DarkSAM: Fooling Segment Anything Model to Segment Nothing
Authors: Ziqi Zhou
Yufei Song
Minghui Li
Shengshan Hu
Xianlong Wang
Leo Yu Zhang
Dezhong Yao
Hai Jin
Venue: NeurIPS 2024 poster (2024)
Keywords: Segment Anything Model
Adversarial Example
Primary area: safety_in_machine_learning

Abstract: Segment Anything Model (SAM) has recently gained much attention for its outstanding generalization to unseen data and tasks. Despite its promising prospect, the vulnerabilities of SAM, especially to universal adversarial perturbation (UAP) have not been thoroughly investigated yet. In this paper, we propose DarkSAM, the first prompt-free universal attack framework against SAM, including a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. We first divide the output of SAM into foreground and background. Then, we design a shadow target strategy to obtain the semantic blueprint of the image as the attack target. DarkSAM is dedicated to fooling SAM by extracting and destroying crucial object features from images in both spatial and frequency domains. In the spatial domain, we disrupt the semantics of both the foreground and background in the image to confuse SAM. In the frequency domain, we further enhance the attack effectiveness by distorting the high-frequency components (i.e., texture information) of the image. Consequently, with a single UAP, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts. Experimental results on four datasets for SAM and its two variant models demonstrate the powerful attack capability and transferability of DarkSAM. Our codes are available at: https://github.com/CGCL-codes/DarkSAM.

DarkSAM: Fooling Segment Anything Model to Segment Nothing
Ziqi Zhou 1.23+ Yufei Song', Minghui Lit, Shengshan Hu 1224,,,, Xianlong Wang" 12,4,5t, 1..g5.2,4455,
Leo Yu Zhang Dezhong Yao ,2,3+ Hai Jin 12,3.
National Engincering Research Center for Big Data Technology and System
2 Services Computing Technology and System Lab Cluster and Grid Computing Lab
Hubei Engineering Research Center on Big Data Security
5 Hubei Key Laboratory of Distributed System Security
School of Computer Science and Technology. Huazhong University of Science and Technology
i School of Cyber Science and Engineering, Huazhong University of Science and Technology
School of Software Engineering, Huazhong University of Science and Technology 8 School of Information and Communication Technology, Griffith University {zhouziql qi, yufei 17, mi nghuil hushengshan, wx 99, dyao, hjin frjinnhhustt @hust edu. leo. zhwngggriffiiiie edu.
Abstract
Segment Anything Model (SAM) has recently gained much attention for its out- standing generalization to unseen data and tasks. Despite its promising prospect, the vulnerabilities of SAM, especially to universal adversarial perturbation (UAP) have not been thoroughly investigated yet. In this paper, we propose Dark- SAM, the first prompt-free universal attack framework against SAM, including a semantic decoupling-
spatial attack and texture distortion- frequency attack. We first divide the output of SAM into foreground and background. Then, we design a shadow target strategy to obtain the semantic blueprint of the image the attack target. DarkSAM is dedicated to fooling SAM by extracting and destroying crucial object features from images in both spatial and frequency do- mains. In the spatial domain, we disrupt the semanties of both the foreground and background in the image to confuse SAM. In the frequency domain, we further en- hance the attack effectiveness by distorting the high-frequency components (i.e., texture information) of the image. Consequently, with a single UAP, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts. Experimental results on four datasets for SAM and its two variant mod- els demonstrate the powerful attack capability and transferability of DarkSAM. Our codes are available at: http://ilubb.ooo/CCC---eeeeeeeee
1 Introduction
With the advancement of deep learning, large language models, such as GPT [2], LaMDA [33], and PaLM [6], have achieved tremendous success, yet the development of large vision models lags be- hind. Recently, Segment Anything Model (SAM) [19] was proposed foundational vision model, demonstrating exceptional generalization capabilities for handling complex segmentation tasks. Un- like traditional segmentation models [24, 42] that output pixel-level labels, SAM introduces a novel prompt-guided image segmentation paradigm by directly producing label-free masks for object seg- mentation. Benefiting from its powerful zero-shot capability, SAM has been rapidly deployed across various downstream scenarios, such as medical images [34], videos [36], and 3D point clouds [12].
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

