A targeted attack method for YOLOv8

Abstract

This invention discloses a targeted adversarial attack method against YOLOv8, belonging to the field of adversarial attack technology. The invention includes the following steps: analyzing the architecture, loss function, and input / output data information of the YOLOv8 object detection model to clarify the output result of the original clean image after model prediction; based on the model architecture, loss function, and input / output data information, constructing three targeted attack targets: object disappearance attack, redundant object attack, and misclassification attack, and designing a corresponding attack loss function for each target; by minimizing the attack loss function, iteratively updating the input image to achieve the three targeted attacks on the YOLOv8 model, generating adversarial sample images in batches; and inputting the adversarial sample images into the YOLOv8 model to obtain the detection result image after the attack. This invention can achieve the three targeted attack results of object disappearance, redundant objects, and misclassification.

Description

Technical Field

[0001] This invention relates to the field of adversarial attack technology, and in particular to a targeted adversarial attack method for YOLOv8. Background Technology

[0002] With the rapid development of deep learning technology, object detection, as one of the core tasks in the field of computer vision, aims to provide efficient visual perception capabilities for systems by locating and identifying targets in images. It has been widely applied in safety-critical scenarios such as unmanned equipment, autonomous driving, and intelligent monitoring. However, deep learning models have been proven vulnerable to adversarial attacks—that is, by adding subtle perturbations to input samples, the model can produce incorrect predictions. Such malicious attacks severely damage the robustness and reliability of object detection models, causing security risks and catastrophic consequences. The core objective of adversarial attacks is to superimpose a carefully calculated, almost imperceptible, tiny noise (i.e., "adversarial perturbation") onto the original image, thereby inducing the detection model to output incorrect predictions. Generating adversarial noise directly on the input digital image is straightforward and easy to implement, making it the most direct and widespread security threat faced by object detection models.

[0003] Currently, adversarial attack methods mainly target image classification models, with relatively little research on object detection models. Based on the destructive effects intended by the attacker, adversarial attacks can be divided into targeted attacks and non-targeted attacks. Targeted attacks aim to induce the model to produce pre-defined erroneous outputs through specific optimization strategies, such as target disappearance, false target appearance, classification errors, or detection delays. Non-targeted attacks, on the other hand, do not specify a particular error type, and their output is a random combination of these various errors.

[0004] With the widespread application of YOLOv8 as a next-generation benchmark model in the field of object detection, it plays an increasingly important role in safety-critical scenarios such as autonomous driving, security monitoring, and industrial quality inspection. However, existing adversarial attack research mainly focuses on image classification models, and attack methods targeting this advanced detector, YOLOv8, are still in their infancy, making it difficult to comprehensively assess its robustness risks in practical deployments. Specifically, existing technologies have the following shortcomings: First, existing research on the YOLO series has mostly focused on earlier versions such as YOLOv3 and YOLOv4, lacking targeted analysis of the innovative architecture introduced by YOLOv8, such as anchorless box detection, decoupling head, and C2f module. This fails to fully reveal the vulnerability patterns brought about by the new architecture, resulting in unsatisfactory attack effects against YOLOv8.

[0005] Therefore, how to provide a targeted adversarial attack method against YOLOv8 to overcome the difficulties of existing technologies is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of this, the present invention provides a targeted adversarial attack method for YOLOv8, which can achieve three targeted attack results: target disappearance, redundant objects, and classification errors.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: A targeted adversarial attack method against YOLOv8 includes the following steps: This paper analyzes the architecture, loss function, and input / output data of the YOLOv8 object detection model to clarify the output results of the original clean image after prediction by the model. Based on the model architecture, loss function, and input / output data, three targeted attack targets are constructed: object disappearance attack, redundant object attack, and misclassification attack. A corresponding attack loss function is designed for each target. By minimizing the attack loss function and iteratively updating the input image, three targeted attacks on the YOLOv8 model are achieved, generating adversarial example images in batches. The adversarial sample image is input into the YOLOv8 model to obtain the detection result image after the attack.

[0008] Optionally, the overall training objective of the YOLOv8 object detection model is formalized as a multi-task optimization problem consisting of bounding box regression loss and classification loss, with the loss function defined as: , in, The bounding box regression loss is represented by an IoU-based metric and is used to constrain the consistency between the predicted and ground truth bounding boxes in terms of location, scale, and shape. The target category classification loss is represented by the binary cross-entropy form under Sigmoid activation, which performs multi-class prediction for each positive sample position. and These are the weighting coefficients for each loss term.

