Abstract: Currently, cameras equipped with AI object detection technology are widely used. However, AI object detection models in realworld applications are vulnerable to adversarial attacks. Existing adversarial attack methods, primarily designed for earlier models, are ineffective against the latest YOLOv8 object detector. To address this issue, we propose a novel adversarial patch attack method specifically for the YOLOv8 object detector. This method minimizes confidence output while incorporating an exponential moving average (EMA) attention mechanism to enhance feature extraction during patch generation, thereby improving the attack’s effectiveness. Experimental results demonstrate that our method achieves superior attack performance and transferability. Validation tests, in which the adversarial patches were printed on clothing, also demonstrated excellent attack results, indicating the strong practicality of our proposed method.

Key words: deep learning, adversarial example, YOLOv8, object detection, adversarial patch

摘要： 目前，基于人工智能目标检测技术的摄像头得到了广泛的应用.而在现实世界中，基于人工智能的目标检测模型容易受到对抗样本攻击.现有的对抗样本攻击方案都是针对早版本的目标检测模型而设计的，利用这些方案去攻击最新的YOLOv8目标检测器并不能取得很好的攻击效果.为解决这一问题，针对YOLOv8目标检测器设计了一个全新的对抗补丁攻击方案.该方案在最小化置信度输出的基础上，引入了EMA注意力机制强化补丁生成时的特征提取，进而增强了攻击效果.实验证明该方案具有较优异的攻击效果和迁移性，将该方案形成的对抗补丁打印在衣服上进行验证测试，同样获得较优异的攻击效果，表明该方案具有较强的实用性.

关键词: 深度学习, 对抗样本, YOLOv8, 目标检测, 对抗补丁