BankTweak: Adversarial Attack Against Multi-Object Trackers by Manipulating Feature Banks

1 Introduction

Multi-object tracking (MOT) is a fundamental perception task aimed at constructing motion trajectories of objects across consecutive frames. Modern DNN-based tracking-bydetection frameworks consist of two stages: detecting objects of interest in each frame (detection) and associating these detections with existing trajectories (association) [Wojke et al., 2017]. In the association phase, a CNN-based model (e.g., OSNet [Zhou et al., 2019]) extracts object features, which are stored in a feature bank if matched using feature-based similarity or motion-based IoU (Intersection over Union). Feature-based matching initially pairs objects with the highest feature similarity, followed by motion-based IoU matching for unmatched objects.

Despite the widespread application and significance of MOT systems, studies on adversarial attacks and defense mechanisms remain limited, falling into two categories: i) targeting the detection phase to generate false negatives and false alarms, and ii) state-of-the-art (SOTA) attacks disrupting the association phase to cause identity (ID) switches by manipulating object positions. Category i) attacks, such as the false negative (FN) attack [Lu et al., 2017] ( 1⃝ in Fig. 1) and Daedalus [Wang et al., 2021] ( 2⃝), degrade detection performance in attacked frames by generating false negatives and false alarms, respectively. However, as these methods focus solely on the detection phase, their effects are limited to the targeted frames, lacking efficiency. For instance, in FN attack and Daedalus scenarios (Fig. 1(a)), the object with ID 1 retains the same ID in post-attack frames, resulting in no impact on post-attack accuracy.

In category ii), Hijacking [Jia et al., 2020] ( 3⃝) disrupts the Kalman filter [Kalman, 1960] by manipulating detection boxes away from their correct velocity, potentially triggering ID switches. The F&F attack [Zhou et al., 2023] ( 4⃝) removes the target object and surrounds it with false alarms, resulting in persistent ID switches even after the attack concludes. As shown in Fig.1(b), these attacks increase the Mahalanobis distance [De Maesschalck et al., 2000] between the measured and predicted positions in the post-attack frame. This distance exceeds the matching boundary, leading to misidentification and the assignment of a new (false) ID (e.g., ID 2). A key misunderstanding of such SOTA attacks is the assumption that persistent ID switches can only be caused by shifting object positions beyond the matching boundary.

In this paper, exploiting this misunderstanding, we first reveal that increasing the Mahalanobis distance threshold (expanding the matching boundary) in prediction models, such as the Kalman filter, effectively counteracts category ii) attacks with minimal accuracy loss (as detailed in Sec. 4), thereby exposing their inherent lack of robustness. Then, overcoming the inherent limitations in i) and ii), we propose BankTweak, a novel adversarial attack that establishes a new paradigm for MOT attacks by inducing persistent ID switches (efficiency) while preserving object positions (robustness). This is achieved through a two-step process: (i) injecting targeted features into the feature bank of selected object pairs without causing ID switches (Step 1: groundwork), and (ii) exploiting this setup to induce permanent ID switches (Step 2: ID Switch). As described in Sec. 3 and illustrated in Figs. 3(b) and (c), inducing persistent ID switches independently of object positions is inherently challenging due to the properties of feature banks. However, BankTweak overcomes this limitation by exploiting vulnerabilities in the Hungarian matching algorithm used by feature-based MOT systems. Notably, BankTweak is capable of simultaneously attacking multiple object pairs within a single frame

As an additional key advantage, unlike the F&F attack, which increases the risk of detection by defenders by generating numerous false alarm objects, BankTweak completely avoids producing false alarms, thereby significantly enhancing its stealth. Moreover, unlike the Hijacking attack requiring model-specific design like Kalman filter information, BankTweak does not rely on such specifics, ensuring greater generality. Fig. 1(c) represents the characteristics of MOT attacks, including BankTweak. Importantly, BankTweak is not tailored to a specific tracker, making it compatible with most DNN-based tracking-by-detection methods that use a feature bank and a two-stage association approach (i.e., feature-based and subsequent IoU-based).