image embedding
MM
Adversory
Coo Image Encoder
Benign Example
Mask decoder
"Segment Anything"
UAP
Prompt encoder
Adversarial Example
"Segment Nothing"
Segment Anything Model (SAM)
Figure Illustration of fooling SAM using UAP
Deep neural networks (DNNs) are shown to be vulnerable to adversarial examples [16, 21, 41, 46], and SAM is no exception. Standard adversarial attacks are designed for classification tasks and cause misclassification by manipulating global image features through image-level perturbations. Existing attacks can be divided into crafting sample-wise adversarial perturbation [25] and universal adversarial perturbation (UAP) [27]. The former is tailored for specific inputs, while the latter seeks single perturbation applicable across wide range of inputs, thereby intensifying its complexity and difficulty. As a pioneering prompt-guided segmentation model, SAM relies on both input images and prompts yield label-free masks, rendering existing adversarial attacks [1, 10, 25, 26] focusing only for images and relying on labels ineffective.
Recent efforts [17,39 39] started to explore the robustness of SAM against sample- adversarial per- turbations. Attack-SAM [39] employs classical FGSM [10] and PGD [25] to remove or manipulate the predicted mask for given image and prompt pair. Meanwhile, another study [17] also investi- gates the robustness of SAM against various adversarial attacks and corrupted images. However, the more challenging universal adversarial attacks, which more closely resemble real-world scenarios, remain far less thoroughly explored. The introduction of extra and varying prompts in SAM's input, coupled with the lack of label information in its output for attack optimization, renders attacking SAM exceedingly challenging, posing an intriguing problem:
Is it feasible to fool the Segment Anything model to segment nothing through a single UAP?
In this paper, take substantial step towards bridging the gap between SAM and UAP. We pro- pose DarkSAM, the first truly prompt-free universal adversarial attack on the prompt-guieed image segmentation models (i.e., SAM and its variants), aiming to disable their segmentation ability across diverse input images using a single UAP, irrespective of prompts (see Fig. 1). Unlike classification models that focus on global features, prompt-guided segmentation models concentrate cal critical objects within images (e.g., objects indicated by prompts). Therefore, our intuition is to destroy crucial object features in the image to mislead SAM into incorrectly segmenting the input images. To this end, DarkSAM is dedicated to decoupling the crucial object features of images from both spatial and frequency domains, utilizing a UAP to disrupt them. 1) In the spatial domain, we begin by dividing SAM's output into foreground (i.e., positive mask values) and background (i.e., negative mask values) via Boolean mask. We then scramble SAM's decision by destroying the features of the foreground and background of the image, respectively. 2) In the frequency do- main, inspired by the factor that SAM is biased towards image texture over shape [38], we employ frequency filter to decompose images into high-frequency components (HFC) and low-frequency components (LFC). By increasing the dissimilarity the HFC of adversarial and benign examples while maintaining consistency in their LHC, we further enhance the effectiveness and transferability of UAP. Experimental results on four segmentation benchmark datasets for SAM and its two variant models, HQ-SAM [18] and PerSAM [40], demonstrate that DarkSAM achieves high attack success rates and transferability.
lo-
Our main contributions are summarized as follows:
We propose DarkSAM, the first truly universal adversarial attack against SAM. We employ a single perturbation to prevent SAM from segmenting objects across range of images under any form of prompt, which further unveils its vulnerability.