[0009] Optionally, the object disappearance attack strategy involves normalizing the probability output by the model. Once the value of each item is reduced below the probability threshold, the attack loss function is designed as follows: , in, For the first The normalized predicted probabilities for each category are: Categories For the minimum numerically stable term, k takes integer values ​​in the range [1,3]. Finally, the average loss of all detection heads is taken to obtain the overall attack loss: , Where K is the number of detectors in YOLOv8, and its value is 3.

[0010] Optionally, a redundancy attack approach involves normalizing the probability output by the model. The value of each item is increased to above the probability threshold, and the attack loss function is designed as the negative of the object disappearance attack: , The overall attack loss is obtained by averaging the losses of all detection heads: .

[0011] Optionally, the misclassification attack involves setting the true label corresponding to the highest probability in the original detection results to negative infinity, while retaining the probability values ​​of other categories, constructing a label vector targeting the incorrect category, and attacking the loss function. The loss function used in the YOLOv8 detection network is... , in, The expression for the modified target tag is: , , .

[0012] Optionally, the image is iteratively updated using the signed gradient method, specifically by minimizing the attack loss function along the positive gradient direction while simultaneously restricting the perturbation norm. The entire optimization process can be represented as follows: ; in, yes , as well as Any one of them, , as well as These are the optimal attack samples for the iterative object disappearance attack, the redundant object attack, and the misclassification attack, respectively. for , as well as Any one of them, For input adversarial sample images The prediction output in YOLOv8.

[0013] Optional, for the input adversarial example image First, calculate the gradient of the attack loss with respect to the input: , Calculate the gradient direction using the sign function and update the input: , in, This is an updated adversarial example. For symbolic functions, For step size parameters, This is a projection operator used to remap updated samples to a perturbation set invisible to the human eye, thereby reasonably constraining the strength of the perturbation update. This is the disturbance amplitude parameter.

[0014] As can be seen from the above technical solution, compared with the prior art, this invention provides a targeted adversarial attack method for YOLOv8, which has the following beneficial effects: 1) This invention solves the problems of gradient failure and low attack success rate of existing methods on the YOLOv8 model, efficiently adapts to the YOLOv8 model architecture, and achieves deep adaptation to the characteristics of the YOLOv8 architecture and efficient attack; 2) This invention solves the problems of existing attack methods having single effects and being unable to simulate complex attack intentions by designing differentiated loss functions for different attack targets, and achieves precise control of three types of attack effects: object disappearance, fake objects, and classification errors. Different types of attacks can be implemented on different targets in the same image. This differentiated loss function design and attack effect control mechanism enable this invention to comprehensively simulate complex attack scenarios in the real world, providing diverse testing tools for the robustness evaluation of YOLOv8. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 This is a flowchart of a targeted adversarial attack method against YOLOv8 disclosed in this invention; Figure 2 This is a schematic diagram illustrating the visual detection effect of the object disappearance attack disclosed in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the visual detection effect of redundant object attacks disclosed in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the visualization detection effect of classification error attacks disclosed in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Reference Figure 1 As shown, this invention discloses a targeted adversarial attack method against YOLOv8, comprising the following steps: This paper analyzes the architecture, loss function, and input / output data of the YOLOv8 object detection model to clarify the output results of the original clean image after prediction by the model. Based on the model architecture, loss function, and input / output data, three targeted attack targets are constructed: object disappearance attack, redundant object attack, and misclassification attack. A corresponding attack loss function is designed for each target. Specifically, the object disappearance attack results in the output detection result that does not contain any object bounding box, the redundant object attack results in the output detection result that contains redundant object bounding boxes that do not belong to the original target, and the misclassification attack results in the output detection result that the object classification label is incorrect. By minimizing the attack loss function and iteratively updating the input image, three targeted attacks on the YOLOv8 model are achieved, generating adversarial example images in batches. The adversarial sample image is input into the YOLOv8 model to obtain the detection result image after the attack.

[0019] Furthermore, the original input image is denoted as... The YOLOv8 model is run to retrieve the detection and prediction results of the input image. For each predicted target, the result can be represented as bounding box coordinates and the corresponding class probability vector:

[0020] in, To predict the coordinates of the center point of the bounding box, These are the width and height of the bounding box, respectively. This represents the normalized probability value for each category.