To demonstrate the applicability, BankTweak is applied to three multi-object trackers (DeepSORT [Wojke et al., 2017], StrongSORT [Du et al., 2023], and MOTDT [Chen et al., 2018]) using a diverse set of detectors: one-stage (YOLOX [Ge et al., 2021]), two-stage (Faster R-CNN [Ren et al., 2015]), anchor-free (FoveaBox [Kong et al., 2020]), and transformer-based (DETR [Zhu et al., 2021]), along with four feature extractors (OSNet [Zhou et al., 2019], ResNet [He et al., 2016], MobileNet [Howard, 2017], and MLFN [Chang et al., 2018]). Comprehensive experiments conducted on the MOT17 [Milan et al., 2016] and MOT20 [Dendorfer et al., 2020] datasets demonstrate that our approach significantly outperforms SOTA attacks up to 11.8 times, revealing the vulnerability of the tracking-by-detection framework to BankTweak.

Our contributions are as follows.

• We reveal that increasing the Mahalanobis distance threshold in MOT systems, effectively counteracts

SOTA attacks with minimal accuracy loss.

• We propose BankTweak, a novel adversarial attack characterized by efficiency and robustness, with benefits of practicality and generality.
• We demonstrate BankTweak's applicability by deploying it to multiple combinations of MOT trackers with detectors, achieving superior performance over existing attacks in extensive public dataset experiments.

2 RelatedWork

Multi-object tracking (MOT) aims to construct object motion trajectories across frame sequences [Luo et al., 2021]. Most MOT methods utilize the tracking-by-detection paradigm, featuring online (real-time) and offline (post-refinement) approaches [Zhang et al., 2022; Zhou et al., 2020; Dai et al., 2021]. Detectors identify objects, while trackers associate them using motion (e.g., Kalman filter [Kalman, 1960]) and appearance cues [Zhang et al., 2021]. Transformer-based methods [Meinhardt et al., 2022; Sun et al., 2020] now integrate detection and association.

Adversarial attacks are studied in detection, tracking, and segmentation [Wang et al., 2021; Jia et al., 2020; Xie et al., 2017], with some real-world demonstrations [Xu et al., 2020]. Attacks on single-object tracking often target accuracy, and detection attacks cause missed/false detections. However, MOT's complexity poses challenges for these methods. Specific MOT attacks include targeting the Kalman filter [Jia et al., 2020] or inducing ID switches via detection failures, as with the F&F attack [Zhou et al., 2023].

3 Method

3.1 Attack Formulation

We consider tracking-by-detection MOT systems, consisting of detection and association phases, discussed in Sec. 1. BankTweak operates under the assumption of a white box attack, with the attacker knowing the detector and feature extractor models for the iterative execution of detection and feature extraction across attack frames. BankTweak only needs five frames for an attack without any false alarms (addressing stealth), and does not necessitate motion prediction of objects (addressing generality). A common attack scenario of BankTweak can be a man-in-the-middle attack, where input packets are intercepted via DNS spoofing, perturbed, and then re-injected into a server-based CCTV system.

Consider an input video comprised of N sequential RGB frames I ∈ RW×H×3 , represented as V = {I1, I2, · · · , IN}. We target a sequence of five consecutive frames starting from the (t+1)-th frame (for 1≤t) for our attack, denoted by S = {It+1, It+2, It+3, It+4, It+5}. Let ˜ It be a frame created by adding a perturbation δ to It. By incorporating perturbations into every frame in S, we generate ˜S = {˜ It+1, ˜ It+2, ˜ It+3, ˜ It+4, ˜ It+5} (for t+5<N). Substituting S in V with ˜S yields ˜V = {I1, I2, · · · , It, ˜ It+1, ˜ It+2, · · · , ˜ It+5, It+6, It+7 · · · , IN}.

For the given target input frame I, the detector D(·|θD) parameterized by θD, feature extractor E(·, ·|θE) parameterized

Algorithm 1 BankTweak attack

Input: target frame sequence S, object detector D(·), feature extractor E(·, ·) Output: perturbed frame sequence ˜S

• 1: ˜S = [ ]
• 2: for I from It+1 to It+5 in S do
• 3: F∗ = E(D(I), I) /* get targeted feature set and loss function (Sec. 3.2) */
• 4: F,L←- get targeted features(F∗ ) /* solve perturbation with Eqs. (1) and (2) */
• 5: ˜ I ←- solve perturbation(F, L, I, D(·), E(·, ·))
• 6: ˜S.append(˜ I)
• 7: end for
• 8: return ˜S

by θE, and target features F, BankTweak finds perturbation δ formulated by

where D(·|θD) processes an input frame I to identify the detected object set O and E(·, ·|θE) extracts feature set F∗ from O. BankTweak uses PGD to iteratively derive a perturbation δ that minimizes L under an ℓ∞-norm constrain (L will be further detailed in Sec. 3.3), which is

where α and ϵ represent the amount of change per pixel and the maximum change allowed, respectively, while ∇ and sgn(·) are functions for performing the gradient operation and extracting the sign of the gradient, respectively. BankTweak initializes the first perturbation δ to zero and iterates R times to compute the final δ. During these iterations, δ must adhere to an ℓ∞-norm constraint, ensuring the perturbed frame ˜ I remains within the [0, 1] range.