---

We design brand-new prompt-free hybrid Pratial-frquence universal attack framework against the prompt-guided image segmentation models to generate UAP thus making them segment nothing, which consists of semantic decoupling- based spatial attack and texture distortion- baaeed frequency attack.
We conduct extensive experiments four datasets for SAM and its two variant models. Both the qualitative and quantitative results demonstrate that DarkSAM achieves high at- tack success rates and transferabilityy
2 Background and Related Works
2.1 Prompt-guided Image Segmentation
Segment Anything Model [19] is a cutting-edge advancement in computer vision, garnering widespread attention [3, 5, 20, 22, 34] for its powerful segmentation capabilities. Recent works have been dedicated to exploring various variants of SAM to further enhance performance, such as HQ-SAM [18], PerSAM [40], and MobileSAM [37]. Distinct from traditional semantic segmenta- tion models [4, 24, 42] that predominantly focus pixel-level label prediction, SAM undertakes the label-free mask prediction by generating object masks for a wide array of subjects using prompts. consists of three components: image encoder, a prompt encoder, and lightweight mask decoder. The image encoder generates image representations latent space and the prompt encoder utilizes positional embeddings for representing prompts, such points and boxes. The mask decoder, com- bining outputs from both image and prompt encoders, predicts effective masks to segment targeted objects.
Given an image x Hx and corresponding prompt to SAM, denoted as [(x IP) xW, the model returns mask m with the predicted segmentation. The prediction process of SAM can be represented as follow:
= (o,
(1)
where 9 represents the parameter of f()). For an image x, each pixel located at coordinates (i.j), referred to Zij. is deemed part of the masked region when its corresponding mask value m.j exceeds a defined threshold of zero. Recent exploratory studies [39, 17, 35] have revealed vulner- abilities of SAM adversarial examples and common image corruptions. Different from previous works, our goal is to develop a powerful universal adversarial attack for such prompt-guided image segmentation models.
2.2 Universal Adversarial Perturbation
Deep neural networks have been shown vulnerable adversarial examples [10, 25, 44, 45, 46), where attackers can deceive models by introducing subtle noise to images. Universal adversarial perturbation [27] (UAP) was first proposed to fool the victim model by imposing single adversar- ial perturbation a series of images. Existing works can be divided into data-dependent universal adversarial attacks [14, 27,30] 30] and data-free universal attacks [28, 29, 31 31], both designed for clas- sification attacks. The former relies the specific data characteristies of target dataset for UAP generation, while the latter provides more generalized approach without relying on such data. Mcanwhile, some works [15] have also explored UAPs for traditional segmentation models, but they rely on pixel-level labels, which are not applicable to emerging prompt-guided segmentation models. The concurrent works [8, 13] explore UAPs against SAM from the perspectives of direct noise optimization and perturbing the output of the image encoder of SAM, respectively. Different from them, aim to comprehensively decouple and disrupt crucial object features in images from both spatial and frequency domains, thereby deceiving SAM into failing to segment input images.
Methodology
3.1 Problem Formulation
As a fundamental vision model, SAM typically operates in an online mode, allowing users set prompts randomly. Therefore, we define the threat model quasi-black-box setting, where ad-
3

