## 4 Experiments
### Generalization to Other Detection Models  
To assess whether the observed trends hold for models beyond the YOLO family, we extended our experiments to include other one-stage and transformer-based object detection models. We categorized these models into small and large sizes, similarly to the YOLO models. Table 4 shows the backbones and parameter counts for each model in this evaluation, where we specifically selected the smallest and largest available model variants. Tables 5 and 6 present the [EMAIL_ADDRESS] results for textures trained on different YOLOv8 models when evaluated on these black box models. The results indicate that the trend observed with YOLO models extends to other detection architectures. Textures optimized on YOLOv8n are more effective against smaller models, while those optimized on YOLOv8x are more effective against larger models. Notably, the texture optimized on the combination YOLOv8x, YOLOv8m, YOLOv8n performs consistently well across both small and large models, achieving lower [EMAIL_ADDRESS] scores compared to textures optimized on single models. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Target Models** & **YOLOv8n** & **YOLOv8s** & **YOLOv8m** & **YOLOv8l** & **YOLOv8x** & **Mean AP** \\ \hline YOLOv8(\(\chi\), n) & 0.0252 & 0.0674 & 0.0684 & 0.0585 & 0.0184 & 0.0475 \\ YOLOv8(\(\chi\), s) & 0.1111 & 0.0277 & 0.0485 & 0.0486 & 0.0172 & 0.0506 \\ YOLOv8(\(\chi\), m) & 0.1651 & 0.0776 & 0.0192 & 0.0378 & 0.0175 & 0.0634 \\ YOLOv8(\(\chi\), l) & 0.2047 & 0.1369 & 0.0481 & 0.0182 & **0.0099** & 0.0835 \\ YOLOv8(\(\mid\)l, n) & **0.0165** & 0.0474 & 0.0388 & 0.0191 & 0.0576 & 0.0359 \\ YOLOv8(\(\mid\)l, s) & 0.0841 & **0.0185** & 0.0286 & **0.0099** & 0.0472 & 0.0377 \\ YOLOv8(\(\mid\)l, m) & 0.1059 & 0.0676 & **0.0191** & 0.0191 & 0.0277 & 0.0479 \\ YOLOv8(\(\chi\), l, m) & 0.1256 & 0.0778 & 0.0193 & 0.0184 & 0.0177 & 0.0518 \\ YOLOv8(\(\chi\), m, n) & 0.0253 & 0.0467 & 0.0198 & 0.0384 & 0.0182 & **0.0296** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparison of [EMAIL_ADDRESS] for adversarial textures optimized using various combinations of YOLOv8 model variants, with the “Mean AP” column representing the average detection performance over all the target models for each texture. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Texture Source** & **YOLOv5x** & **YOLOv10x** & **YOLOX-x** & **RetinaNet-I** & **RT-DETR-x** \\ \hline YOLOv8n & 0.1574 & 0.1975 & 0.2254 & 0.1708 & 0.5032 \\ YOLOv8x & 0.0491 & 0.1482 & 0.1954 & 0.2073 & 0.4705 \\ YOLOv8[x, n] & 0.0393 & 0.0989 & 0.1652 & 0.0997 & 0.4492 \\ YOLOv8[x, m, n] & 0.0293 & 0.0592 & 0.0948 & 0.0781 & 0.3255 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: [EMAIL_ADDRESS] performance of textures optimized on different YOLOv8 models, tested on large-sized detection models outside the YOLOv8 family. Figure 4: Comparison of mean [EMAIL_ADDRESS] scores for textures optimized on YOLOv8 model combinations when tested on both small and large object detection models outside the YOLOv8 family. \begin{table}
\begin{tabular}{l c c} \hline \hline
**Model** & **Backbone** & **Params** \\ \hline YOLOv5n & CSPDarknet53 & 1.9 M \\ YOLOv10n & CSPDarknet (optimized) & 2.3 M \\ YOLOX-n & DarkNet53 & 5.1 M \\ RetinaNet-s & ResNet-18-fpn & 21.4 M \\ RTDETR-s & rtdetr\_r18 vd & 20.2 M \\ \hline YOLOv5x & CSPDarknet53 & 97.2 M \\ YOLOv10x & CSPDarknet (optimized) & 29.5 M \\ YOLOX-x & DarkNet53 & 99.1 M \\ RetinaNet-x & ResNeXt-101-fpn & 95.7 M \\ RTDETR-x & rtdetr\_r101 vd & 76.6 M \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Model architecture comparison. Small-size and large-size models are separated by the horizontal line.