Alg. 1 outlines the attack process of BankTweak. It takes as input the target frame sequence S, object detector D(·), and feature extractor E(·, ·), producing the perturbed frame sequence ˜S as output. For each input frame I, BankTweak performs the detection to obtain the object set O and then conducts feature extraction based on O to extract the feature set F∗ (Line 3). Subsequently, it determines the designated F and L for each attack frame based on F∗ (Line 4). Utilizing the derived F, L, and the models D(·) and E(·, ·), it computes the perturbed frame ˜ I using Eqs. (1) and (2) (Line 5), which is then added to ˜S. The detector D(·) is used for cropping the detected object from the input image after performing detection, and the perturbation is determined through the model E(·, ·) (Line 5). This procedure is repeated for the length of the input frame sequence S, which is five (i.e., from It+1 to It+5), and ultimately returns the perturbed frame sequence ˜S (Line 8).

3.2 BankTweakMechanism

The primary objective of BankTweak is to switch the IDs of target objects A⃝ and B⃝, ensuring these changes remain constant, even after the completion of the attack. This process unfolds in two steps. (i) Initially, BankTweak systematically injects perturbed features into the feature banks of A⃝ and B⃝, without initiating an ID switch. This preparatory action lays the groundwork for the next step. (ii) Subsequently, leveraging the altered feature banks established in (i), BankTweak executes the ID switch for A⃝ and B⃝, effectively achieving the intended consistent ID switch even after the attack. Fig. 2 presents the overall process by which BankTweak induces an ID switch between a pair of objects A⃝ and B⃝. For a clean frame It, features A and B are extracted from objects A⃝ and B⃝, respectively, and are assigned ID 1 and ID 2. These features are then stored in the feature banks of their corresponding objects. Consider A|B as feature A generated from B through an adversarial example mechanism (e.g., PGD [Madry et al., 2017]), which appears as B to humans but is identified as A by the deployed model. BankTweak selects the object pair A⃝ and B⃝ for an ID switch in each frame It, fundamentally choosing A⃝ and B⃝ randomly without awareness of the Mahalanobis distance threshold, thereby satisfying generality.

Step 1: Groundwork. It performs the following for the first three attacked frames:

˜ It+1: Define X and Y as the dummy features that exhibit a significantly large cosine distance from A and B, ensuring they are distinctly different. By definition, X|A and Y |B have a high cosine distance (e.g., 0.9) from A and B, respectively, and are injected into the feature banks of A⃝ and B⃝ through IoU matching; it is assumed that features are only considered for featurebased matching when they have a cosine distance of 0.5 or less (called cosine distance threshold).

˜ It+2: It places B|A into A⃝'s feature bank and Y |B|B into B⃝'s feature bank, leveraging the very low cosine distance between Y |B|B and Y |B (e.g., 0.02 in Fig. 2) once it is inserted into B⃝'s bank in ˜ It+1. Being generated from A, B|A exhibits a relatively low cosine distance (e.g., 0.07 in Fig. 2).

˜ It+3: It places A|B into B⃝'s feature bank and X|A|A into A⃝'s feature bank using the similar property in ˜ It+2.

Fig. 3(a) presents our experimental result for two distinct scenarios, each featuring varying converging cosine distances when a source feature is subjected to up to 150 perturbations to derive a specific target feature, as outlined in Eq. (4). For instance, when producing Y |B|B|A (in ˜ It+4), the source feature is A, targeting the feature Y |B|B (in ˜ It+2). Conversely, Y |B|B is derived from B, resulting in a cosine distance of 0.07 between Y |B|B|A and Y |B|B due to the disparity in their source features. On the other hand, for the production of Y |B|B (in ˜ It+2), B acts as the source feature with Y |B (in ˜ It+1) as the target. Here, Y |B, created from the same source B, leads to a minimal cosine distance of 0.02 between Y |B|B and Y |B. It might seem straightforward to induce an ID switch by injecting B|A and A|B into the feature banks of A⃝ and B⃝ in Step 1. However, Fig. 3(b) illustrates that because the feature banks of A⃝ and B⃝ already include A and B, any ID switch in ˜ It+1 reverts to the original IDs by ˜ It+2 post-attack.