---

Benign examples
Single mask
"Blueprint" T
prompt prompt 2
SAM
Merge
prompt prompt
SAM
Merge
(b)
(c)
Figure 2: Illustration of the proposed shadow target strategy
versaries have access to the official open-source SAM, but not to the pre-training dataset and the downstream dataset (i.e., those used by users). The adversaries' goal is craft UAP 5 using rogate dataset D, (i.e., unrelated to the pre- pre-training and downstream dataset), thereby compromising the model's performance, i.e., rendering adversarial examples unable to be correctly segmented by SAM. Additionally, the should be sufficiently small, and constrained by 1--norm of e. This prob- lem can be formulated as:
max ED ((xx+66,)) # fo (z, s.t. |10||p Se.
3.2 Intuition Behind DarkSAM
Unlike the standard deep learning paradigm that inputs a single image and outputs a one-hot label or pixel-level label, SAM requires both images and prompts inputs, and then outputs label-free masks, indicating the shape information of critical objects. Therefore, a truly universal adversarial attack against SAM should implement single perturbation achieve ineffective segmentation for any combination between a series images and different prompts. However, this task is hindered by the following challenges:
The dual ambiguity in attack targets arising from varying images and prompts. Previous UAP works only need to optimize in the target images, hence the introduction of prompts could lead to invalid attacks, as different prompts for a fixed image yield distinct segmentation results. For instance, the image in the top-left corner of Fig. 2 shows can and a spoon. For the same image, feeding different prompts will result in different masks output by SAM (see Fig. 2(b)). In conclusion, diverse variations in target images and prompts increase the uncertainty of attack targets. For varying images, cxisting UAP solutions (e.g., UAPGD [9]) can provide references, and the main challenge here is the uncertainty of the attack target brought by unknown prompts. To this end, we propose shadow target strategy by increasing the number of prompts during the attack process to enhance the cross-promy, transferability of UAP. Specifically, for given input image, we randomly select & prompts (e.g., points or boxes) to create a prompt auxiliary set. By merging their masks output by SAM, form semantic blueprint of the image, which serves the target for our attack, as illustrated in Fig. 2(c). This semantic blueprint effectively encompasses the main semantic content of the original image, substantially reducing the ambiguity associated with unknown prompts.
Challenge I:
Challenge II: Suboptimal attack efficacy due to semantic decoupling deficiency. Since prompt- guided segmentation models output masks that are neither one-hot nor pixel-level labels, traditional attack methods that rely on label deviation for optimization guidance become ineffective. Another approach involves directly modifying the output, such as adjusting the adversarial examples' masks to diverge from their originals, potentially yielding marginal attack success verified in Sec. 4.4. Nonetheless, the intrinsic sensitivity of segmentation models to pixel-level details significantly con- strains the potency of these attacks, underscoring notable limitation in their applicability.
Given the focus of prompt-guided segmentation models on local, critical object features rather than global image features, we are motivated to comprehensively decouple the key semantic features

---

Frequency domain
Spatial domain
benign results
DD-
C
Filter
SAM
benign moammle
foregiand region
pouttec: rageli
PAI
results
oprictration
optimicab
gerand sedan
negelas pa
push
HFC
"Segenent Everything Mode"
Figure 3: The framework of DarkSAM
of an image from the perspective of both spatial and frequency domains, aiming to fool SAM by manipulating these features. We first define the main object within the image (i.e., the target of segmentation, typically region rich in texture) as the foreground, with the rest being defined as the background. As the mask oulput by SAM indicates the foreground with positive values and the background with negative ones, we use a Boolean mask to separately extract these foreground and background masks. Subsequently, we optimize the UAP, switching adversarial examples' fore- ground to negative and background to positive, disrupting the image's semantics for spatial at- tack. At the same time, inspired by the recent study [38] that SAM is biased towards texture of the image over shape, we investigate the alteration of the high-frequency components (i.e., texture in- formation) adversarial examples the frequency domain, while simultaneously constraining low-frequency components (i.e., shape information), in order to further enhance the effectiveness and transferability our attack. By separately decoupling and destroying crucial features both the spatial and frequency domains, provide valuable optimization directions for UAP generation, thereby facilitating effective attacks on SAM.
3.3 DarkSAM: A Complete Illustration
In this section, we present DarkSAM, novel prompt-free hybrid spatial-frequene universal ad- versarial attack against the prompt-guided image segmentation models (i.e.. SAM and its variants). The pipeline of DarkSAM is depicted in Fig. 3, encompassing semantic decoupling-bast based spatial attack and texture distortion-baser frequency attack. We start by randomly generating different prompts to form an auxiliary prompt set Pa. acquiring the semantic blueprints of the target images as the attack targets. By individually manipulating the semantic content of adversarial examples' foreground and background in the spatial domain, and increasing the distance between the HFC of adversarial and benign examples the frequency domain, while also constraining the difference in their LFC, we enhance the attack performance and transferability of the UAP. We provide the de- tailed optimization process DarkSAM in Algorithm I. The overall optimization objective Trotal of DarkSAM is follow:
Trotal = Jsa + XJfa=
where J.n and Jfa are the spatial and frequency attack losses, and À controls the importance.
Semantic decoupling-based spatial attack. Initially, utilize to separately extract the foreground and background mask of the adversarial examples based on the positive and negative values in the mask output by SAM. As for the foreground, our intention is to render it unidentifiable and unsegmentable by SAM. Thus, we optimize its mask towards negative fake mask Eneg, enabling its fusion with the background achieve segmentation evasion. The foreground evasion loss Jjc can be described as:
Boolean mask mfg and m
Jje Ja(fo( &.P.) mngg
where Eneg fake mask that conforms to the shape of the image, containing threshold values of -r in regions corresponding to the foreground, and 0 elsewhere. Ta serves as the distance metric function, representing the mean squared error loss. For the background, we optimize its mask towards positive fake mask Epos (opposite to Eneg), misleading SAM into interpreting it as
5

