrap_atg_percepguard.png
bash scripts/eval_percepguard.sh config/final/siamrpn_mob_percepguard.py patches/siamrpn_mobile_flytrap_pdp.png

# Evaluation SiamRPN-Alex
bash scripts/eval_percepguard.sh config/final/siamrpn_alex_percepguard.py patches/siamrpn_alex_flytrap_atg_percepguard.png
bash scripts/eval_percepguard.sh config/final/siamrpn_alex_percepguard.py patches/siamrpn_alex_flytrap_pdp.png
```

#### 🚀 2.2 VOGUES Evaluation (Table V, ~8 hours)

Run the following command one by one to evaluate FlyTrapATG and vanilla FlyTrap. The results will be saved in `work_dirs/vogues_results`
- In attack case: `before` means the false alarm rate before the attack and `after` means the true alarm rate after the attack.

- In benign case: `before` means the false alarm rate without the umbrella and `after` means the false alarm rate with the umbrella.

```sh
# Evaluation MixFormer
bash scripts/eval_vogues.sh config/final/mixformer_vogues.py patches/mixformer_flytrap_atg_vogues.png
bash scripts/eval_vogues.sh config/final/mixformer_vogues.py patches/mixformer_flytrap_pdp.png

# Evaluation SiamRPN-ResNet
bash scripts/eval_vogues.sh config/final/siamrpn_resnet_vogues.py patches/siamrpn_resnet_flytrap_atg_vogues.png
bash scripts/eval_vogues.sh config/final/siamrpn_resnet_vogues.py patches/siamrpn_resnet_flytrap_pdp.png

# Evaluation SiamRPN-Mobile
bash scripts/eval_vogues.sh config/final/siamrpn_mob_vogues.py patches/siamrpn_mobile_flytrap_atg_vogues.png
bash scripts/eval_vogues.sh config/final/siamrpn_mob_vogues.py patches/siamrpn_mobile_flytrap_pdp.png

# Evaluation SiamRPN-Alex
bash scripts/eval_vogues.sh config/final/siamrpn_alex_vogues.py patches/siamrpn_alex_flytrap_atg_vogues.png
bash scripts/eval_vogues.sh config/final/siamrpn_alex_vogues.py patches/siamrpn_alex_flytrap_pdp.png
```

## Acknowledgments

We thank the following projects for their contributions:

- [AlphaPose](https://github.com/MVIG-SJTU/AlphaPose)
- [PySOT](https://github.com/STVIR/pysot)
- [MixFormer](https://github.com/MCG-NJU/MixFormer)
- [PercepGuard](https://github.com/Harry1993/PercepGuard)

> All drone data and experiments presented in this work were completed before December 22, 2025

FlyTrap

FlyTrap Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

FlyTrap

FlyTrap Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README