Step 2: ID Switch. This step involves the following for the next two frames:

˜ It+4: It places Y |B|B|A into A⃝'s feature bank without creating any perturbation for B⃝. B in ˜ It+4 demonstrates a significantly low cosine distance (i.e., 0.02) to B in It, whereas Y |B|B|A exhibits a high cosine distance (i.e., 0.9) with the features in A⃝'s bank. Given the cosine distances of 0.07 between Y |B|B|A and Y |B|B, and 0.07 between B and B|A, the Hungarian algorithm [Kuhn, 1955] allocates IDs based on the lower average cosine distance, prompting an ID switch.

˜ It+5: It places X|A|A|B into B⃝'s feature bank, and similarly, no perturbation is created for A⃝. Similar reasoning to ˜ It+4 causes an ID switch for ˜ It+5.

As a result, from It+6 onward, A in A⃝ matches with A having ID 2 in ˜ It+5 (rather than A with ID 1 in It), and B in B⃝ matches with B having ID 1 in ˜ It+4 (rather than B with ID 2 in It), thus continuous ID switches occur without further attacks. One might assume that directly injecting A and B into the feature banks of A⃝ and B⃝ for ˜ It+4 in Step 2 is a straightforward approach to trigger an ID switch. However, as shown in Fig. 3(c), such an action does not lead to an ID switch due to the pre-existing A and B in the respective feature banks of A⃝ and B⃝. To this end, BankTweak employs a meticulous strategy that exploits the vulnerability (i.e., ID allocation on lower average cosine distance) of the Hungarian algorithm in Step 2, based on the groundwork conducted in Step 1.

3.3 Solving Perturbations

BankTweak employs cosine distance to evaluate the similarity between the features of two objects, facilitating the creation of the target feature set F from an initial feature set F∗ , which is derived by

where A and B are feature vectors of two distinct objects, each in R1×512 . Eq. (3) produces values within the [0, 2] range, with lower values denoting higher similarity and higher values indicating greater dissimilarity between the features of two objects.

For a frame I, which includes multiple objects, we define the extracted feature set as F∗ and its target feature set as F. For each feature F ∗ i ∈ F∗ , Fi ∈ F represents its corresponding target feature. BankTweak computes the loss for each feature set F∗ , aggregates these losses, and applies the perturbation collectively. This process employs a specific loss function formulated as

For each feature F ∗ i ∈ F∗ and its target feature Fi ∈ F, the loss Ls signifies that a lower value increases the similarity between F ∗ i and Fi. Conversely, a higher value of Ld decreases the similarity between F ∗ i and Fi. For instance, the goal for ˜ It+1 is to generate X|A and Y |B, thus the target feature set F = {F1 = A, F2 = B}, and X|A and Y |B are created to have the maximum possible cosine distance from A and B, respectively, using Eq. (5). On the other hand, for ˜ It+2, aiming to generate B|A and Y |B|B, the target feature set F = {F1 = B, F2 = Y |B}, and B|A and Y |B|B are produced to be as close as possible to A and B, respectively, using Eq. (4). The feature sets F∗ , target feature set F, and the loss function for each attack frame are determined as follows.

4 Evaluation

4.1 Experiment Setting

Metrics. We compare the performance of the considered approaches regarding efficiency, robustness, and stealth. BankTweak inherently ensures generality as it does not require any information about the prediction model. For efficiency, we use standard MOT accuracy metrics such as IDF1 [Ristani et al., 2016] and HOTA [Luiten et al., 2021]. IDF1 is defined as IDF1 = 2 × TP 2×TP+FP+FN , where TP, FP, and FN are true positives, false positives, and false negatives. HOTA is given by HOTA = √DetA · AssA, with DetA = TP TP+FN+FP and AssA = 1 - IDsw GTtrack , where IDsw is the number of ID switches and GTtrack is the total number of tracklets in the ground truth. These metrics exclude attack frames for accuracy. For robustness, we measure accuracy by varying the Mahalanobis distance threshold. For stealth, we measure ρDet and ρID to evaluate the system's ability to reduce new objects (mainly false alarms) during attack frames. ρDet is the ratio of the average detection increase per attack frame to the ground truth GTt, while ρID quantifies the increase in ID counts.

