Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2

AI summary

Overview

• Research area: Adversarial machine learning applied to visual foundation models, specifically prompting-based video object segmentation with Segment Anything Model 2 (SAM2).
• Technical level: Intermediate. The paper assumes familiarity with segmentation, prompts, adversarial perturbations, and IoU-style metrics, but explains its architecture-inspired reasoning in accessible terms.
• Scope: The paper introduces UAP-SAM2, the first cross-prompt universal adversarial attack against SAM2, and evaluates it on six datasets across video and image segmentation tasks.

What This Paper Is About

SAM2 extends the image segmentation model SAM to video by storing a prompt from the first frame and caching features from previous frames in a memory bank. Prior adversarial attacks that badly damage SAM largely fail on SAM2, so this paper asks why, then builds an attack that transfers across videos, frames, and prompts to make target objects "vanish into thin air." The goal is a single universal perturbation (UAP) that works on any frame, not a bespoke perturbation per image.

Key Contributions

1. The first cross-prompt universal adversarial attack against SAM2, designed so a single perturbation consistently misleads segmentation across videos, frames, and prompts.
2. A dual semantic deviation framework that combines a semantic confusion attack, a feature shift attack, and a memory misalignment attack, optimizing perturbations that distort current-frame semantics and break semantic consistency across consecutive frames.
3. A target-scanning strategy that splits each frame into m regions, each randomly assigned a prompt, to reduce dependence on any particular prompt during optimization.
4. An extensive evaluation on six datasets across two segmentation tasks, plus transferability studies, ablation studies, and two defense strategies, showing that UAP-SAM2 substantially outperforms prior state-of-the-art attacks.

Main Findings

• Existing SAM attacks barely transfer to SAM2: Evaluated at ε = 10/255 on YouTube and MOSE, methods including PGD, Attack-SAM, S-RA, UAD, and DarkSAM fool SAM but not SAM2. DarkSAM reduces SAM's average segmentation performance by 98.25% relative to its original performance on the two datasets, yet causes only a 22.26% drop on SAM2.
• Attacking only the first frame is insufficient: Using DarkSAM as a one-shot attack on the first frame of YouTube videos, and growing the perturbation budget from 10/255 to 32/255, still failed to significantly degrade segmentation even at the highest budget.
• Memory-based dual guidance resists single-frame attacks: Injecting noise into a randomly chosen middle frame did not greatly hurt accuracy, but perturbing features that feed the memory bank noticeably impaired segmentation of the current frame.
• Avalanche effect: Applying a UAP across consecutive frames produced a progressive decline in similarity between the current frame and both adjacent frames and the first frame.
• Strong attack performance: Benign SAM2 averages above 76% mIoU across the six datasets. On DAVIS with point prompts, UAP-SAM2 and its sample-wise variant UAP-SAM2* reduce SAM2's mIoU by over 45.79% and 54.77%, respectively. The method performs more strongly on video segmentation than on image segmentation for both point and box prompts.
• Better than baselines: Under the universal setting with SAM2-T as the target and random prompts used at both training and test time, UAP-SAM2 outperforms all existing attacks on video segmentation across three datasets and surpasses most baselines on image segmentation. For example, on the D1 video setting with point prompts, UAP-SAM2 reaches 37.03 mIoU versus 67.51 for DarkSAM.
• Transferability: Adversarial examples transfer across datasets and across models, and perturbations crafted on SAM2-T also degrade Sam2long under point and box prompts.
• Ablation details: All three loss modules contribute, since no ablated variant beat the full model. Attack performance is best at m = 256 regions (tested from 8 to 512), stabilizes after 10 iterations (tested 1 to 20), and remains strong even at ε = 4/255, with an average mIoU decrease of over 33.08% (ε tested from 2/255 to 32/255). Thirty negative samples was chosen as default (tested from 10 to 100), and 15 test frames per video matched the results of using all frames.
• Defenses are limited: Under model pruning from 0 to 0.9 on DAVIS, benign-sample mIoU falls as the pruning ratio rises while adversarial mIoU stays relatively stable, with benign performance degrading significantly by a pruning ratio of 0.4. Under spatter (sp_) and saturate (sa_) input corruption at severity levels 0 to 5, benign mIoU drops steadily while adversarial mIoU remains largely unaffected.

