Project 02 — Research
YOLO26 Threat Mapping
From attack surface to diffusion-prior defence. What an attacker actually spends to own a production detector, and whether any defense inside it survives.
TL;DR: If you run computer vision in production with public weights, your system is wide open. You don't need a zero-day to blind it or feed it ghosts; you just need basic gradient descent. We did an end-to-end threat mapping of YOLO26-nano to price out what an attacker actually spends to own the model, in pixels, then built the standard defenses that live inside the detector and attacked every one of them the way a real adversary would. Spoiler: they don't survive, and the reason is structural. So we built one that lives outside the detector, a small diffusion model that asks a question the attacker never had to care about: are these pixels even a photograph? It works on the attacks it was built for, it has hard limits, and it is designed to be thrown away and replaced. All of it is in the paper, with every number traced to a result file.
The Threat Mapping
Attacking a white-box detector is training it in reverse: running gradient descent on the pixels instead of the weights. We priced nine digital attacks against YOLO26-nano:
- 1
Unbounded gradient:
The sanity bound, with random noise establishing the baseline floor.
- 2
Object-vanishing:
1 grey level per pixel empties 90% of frames. It survives PNG formatting but dies under JPEG compression.
- 3
Targeted fabrication:
0.5 grey levels per pixel injects a person somewhere in 95% of frames.
- 4
Per-image patch:
A square covering 1% of the photograph blanks a third of frames.
- 5
Bounding-box mislocalization:
The box is drawn, confident, and on the wrong object entirely.
- 6
Duplicate-detection:
One real object is reported twice.
- 7
Universal adversarial-patch:
One fixed file invents a person in 90% of unseen photos and survives JPEG quality 30. This is the attack that actually ships.
- 8
Image-specific perturbation:
A bounded change refined per photo, working 5 times out of 6 in seconds.
- 9
Photographic (stealth) patch:
A real photo crop with a tiny optimized change. It fabricates objects in 97% of frames while remaining a real photograph.
We built standard internal defenses, noise probes, transform banks, flip gates, crop-and-re-query, certified masking, and a massive second detector. Handed to a gradient-aware attacker, they all fail. A flip gate goes from 2.5% evasion to 97.5%. A second detector with 40x the parameters is bypassed three times out of four. The failure is structural: if the detector computes it, it's differentiable in the pixels the attacker controls, turning your defense into just another term in their loss function. The only test that holds is the quiet-output test (checking for total suppression), simply by construction. Run it today, but expect nothing more from it.
The Diffusion Prior
Because the detector cannot police its own math, a real defense must read something the detector ignores. We trained a 1-million-parameter U-Net from scratch on clean photos to reverse discrete Brownian diffusion, learning the exact direction and distance to a natural photograph. When YOLO reports a box, the U-Net measures the denoising residual of those pixels and asks: is this a photograph? The synthetic universal patch is not; it gets separated at AUC 0.94 and localized every time.
Here is what most papers hide: this defense has hard limits. It misses bounded full-frame perturbations because they sit below its resolution floor. The stealth photographic patch walks straight through because a crop of a photo is a photo, and no amount of training changes a correct answer. Honestly, a plain texture statistic catches the universal patch nearly as well. Plus, all our numbers assume the attacker doesn't know the defense exists.
This is a temporary solution by design. The U-Net is differentiable; once its weights leak, the exact same math that broke the internal defenses will break it. The advantage is pure logistics: training a replacement takes two epochs on a single GPU. You can retire and rotate compromised checkpoints cheaply without touching the main detector. We priced the attack surface, proved why internal defenses fail, and built an external one that actually bounds the threat.