Dataset. Experiments are conducted using the MOT17 and MOT20 pedestrian tracking datasets. Each dataset is split into two halves: one for training the considered detection model and the other for evaluation. The MOT17 and MOT20 datasets are further divided into 30-frame segments, yielding 83 and 148 segments, respectively. Experiments target each segment's (15-19)-th frames for attacks to accumulate features in the objects' feature banks over five frames, ensuring accurate evaluation of BankTweak's potential effects in practical tracking applications.

Implementation Details. To demonstrate the applicability, BankTweak is applied to three prominent multi-object trackers (DeepSORT, StrongSORT, and MOTDT denoted by DS, SS, and MD, respectively) with one-stage (YOLOX), two-stage (Faster-RCNN), anchor-free (FoveaBox) and transformer (DETR) detectors. We consider OSNet, ResNet, MobileNet, and MLFN as feature extractors. The feature-based matching threshold is λapp = 0.2, and IoU-based matching threshold is λIoU = 0.7. Attack parameters are ϵ = 4/255 and α = 1/255. In BankTweak, dissimilarity loss Ld succeeds when feature similarity exceeds λapp = 0.2, and similarity loss Ls requires cosine distance to be less than λapp = 0.2. Empirically, iterations for Ld are set to Rd = 10, and for Ls , Rs = 150.

4.2 Comparison to ExistingMethods

We evaluate our approach against four existing attacks: the FN attack, Daedalus, Hijacking, and F&F attack.

Efficiency and Robustness. Tab. 1 shows attack performance under the maximum Mahalanobis distance threshold, counteracting Hijacking and F&F attack with minimal accuracy drop (see Figs. 4(a)-(c)) for YOLOX and OSNet. The experimental results for combinations with other detectors and feature extractors are provided in the supplementary material. Tab. 1 demonstrates that BankTweak significantly decreases the IDF1 and HOTA score across all trackers. For instance, BankTweak reduces the IDF1 score by 13.57 for SS on MOT17, compared to 1.15 for F&F, achieving up to an 11.8-fold (13.57/1.15) improvement. It also significantly increases IDsw (e.g., 1847% for MD on MOT20) while decreasing AssA, alongside a reduction in the detection metric DetA. As demonstrated by Tab. 1, unlike FN attack and Daedalus, BankTweak significantly affects performance by altering object IDs during attacks, with these changes persisting post-attack and resulting in a noticeable decline in IDF1 scores. Also, Hijacking and F&F attacks shift an object's position before the attack, creating a significant Mahalanobis distance from its original location after the attack, but increasing the Mahalanobis distance threshold (expanding the matching boundary) can neutralize the attack. BankTweak thrives when the matching boundary is expanded, ensuring the targeted object pair falls within this expanded boundary, enhancing performance.

Stealth. BankTweak induces ID switches by altering the feature banks of individual objects, effectively reducing accuracy without generating false alarms. Tab. 1 illustrates that BankTweak keeps the object count stable during an attack, as evidenced by the ρDet and ρID metrics, closely aligning with the Clean scenario. For instance, detected object values on DS for Clean and BankTweak closely match (ρDet at 0.93 vs 0.92), similar to the tracked object values (ρID remains at 0.82 for both). In contrast, Daedalus shows a marked effect on these metrics, with ρDet jumping from 0.93 to 7.18 and ρID for tracked objects rising from 0.82 to 2.01, demonstrating a significant difference.

Applicability. In Tab. 1, against DS on MOT17, the Daedalus and F&F attacks reduce the IDF1 score by 5.3 and 7.75, respectively. In contrast, the reductions against SS are more modest, at 0.73 and 1.15, while for MD, the scores decrease by 2.01 and 2.09. These variations arise from the distinct matching strategies employed by each tracker. DS prioritizes matching newly tracked objects, which can result in previously tracked objects being incorrectly matched with false alarms during an attack. Conversely, SS and MD treat all tracked objects equally, reducing the likelihood of incorrect ID assignments. BankTweak, capable of attacking any tracker that employs a feature bank, operates effectively regardless of a tracker's specific matching procedures.