[0021] Furthermore, the YOLOv8 object detection model adopts an end-to-end one-stage detection paradigm and performs object modeling based on an anchorless mechanism. Unlike earlier YOLO models, YOLOv8 no longer explicitly introduces a separate object confidence prediction branch. Instead, it implicitly characterizes object existence through the outcome of the classification branch and the positive / negative sample allocation strategy. Therefore, the overall training objective of the YOLOv8 object detection model is formalized as a multi-task optimization problem consisting of bounding box regression loss and classification loss. The loss function is defined as: , in, and These are the weighting coefficients for each loss term. The bounding box regression loss is represented by an IoU-based metric (such as CIoU), used to constrain the consistency between the predicted and ground truth boxes in terms of location, scale, and shape. Its expression can be written as: , in, and They represent the first One predicted bounding box and one ground truth bounding box. Indicates the distance from the center point. The minimum diagonal length of the bounding box. and For aspect ratio consistency constraints, N is the number of prediction boxes; The target class classification loss, expressed as a binary cross-entropy form under Sigmoid activation, performs multi-class prediction for each positive sample position, and is defined as follows:

[0022] in, The total number of categories, For real category labels, This represents the class probabilities predicted by the model.

[0023] Furthermore, when performing digital domain adversarial attacks on YOLOv8, the bounding box regression loss and classification loss are coupled during gradient backpropagation because the model training employs an end-to-end multi-task loss function. This means that even if the attack perturbs a specific loss term, the resulting gradient will still affect the parameter update direction of the entire network. Therefore, if the original training loss is used directly for the attack, the gradient information will be mixed between the regression and classification tasks, potentially leading to various issues such as missed detections, false detections, and misclassifications, often resulting in undirected attacks. To improve attack targeting, simplify the attack process, and increase attack efficiency, this project specifically designed the attack loss function, simplifying it to construct a negative logarithmic probability loss only for the classification probability branch, enabling various targeted attacks.

[0024] Furthermore, the idea behind the object disappearance attack is to normalize the probability output by the model. Once the value of each item is reduced below the probability threshold, the attack loss function is designed as follows: , in, For the first The normalized predicted probabilities for each category are: Categories For the minimum numerically stable term, k takes integer values ​​in the range [1,3]. Finally, the average loss of all detection heads is taken to obtain the overall attack loss: , Where K is the number of YOLOv8 detectors, with a value of 3. Through this loss function design, the attack process can focus on using gradient information to apply maximum perturbation to the classification branch, avoid interference from bounding box regression gradients, improve the control effect on target disappearance, and at the same time ensure that the generated perturbation remains visually imperceptible.

[0025] The physical significance of the damage caused by the attack is as follows: (1) Reduce the confidence of category prediction: By maximizing the negative log probability, the model's prediction of all categories is no longer certain, thereby weakening its semantic discrimination ability; (2) Push the candidate box to shift towards the "non-target" direction: The perturbation makes the candidate box output by the model more likely to be judged as the background; (3) Achieve target reduction or disappearance effect: In the post-processing stage, since the prediction confidence is lower than the threshold, the originally detectable targets are systematically filtered out, thereby achieving targeted disappearance attack.

[0026] Furthermore, the redundancy attack strategy involves normalizing the probability output by the model. The value of each item is increased to above the probability threshold, and the attack loss function is designed as the negative of the object disappearance attack: , The overall attack loss is obtained by averaging the losses of all detection heads: .

[0027] Furthermore, the misclassification attack involves setting the true label corresponding to the highest probability in the original detection results to negative infinity, while retaining the probability values ​​of other categories. This constructs a label vector targeting the incorrect category, thereby guiding the model to misclassify the originally correctly classified target as a preset incorrect category during the update process. The attack then affects the loss function. The loss function used in the YOLOv8 detection network is... , in, The expression for the modified target tag is: , , .

[0028] Specifically, the purpose of redundant object attacks is to change the target classification label. The attack shifts the target category label by modifying the input. The optimization objective is set as the original detection network loss function, thus causing the model to believe the attacked sample belongs to the wrong category. That is, by minimizing the original network loss, the prediction result is shifted towards the incorrect true value. The optimization objective is: .

[0029] Furthermore, the image is iteratively updated using the signed gradient method. Specifically, this involves minimizing the attack loss function along the positive gradient direction while simultaneously restricting the perturbation norm to ensure that the superimposed perturbation noise remains invisible to humans, thereby improving the stealth of the attack. The entire optimization process can be expressed as follows: ; in, yes , as well as Any one of them, , as well as These are the optimal attack samples for the iterative object disappearance attack, the redundant object attack, and the misclassification attack, respectively. for , as well as Any one of them, For input adversarial sample images The prediction output in YOLOv8.