---

semantically meaningful object, consequently causing further interference in the assessment of the foreground. The associated loss is
Jom [2(fo( + o,F.) migg
(5)
The loss the semantic decoupling-bane based spatial attack can expressed as:
Jsa = Jec + Jbm-
(6)
Texture distortion-based frequency attack. In the frequency domain, the high-frequene com- ponents of image denote the finer details, including noise and textures, while the low- low-frequency components contain the general outline and overall structural information of the image. We em- ploy the discrete wavelet transform (DWT), utilizing low-pass filter L and high-pass filter 'H to decompose the image x into different components, constituting a low-frequency component Cn, a high-frequency component Chh, and two mid-frequency components eu and chts via
= CrC = HoH." cu/eeu LxH.") /HoL"
Subsequently, we employ the inverse discrete wavelet transform (IDWT) to reconstruct the signal that have been decomposed through DWT into image. We choose the LFC and HFC while dropping the other components to obtain the reconstructed images 6(x) and (xx) as
<(x) cncn-= L2 2T (CxL")L.
v(x) = H. CAA 7 H. (Ha7" HH.
By adding a UAP to the images, we alter their HFC, disrupting the original texture information. Simultaneously, enforee constraints the low-frequency disparities between adversarial and benign examples to redirect larger portion of the perturbation towards the high-frequency domain. As result, enhance the attack performance and cross-domain transferability of the UAP by introducing variations the frequency domain. The loss texture distortion- frequency attack can be expressed as:
Jja Jifa- -pJfe
(10)
where / is pre-defined hyperparameter.
Algorithm DarkSAM
Input: image x E D., SAM f(r with parameter 0, hyper parameters k, T, X, and μ,, max- perturbation constraint
Output: A universal adversarial perturbation 5 1: Initialize random prompt IP, and noise 8,
2: Initialize adversarial examples: x f- x + 8,
3: Project x² to [0, via clipping
4: Separating different frequency components of x using the discrete wavelet transform:
cu, Cth, Chis ChΛ
DWT(z)
5: Restore part of the frequency components into an image using the inverse discrete wavelet trans-
form: (bx), (x) k- IDWT(cu). (DWT(cis)
6: Calculate / by determining the sign of each value in output of fo(x,
7: while max iterations not converge do
8: Calculate spatial loss mentioned in Eq. 6
9: Calculate frequency loss mentioned in Eq. 10
10:
Update ō through backprop
Clip to satisfy imperceptibility constraint
12: Project x" to [0, via clipping
13: end while