4.3 Ablation Study

Varying Mahalanobis Distance Threshold. In featurebased matching, trackers check if detected objects are within the tracked objects' matching boundary, set by a threshold λm. The Kalman filter models each tracked object's motion details (e.g., center, width, and height) using a chi-square distribution, represented by the probability density function f(x). The matching boundary is where 95% of position values are concentrated around the distribution's mean within a λm distance. Figs. 4(a)-(c) show IDF1 variations as λm increases (e.g., ×5 indicates λm × 5), noting that a higher λm expands the matching boundary, with "Max" occurring when ∫ λm 0 f(x)dx = 1. Clean and the FN attack experience minimal IDF1 changes with rising thresholds. Conversely, Daedalus and the F&F attack encounter an IDF1 increase and a notable decline in attack success as the threshold grows. BankTweak shows a high enhancement of the attack's effectiveness at higher thresholds, indicating its reliance on the matching boundary to facilitate ID switches.

Quantity of Allowable False Alarms. To evaluate attack effectiveness against stealth, we limited the number of false positives each attacker could generate. Figs. 4(d)-(f) plot IDF1 against the maximum number of objects for DS, SS, and MD, respectively, with DGT representing the actual object count per attack frame and 2DGT , 3DGT , and 4DGT denoting multiples of this number. The F&F attack typically generates four false positives per targeted object; instead of reducing these numbers, we constrained the targeted objects per frame. Clean and BankTweak do not generate additional objects, hence their IDF1 scores remain unaffected by the object limit. Daedalus and the F&F attack, however, show a notable IDF1 decrease with more false positives, although less significant than with BankTweak.

Impact of Step 2. As detailed in Fig. 3(c), Step 2 is crucial for BankTweak. Tab. 2 shows that ID switches occur less without Step 2, resulting in a smaller IDF1 reduction. For DS, omitting Step 2 results in a minor IDF1 drop (79.78 to 77.52), while including it reduces IDF1 by 21.77 points (79.78 to 58.01), underscoring Step 2's importance.

Number of Iterations. Tab. 3 shows the effect of varying BankTweak's Rs on IDF1. Increasing Rs leads to a greater reduction in IDF1, indicating that more iterations significantly enhance BankTweak's attack efficiency. Tab. 3 shows that increasing ϵ (in Eqs. (1) and (2)) dramatically reduces Rs needed to generate perturbations (which also reduces latency) while maintaining attack performance. For instance, with ϵ = 4/255 (default), accuracy drops from 77.4 to 63.3. With ϵ = 16/255, accuracy drops to 67.6 and 59.4 for Rs = 10 and Rs = 20, respectively.

5 Conclusion

This paper proposes BankTweak, a novel adversarial attack on multi-object trackers, targeting feature extractors during association to induce persistent ID switches. Our method remains robust under heightened Mahalanobis distance thresholds and does not depend on false alarms or motion prediction for effectiveness. We demonstrate the versatility of BankTweak across various combinations of detectors, feature extractors, and trackers. Comprehensive experiments on public datasets validate BankTweak's effectiveness and explore a diverse range of attack tactics.

Limitation. While there has been significant research on black box attacks in classification problems [Mi et al., 2023; Liang et al., 2022], there has been little progress in MOT attacks due to its inherent challenge [Ding et al., 2024]. Consequently, an MOT attack based on black-box methodologies has yet to be proposed. Although BankTweak is also a white-box attack, as illustrated in Fig. 5(c), a transfer-based black-box attack on BankTweak can be feasible when object pairs (A and B) for an ID switch have similar features. This is because generating similar features for A from B (or vice versa) is easier, and creating untargeted features (e.g., X and Y) is simpler than targeting generation. Figs. 5(a) and (b) show that, while less effective than a white-box attack, this approach meets the necessary thresholds for BankTweak in a transfer-based attack. Thus, a black-box attack will work if it finds object pairs with similar features to those of the deployed detector. Research on attacking MOT, targeting multiple objects simultaneously, is still in its early stages. Notable studies include the F&F attack and Hijacking, both white-box attacks, while BankTweak significantly addresses their limitations.

Acknowledgments

This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (RS-2025-00520023, RS-2024-00438248, RS-2023-00250742). This research was supported by the MSIT(Ministry of Science and ICT), Korea under the ITRC(Information Technology Research Center) support program(IITP-2025-RS-2023-00259061) supervised by the IITP(Institute for Information & Communications Technology Planning & Evaluation)

Contribution Statement

Woojin Shin and Donghwa Kang are co-first authors and contributed equally. Jinkyu Lee and Hyeongboo Baek are the corresponding authors.