Abstract
Gimbal-stabilized visual tracking is critical for modern autonomous systems such as Unmanned Aerial Vehicles (UAVs). While prior work shows acoustic signals can disturb gimbal internals, the impact of such attacks on real-world applications like UAV tracking and following remains underexplored. Existing demonstrations largely overlook practical challenges for real-world attacks, such as object-motion uncertainty and runtime latency.
To bridge this gap, we present Banshee, the first physically realizable attack that induces target switching in UAV visual tracking systems by exploiting acoustic vulnerabilities in gimbal-camera systems. Banshee generates carefully crafted acoustic waveforms that induce optimized adversarial gimbal oscillations, causing directionally biased camera-view drifts that break inter-frame target associations. Consequently, the onboard tracker is driven to switch from the original target to an attacker-selected object with high probability, with occasional target loss.
Banshee achieves a 93.6% success rate in simulation across two commercial gimbal systems and five trackers. Real-world benchtop and in-flight black-box attacks against a commercial drone across varied scenarios show an overall 95.5% attack success rate. Our results reveal a practical cross-domain vulnerability between acoustics and vision, highlighting the need for robust designs of gimbal systems and applications.
Key Contributions
First End-to-End Acoustic Tracking Attack
We design Banshee, the first end-to-end attack using acoustic injection to compromise UAV visual tracking, bridging gimbal-level hardware vulnerabilities to application-level impacts.
Systematic Gimbal Motion Modeling
We propose the first systematic method to empirically model gimbal motion under acoustic injection. Using offline profiling and online phase modulation, the attacker can induce consistent, directionally biased gimbal angular offsets in real time.
High-Fidelity Simulation Evaluation
We extensively evaluate Banshee in high-fidelity simulation (Gazebo + PX4-Autopilot) with realistic simulation of gimbal vulnerability, demonstrating effectiveness across 5 trackers, 2 drone models, and 4 environments.
Real-World Physical Validation
We demonstrate real-world online attacks on a commercial drone achieving 95.5% success, including in-flight black-box target switch attacks, validating practical feasibility of the proposed attack.
System Overview
Banshee operates in two stages: offline gimbal profiling followed by an online attack.
Banshee Overview. Banshee consists of an offline gimbal profiling procedure and an online optimized attack.
Offline Gimbal Profiling
The attacker uses an identical gimbal device to empirically learn a black-box mapping from acoustic signals to induced gimbal motion — the Gimbal Acoustic Response Model. This involves:
- Frequency sweep: identify resonant frequencies most effective at driving gimbal oscillations
- Amplitude sweep: learn the linear relationship between injected signal amplitude and induced gimbal motion amplitude
- Phase modulation: enable real-time directional control of gimbal motion
Online Attack
The attacker runs two parallel loops to corrupt tracking in real time:
- Surrogate Tracking Loop: maintains a black-box replica of the UAV's onboard tracker using external 3D object detection and estimated gimbal camera view
- Planning-Execution Loop: optimizes acoustic waveforms to maximize the probability of target switch, then immediately injects them via speaker or piezoelectric transducer
How the Attack Works
Adversarial Acoustic Gimbal Biasing
MEMS gyroscopes in gimbals measure angular velocity via the Coriolis force on a vibrating proof mass. When an external acoustic signal matches the gyroscope's resonant frequency fn, it induces large oscillations that are digitized and aliased to a low frequency — appearing as false motion to the stabilization system.
The stabilization controller then applies incorrect servo compensation, causing a consistent directional drift along the target gimbal axis. Banshee modulates the signal phase in real time to control bias direction despite unknown sampling phase — creating a reliable pipeline for adversarial camera-view manipulation.
Exploiting Visual Tracker Vulnerabilities
Banshee exploits two fundamental weaknesses shared by all modern trackers:
- Motion-based trackers (e.g., SORT, UCMC): Assume small inter-frame displacement. Abrupt gimbal-induced camera shifts create large apparent jumps, breaking object association.
- Appearance-aware trackers (e.g., SiamRPN, KCF): Search within a spatial window around the predicted location. Abrupt gimbal displacement moves the true target outside the search region, reducing matching reliability.
Evaluation
Extensive evaluation across simulation and physical experiments validates Banshee's effectiveness.
Simulation Results
Banshee attack success rates. Banshee achieves high ASR in our simulated environment, successfully switching or disabling tracking on a UAV using two different profiles obtained through characterization of two commercial UAVs.
Ablation of attack factors and components. Results highlight the efficacy of our designed attack components and the robustness of our attack under varying attack conditions.
Attack Success Rates (Simulation)
Switch/Disable success rates across 5 trackers on 2 commercial drone gimbal systems (108 trials per configuration). In Normal, we simulate UAV object tracking without the presence of attack. In Noisy, we simulate UAV object tracking under strong and gusty wind supported by the realistic Gazebo WindEffects plugin. In HighEndDrone and MidEndDrone, we simulate attacks with corresponding acoustic vulnerabilities.
| Tracker | Normal (Switch/Disable) | Noisy (Switch/Disable) | HighEndDrone (Switch/Disable) | MidEndDrone (Switch/Disable) |
|---|---|---|---|---|
| SORT | 11.1% / 24% | 0% / 75% | 59.3% / 94.4% | 55.6% / 96.3% |
| UCMC | 0% / 0% | 6% / 6% | 68.5% / 92.6% | 61.1% / 87.0% |
| SiamRPN | 0% / 0% | 0% / 0% | 83.3% / 88.9% | 90.2% / 93.1% |
| DaSiam | 0% / 0% | 0% / 0% | 92.6% / 98.1% | 97.2% / 100% |
| KCF | 0% / 0% | 17.6% / 17.6% | 70.3% / 94.4% | 72.2% / 87.5% |
Real-World Experiments
Testbed for real-world experiments. Our benchtop experiments include both direct-contact (left, using a PZT disc) and remote attacks (center, using a speaker), and our flight experiments feature a drone-mounted payload (right).
Results from real-world experiments. We achieve high success rates in our benchtop experiments, as shown in the figure, and a 60%/80% tracking switch/disable rate in flight testing.
Real-world results: Real-world benchtop and in-flight black-box attacks against commercial drones across varied scenarios achieve an overall 95.5% attack success rate. Physical experiments validate the online biasing methodology, confirming that consistent, directionally controlled gimbal rotation is achievable in practice with only a small degree of error.
BibTeX
@inproceedings{li2026banshee,
title = {Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection},
author = {Li, Jiarui and Brewington, Joseph and Zhang, Qingzhao and Mao, Z. Morley},
booktitle = {IEEE Symposium on Security and Privacy (S\&P)},
year = {2026}
}