---

Table I: The mloU (%) of DarkSAM under different settings. Values covered by gray denote the clean mloU,
others denote adversarial mloU. ADE20K, MS-COCO, CITYSCAPES abbreviated ADE, COCO, CITY, respectively. Bolded values indicate the best results.
Setting
SAM
IQQ-AMM [18]
PerSAM [40)
Prompi
Surrugate
ADE
COCO
CITY
SA-10
ADE
COCO
CITY
SA-IB
ADE
COCO
CITY
SA-
Clean
65.39
62.79
50.70
77.21
63.39
65.38
50.25
72.89
64.61
62.91
51.22
77.93
ADE
0.43
3.21
0.02
5.81
0.99
6.04
6.82
7.75
0.37
3.25
7.95
1.54
COCO
0.42
1.16
0.76
2.46
0.69
2.23
3.19
3,46
0.01
0,05
2.56
0.07
POINT
CITY
10.54
22.23
0.97
22.11
9.95
25.12
3.01
20.82
0.93
5.57
0.43
1.19
SA-1B
0.24
0.91
0.04
0.14
1.20
5,74
2.81
0.75
0.05
0.07
2.54
0,05
7.63
9.78
2.24
3.37
Clean
74,39
79.00
64.60
89.41
72.95
81.19
62,00
86,80
72.30
78.83
641.66
89.32
ADE
4.87
10.74
1.64
14.81
3.77
12.95
19.16
20.90
2.32
8.82
19.33
14:06
COCO
1.51
2.97
1.96
9.22
0.27
9.38
9.74
20.97
0.41
1.38
12.04
3.20
BOX
CITY
17.39
26.43
0.33
16.10
4.43
20.60
27.66
3.09
13,40
2.49
35.25
SA-1B
16.81
27.38
9.19
5.19
10.16
24.90
18.06
1.01
5.49
17.12
16.46
0.81
11.33
4.66
10.18
12.58
Experiments
4.1 Experimental Setup
Datasets and models. We evaluate our method using four public segmentation datasets: ADE20K [43], MS-COCO [23], CITYSCAPES [7], and SA-IB [19]. For each dataset, we ran- domly select 100 images for UAP generation and 2,000 images for testing purposes. All images are uniformly resized to xx 1024x 1024. For victim models, we use the pre-trained SAM [19], HQ-SAM [18] and PerSAM [40] with the ViT-B backbone.
Parameter setting. Following 19, 27, 32], experiments, we adjust the hyperparameters k, T, X, and μu to 10, 1, 0.1, and 0.01, respectively, and set the batch size 1. To evaluate the cross-prompt attack capabilities of DarkSAM, we employ three distinct prompt types: point, box, and segment everything (also abbreviated as "all") mode.
the upper bound of UAP 10/255. For our
Evaluation metries. To evaluate the effectiveness of DarkSAM, Union (mloU) metric. To facilitate data presentation, we also use the attack success rale (ASR) as metric to evaluate attack performance. ASR represents the difference between the mloU values of benign and adversarial examples.
the mean Intersection over
4.2 Attack Performance
To comprehensively evaluate DarkSAM's effectiveness, we perform experiments on three prompt- guided image segmentation models including SAM, HQ-SAM, and PerSAM, across four datasets. For each setup, we generate UAPs using point and box prompts, respectively, and then evaluate DarkSAM's attack performance using the corresponding single-point or single-box prompt. We first calculate the clean mIoU of different models across four datasets using point and box as prompts. Specifically, for the SA-IB dataset, we directly extract point and box prompts from the annotations, whereas for the other datasets, we obtain internal points and external boxes as prompts by calculating the object contour coordinates within their annotations.
The experiments in Tab. show that DarkSAM can effectively fool these prompt-guided image seg- mentation models with an average mIoU reduction of more than 60% across 96 different experimen- tal settings. The results in Tab. also indicate that box prompts only yield higher segmentation accuracy but also demonstrate greater robustness. For adversaries, the choice of surrogate datasets has minor impact on crafting UAPs, yet they consistently facilitate excellent attack performance. Notably, DarkSAM AM demonstrates a distinct advantage when the SA-IB dataset, the training data for SAM, is employed results, we also present qualitative findings. Specifically, we provide the visualization of SAM seg- mentation results for adversarial examples made by DarkSAM using point and box prompts across four different datasets in Fig. 4. These results include masks of objects in images output by SAM under point, box, and segment everything prompt modes. From Fig. 4, we can see that SAM suc- cessfully segments benign images across three types of prompt modes, but it is unable segment adversarial examples, iee,, the output masks are close to "dark". The qualitative results further cor- roborate the powerful attack capability of DarkSAM.
the surrogate dataset. In addition the above quantitative experimental

