Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection

Jul 16, 2026

Upload by Aria

Gimbal-stabilized visual tracking is essential for autonomous platforms such as UAVs, enabling persistent object following with high precision. Prior work shows acoustics can disturb gimbal internals, yet real-world effects on application-level tracking remain insufficiently studied, especially under object-motion uncertainty and runtime latency. Banshee introduces a physically realizable acoustic injection attack that induces target switching in UAV visual trackers by driving directionally biased camera drift, breaking inter-frame target associations. It achieves high success rates in simulation across multiple commercial gimbals and trackers and shows strong black-box attack effectiveness in varied real-world scenarios, exposing a practical acoustics-to-vision cross-domain vulnerability.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages20

Reading Time50 min

Abstract

Introduction

Background: UAV target following and gimbal stabilization

Prior acoustic influence on inertial feedback

Banshee overview and attack rationale

Attack scenarios: target switch and target loss

Two-stage attack design: offline profiling and online planning-execution

Banshee: Target Switch Attacks on Gimbal-Stabilized Visual Tracking Systems via Acoustic Injection Jiarui Li University of Michigan [jiaruili@umich.edu](jiaruili@umich.edu) Joseph Brewington University of Michigan [brewing@umich.edu](brewing@umich.edu) Qingzhao Zhang∗ The University of Arizona [qzzhang@arizona.edu](qzzhang@arizona.edu) Z. Morley Mao∗ University of Michigan [zmao@umich.edu](zmao@umich.edu) arXiv :2607 .09930v1 [ cs .CV] 10 Jul 2026 Abstract—Gimbal-stabilized visual tracking is critical for modern autonomous systems such as Unmanned Aerial Vehicles (UAVs). While prior work shows acoustic signals can disturb gimbal internals, the impact of such attacks on real-world applications like UAV tracking and following remains underexplored. Existing demonstrations largely overlook practical challenges for real-world attacks, such as object-motion uncertainty and runtime latency. To bridge this gap, we present Banshee1 , the first physically realizable attack that induces target switching in UAV visual tracking systems by exploiting acoustic vulnerabilities in gimbal-camera systems. Banshee generates carefully crafted acoustic waveforms that induce optimized adversarial gimbal oscillations, causing directionally biased camera-view drifts that break inter-frame target associations. Consequently, the onboard tracker is driven to switch from the original target to an attacker-selected object with high probability, with occasional target loss. Banshee achieves a 93.6% success rate in simulation across two commercial gimbal systems and five trackers. Real-world benchtop and in-flight black-box attacks against a commercial drone across varied scenarios show an overall 95.5% attack success rate. Our results reveal a practical cross-domain vulnerability between acoustics and vision, highlighting the need for robust designs of gimbal systems and applications. Our code is available at: [https://github.com/U1ltra/Banshee](https://github.com/U1ltra/Banshee). 1. Introduction Gimbal-stabilized visual tracking is a core capability of modern camera systems, enabling persistent, high-precision object following in dynamic scenes. As a prominent example, commercial Unmanned Aerial Vehicles (UAVs) widely deploy target following, which typically pairs a multi-axis gimbal with an onboard camera, combined with object tracking algorithms running in software, to enable active * . These authors are corresponding authors. 1. Our attack is named after the banshee, a mythical spirit whose scream causes or signals harm, reflecting the attack’s acoustic nature. © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses. This is the accepted version of the paper published in 2026 IEEE Symposium on Security and Privacy. The final published version is available at IEEE Xplore. DOI: 10. 1109/SP63933 .2026.00129. UAV w/ Target Following Acoustic Signal True Tracking False Tracking Figure 1: Illustration of Banshee in UAV target following. Crafted acoustic signals induce the UAV’s visual tracker to switch to an incorrect target or lose track. tracking and following on a selected mobile target [1], [2],[3], [4], [5], [6] . Gimbal-stabilized visual tracking enables applications such as autonomous filming, surveillance, and infrastructure inspection, but also creates a single point of failure: compromising this pipeline can lead to severe consequences, including flight hazards, loss of vehicle control, and tracking of false targets [7], [8], [9], [10], [11] . Gimbal systems commonly rely on real-time inertial measurement unit (IMU) feedback to mechanically stabilize onboard cameras during rapid motion [12], [13] . Prior research has shown that carefully crafted acoustic patterns, delivered via speakers, ultrasonic transducers, or even laser systems, can manipulate IMU readings and, in turn, disrupt gimbal stabilization [14], [15], [16], [17], [18] . While these studie

FAQs

What is Banshee, and what threat does it target?

Banshee is a physically realizable acoustic injection attack that targets UAV gimbal-stabilized visual tracking by inducing target switching (and sometimes target loss) in the onboard tracker.

How does Banshee work at a high level?

It crafts acoustic waveforms to cause directionally biased gimbal-camera oscillations and drift, which disrupts the tracker’s inter-frame association and increases the chance of switching to an attacker-selected object.

How are the attack signals generated and deployed?

The attacker first performs offline gimbal profiling to learn a mapping from acoustic signals to induced gimbal motion. During the online attack, a surrogate tracking loop and a planning-execution loop jointly optimize a sequence of acoustic signals under physical and algorithmic constraints, then inject them via a speaker or piezoelectric transducers.

Jul 16, 2026

Upload by Aria