[0030] Furthermore, for the input adversarial example images First, calculate the gradient of the attack loss with respect to the input: , Since the update of adversarial examples does not care about the gradient magnitude, the gradient direction is calculated using a sign function and the input is updated accordingly: , in, This is an updated adversarial example. For symbolic functions, For step size parameters, This is a projection operator used to remap updated samples to a perturbation set invisible to the human eye, thereby reasonably constraining the strength of the perturbation update. The perturbation amplitude parameter is used. The entire update process involves multiple iterations, and the output is the final adversarial sample after multiple iterations.

[0031] In one specific embodiment, the present invention achieves three targeted attack results: target disappearance, redundant objects, and classification errors, as follows: Figure 2-4As shown, it is not difficult to see that the present invention achieves precise control over the attack effect. That is, the number of detected targets and classification labels can be controlled by adjusting the parameters, and the attack result type, location and category can be precisely manipulated by designing the loss function and iterative strategy. Moreover, this controllability makes the present invention usable for testing the vulnerability performance of YOLOv8 under different attack scenarios and analyzing the inter-layer perturbation propagation mechanism.

[0032] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A targeted adversarial attack method against YOLOv8, characterized in that, Includes the following steps: This paper analyzes the architecture, loss function, and input / output data of the YOLOv8 object detection model to clarify the output results of the original clean image after prediction by the model. Based on the model architecture, loss function, and input / output data, three targeted attack targets are constructed: object disappearance attack, redundant object attack, and misclassification attack. A corresponding attack loss function is designed for each target. By minimizing the attack loss function and iteratively updating the input image, three targeted attacks on the YOLOv8 model are achieved, generating adversarial example images in batches. The adversarial sample image is input into the YOLOv8 model to obtain the detection result image after the attack.

2. The targeted adversarial attack method against YOLOv8 according to claim 1, characterized in that, The overall training objective of the YOLOv8 object detection model can be formalized as a multi-task optimization problem consisting of bounding box regression loss and classification loss. The loss function is defined as: ， in, The bounding box regression loss is represented by an IoU-based metric and is used to constrain the consistency between the predicted and ground truth bounding boxes in terms of location, scale, and shape. The target category classification loss is represented by the binary cross-entropy form under Sigmoid activation, which performs multi-class prediction for each positive sample position. and These are the weighting coefficients for each loss term.

3. The targeted adversarial attack method against YOLOv8 according to claim 1, characterized in that, The idea behind the object disappearance attack is to normalize the probability output of the model. Once the value of each item is reduced below the probability threshold, the attack loss function is designed as follows: ， in, For the first The normalized predicted probabilities for each category are: Categories For the minimum numerically stable term, k takes integer values ​​in the range [1,3]. Finally, the average loss of all detection heads is taken to obtain the overall attack loss: ， Where K is the number of detectors in YOLOv8, and its value is 3.

4. The targeted adversarial attack method against YOLOv8 according to claim 1, characterized in that, The redundancy attack strategy involves normalizing the probability output of the model. The value of each item is increased to above the probability threshold, and the attack loss function is designed as the negative of the object disappearance attack: ， The overall attack loss is obtained by averaging the losses of all detection heads: 。 5. A targeted adversarial attack method against YOLOv8 according to claim 1, characterized in that, The misclassification attack involves setting the true label corresponding to the highest probability in the original detection results to negative infinity, while retaining the probability values ​​of other categories, constructing a label vector targeting the incorrect category, and attacking the loss function. The loss function of the YOLOv8 detection network is used, i.e. ， in, The expression for the modified target tag is: ， ， 。 6. The targeted adversarial attack method against YOLOv8 according to claim 1, characterized in that, The image is iteratively updated using the signed gradient method, specifically by minimizing the attack loss function along the positive gradient direction while simultaneously constraining the perturbation norm. The entire optimization process can be expressed as: ； in, yes , as well as Any one of them, , as well as These are the optimal attack samples for the iterative object disappearance attack, redundant object attack, and misclassification attack, respectively. for , as well as Any one of them, For input adversarial sample images The prediction output in YOLOv8.

7. A targeted adversarial attack method against YOLOv8 according to claim 6, characterized in that, Adversarial sample images for input First, calculate the gradient of the attack loss with respect to the input: ， Calculate the gradient direction using the sign function and update the input: ， in, This is an updated adversarial example. For symbolic functions, For step size parameters, This is a projection operator used to remap updated samples to a perturbation set invisible to the human eye, thereby reasonably constraining the strength of the perturbation update. This is the disturbance amplitude parameter.

Images