---

Benign-Foint
Ady-Point
Benign- Box
Adv-Boo
Benign-All
AdvAAl
MS-COCO
SA-IB CITYSCAPES
Figure Visualizations of SAM segmentation results for adversarial examples across four datasets. The middle four columns display the segmentation results for point and box prompts, respectively. The last three columns show results under the segment everything mode for benign examples, as well as adversarial examples created using point and box prompts, respectively.
first four columns
Table 2:
The ASR (%) of the cross poss-prompt transferability study SAM. "BOX POINT" indicates that adversarial examples created using box tested point mode. Others stand the meaning.
BOX POINT
POINT
BOX
Surrogate
ADE
COCO
CITY
SA-1B
ADE
COCO
CITY
SA-1B
ADE
63.01
55.61
49.72
66.67
47.00
35.52
56.15
40.80
COCO
64.95
61.69
49.98
75.09
19.95
25.27
44.60
53.01
CITY
48.31
30.48
50.30
55.74
17.36
10.94
55.43
20.69
SA-1B
52.47
36.05
47.12
66.20
31.16
17.45
58.21
62.00
AVG
57.19
45.96
49.28
65.93
28.87
22.30
53.60
44.13
4.3 Transferability Study
We study the attack transferability of DarkSAM across data domain, prompt types, and models, re- spectively. Cross-domain. The results in Tab. demonstrate DarkSAM's excellent cross-domain transferability, where UAPs generated with the surrogate dataset (ADE20K) achieve high ASR on datasets from various different domains. also explore the role of the frequency attack (i.e., Jyas denoted as FA) in enhancing cross-domain transferability. As shown in Fig. (a) frequency attack can effectively improve the attack performance based on the spatial attack (i.e., Jear denoted as SA). 2 Cross Cross-prompt. We examine the performance of DarkSAM across various types of prompts. As demonstrated in the last three columns of Fig. 4, UAPs created based on both point and box prompts perform well under the segment everything mode. Additionally,
provide results of transferability experiments between point and box prompts in Tab. 2. This includes testing UAPs created with point prompts in the box prompt setting and vice versa. Based the observed results, it is discernible that UAPs crafted using box prompts generally demonstrate better transferability compared to those using point prompts. This increased efficacy can likely be attributed to the box prompts offering more integral and detailed prompt information. Cross-model. We use UAPs created with points and boxes based SAM attack HQ-SAM and PER-SAM. The results Fig. 5 (b) (e) showcase DarkSAM's exceptional transferability across different models.
4.4 Comparison Study
To comprehensively demonstrate the superiority of our proposed method, we compare DarkSAM
with popular UAP schemes, including UAP [27], UAPGD [9], and SSP [32]. We also consider the state-of-the-art adversarial attack against traditional segmentation models, SegPGD [11], and the