Methodology in Plain English

The authors first diagnose why attacks built for SAM collapse on SAM2. SAM2 keeps the prompt as a persistent representation and maintains a memory bank of features from earlier frames, and a memory attention module blends past and present information. That means a perturbation limited to one frame is diluted by two sources of guidance that the attacker does not control.

To counter this, UAP-SAM2 optimizes a single perturbation with three combined objectives. The semantic confusion attack pushes object pixels toward the background class and reinforces background pixels, using binary cross-entropy so that pixels with logits near the decision boundary get pushed harder. The feature shift attack minimizes cosine similarity between the image encoder's features for a perturbed frame and the clean frame, and adds a contrastive term that treats a prototype built from randomly augmented versions of the clean frame as a negative pair and frames from other videos as positive pairs. The memory misalignment attack maximizes the feature discrepancy between consecutive adversarial frames, which is what produces the avalanche effect.

To keep the perturbation prompt-agnostic, each frame is divided into m regions and each region gets a randomly assigned prompt, while the loss mainly targets the output features of the image encoder, whose input is only the image. The comparison and ablation experiments use point and box prompts and a large grid of datasets, model variants, and hyperparameters.

Why This Matters

This is the first work to probe the robustness of SAM2 to adversarial examples, showing that architectural improvements such as memory-based temporal guidance raise but do not eliminate the attack surface of segmentation foundation models. It also supplies a hard test case for adversarial robustness research: prior SAM attacks are poor proxies for video segmentation models.

Real-world applications affected:

• Autonomous driving, where accurate video object segmentation underpins perception and tracking.
• Medical video analysis, cited in the paper as a downstream SAM2 application alongside 3D segmentation and camouflaged object detection.
• Video editing, annotation, and content moderation pipelines that rely on foundation segmentation models.
• Surveillance and robotics, where frame-to-frame object tracking determines downstream decisions.

Industry relevance is direct: SAM2 is open-source, and the paper explicitly assumes attackers can obtain the model and collect public datasets, which is why the authors release code at https://github.com/CGCL-codes/UAP-SAM2. For teams deploying SAM2, the defense results suggest that common mitigations such as pruning or input corruption are not sufficient.

Future Directions

• Whether adversarial examples crafted for SAM2 transfer to other segmentation frameworks remains unclear, as the authors note their method may not directly generalize to traditional segmentation models whose outputs are not label-free masks.
• Extending robustness evaluation and defense design to SAM2 variants, since only Sam2long was tested in addition to SAM2-T, SAM2-S, and SAM2.1-T.
• Designing dedicated adversarial defenses for SAM2, given that the paper found no defense tailored to it and the two tested strategies offered limited protection.
• Studying safety-critical deployments such as autonomous driving and medical imaging, which the authors identify as a crucial direction for future research.

Target Audience

Researchers and practitioners in adversarial machine learning, computer vision security, and video object segmentation, including those evaluating or deploying SAM/SAM2 in safety-critical pipelines. It is most useful to readers who already understand segmentation, prompt-based models, and perturbation budgets, though the paper's diagnosis of SAM2's architecture is explained clearly enough for graduate students entering the field.

Authors’ abstract

Recent studies reveal the vulnerability of the image segmentation foundation model SAM to adversarial examples. Its successor, SAM2, has attracted significant attention due to its strong generalization capability in video segmentation. However, its robustness remains unexplored, and it is unclear whether existing attacks on SAM can be directly transferred to SAM2. In this paper, we first analyze the performance gap of existing attacks between SAM and SAM2 and highlight two key challenges arising from their architectural differences: directional guidance from the prompt and semantic entanglement across consecutive frames. To address these issues, we propose UAP-SAM2, the first cross-prompt universal adversarial attack against SAM2 driven by dual semantic deviation. For cross-prompt transferability, we begin by designing a target-scanning strategy that divides each frame into k regions, each randomly assigned a prompt, to reduce prompt dependency during optimization. For effectiveness, we design a dual semantic deviation framework that optimizes a UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames. Extensive experiments on six datasets across two segmentation tasks demonstrate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms state-of-the-art (SOTA) attacks by a large margin.