YOLO26 Threat Mapping: From Attack Surface to Diffusion-Prior Defence

TL;DR: If you run computer vision in production with public weights, your system is wide open. You don't need a zero-day to blind it or feed it ghosts; you just need basic gradient descent. We did an end-to-end threat mapping of YOLO26-nano to price out what an attacker actually spends to own the model, in pixels, then built the standard defenses that live inside the detector and attacked every one of them the way a real adversary would. Spoiler: they don't survive, and the reason is structural. So we built one that lives outside the detector, a small diffusion model that asks a question the attacker never had to care about: are these pixels even a photograph? It works on the attacks it was built for, it has hard limits, and it is designed to be thrown away and replaced. All of it is in the paper, with every number traced to a result file.

The Threat Mapping

Attacking a white-box detector is training it in reverse: running gradient descent on the pixels instead of the weights. We priced nine digital attacks against YOLO26-nano.

The Diffusion Prior

Because the detector cannot police its own math, a real defense must read something the detector ignores. We trained a 1-million-parameter U-Net from scratch on clean photos to reverse discrete Brownian diffusion, learning the exact direction and distance to a natural photograph. When YOLO reports a box, the U-Net measures the denoising residual of those pixels and asks: is this a photograph? The synthetic universal patch is not; it gets separated at AUC 0.94 and localized every time.

Download the PDF ↓ Download the Markdown Project breakdown