---

on
2504
6141
40
437
1/44
0.40
5.15
MM 140
9031
1214
0151
(a) SA&FA
(b) Point-HQ
(c) Point-PER
(d) Box-HQ
(c) Box-PER
Figure 5: The ASR (%) of transfcrability study. (a) explores the impact of the frequency attack on boosting the
cross-domain transferability UAPs. (b) (e) stand the results cross-model transferability study. "Point-
HQ" and "Box-HQ" denote the results of HQ-SAN SAM under point and box prompts, while the suffix "-PER" represents the corresponding results for PerSAM. Each row represents the same UAP.
Table 3: The ASR (%) of comparison study
POINT + POINT
BOX - BOX
Method
ADE
COCO
CITY
SA-IB
ADE
COCO
CITY
SA-IB
UAP [27]
1.62
0.47
8.13
5.28
0.28
*
1.29
1.76
UAPGD [9]
4.85
1.52
11.52
10.04
0.97
0.45
2.22
3.11
SSP [32]
0.67
0.09
5.90
4.08
0.91
1.20
SegPGD [11]
4.24
1.44
11.48
8.92
0.89
0.51
2.10
3,46
Attack-SAN. [39]
2.91
1.36
13.20
9.54
0.51
0.36
1.90
3.12
Ours
64.96
61.63
50.63
77.07
69.72
76.03
64.27
84.22
latest sample-wise attack against SAM, Attack-SAM [39]. For a fair comparison. we adapt them to UAP optimization strategy and keep other settings consistent with DarkSAM. We select SAM as the victim model and assess the effectiveness of these UAP methods across four datasets, using the same dataset for both generating and testing the UAPs. The results in Tab. indicate that Dark- SAM outperforms all methods with a considerable margin. The negative experimental values ("*") indicate that the attack does not work at all. This phenomenon may stem from counterproductive perturbations that inadvertently cause the input samples to resemble the training set used by SAM, paradoxically enhancing accuracy and resulting in negative ASR values. We also provide visual- izations of the segmentation results of the adversarial examples made by these methods using box prompts in Fig. obtained in point, box, and segment-everything modes, respectively. The results further demonstrate the superiority of DarkSAM.
4.5 Ablation Study
In this section, we explore the effect of different modules, prompt number, attack strengths, training data size, and threshold values on DarkSAM. We conduct experiments using point prompts on SAM across the ADE20K dataset.
The effect of different modules. We investigate the effect of various modules on the attack perfor- mance of Dar For clarity and convenience, we use A. B, C, and denote Jfe- Jom Jhfe- and Jife, respectively. The results in Fig. 7 (a) show that no variants can compete with the complete method, implying the indispensability each component for DarkSAM.
The effect of prompt number. We study the effect of the prompt number in proposed shadow target strategy on attack performance of DarkSAM. We conduct experiments with varying numbers of point prompts, ranging from to 100. The results in Fig. 7 (b) show a gradual increase in attack performance from to 10 (default setting), followed by downward trend. This could be attributed to an excess of random points leading to masks with redundant information, thereby impacting the attack efficacy.
The effect of perturbation budget. As shown in Fig. 7 (c), we evaluate DarkSAM's attack perfor- mance with from 4/255 32/255. With the increase in there is corresponding enhancement in attack performance. Notably, our attack still maintains high efficacy at the 6/ /25 setting, with an average ASR exceeding 45%.
The effect number of training samples. We explore the effect of varying the number of train- ing images used to create UAP on DarkSAM. Utilizing range from 10 to 1000 images to craft UAPs, the results Fig. 7 (d) reveal that employing merely 100 images can achieve excellent attack performance, demonstrating strong applicability advantage.

---

Benign
UAP
UAPGD
SSP
SegPGD
Attack-SAM
Ours
Point
Box
All
Figure Visualizations of the comparison study
ASS
1901 030
(a) Module
(b) Prompt
(c) Epsilon
(d) Number
(c) Threshold
Figure 7: The results (%) of ablation study. (a) - (c) investigate the effect of different modules, prompt number, attack strengths, number of training samples, and threshold values in fake mask on DarkSAM, respectively.
The effect of threshold values. DarkSAM. As illustrated in Fig. 7 (e), test range of values from 1 to 1000. The results indicate that these different values have a minimal overall effect on DarkSAM's performance.
We examine the effect of varying threshold values r in the fake mask
Conclusions, Limitations, and Broader Impact
In this paper, propose DarkSAM, the first truly universal adversarial attack against SAM. With single perturbation, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts, thereby exposing its vulnerability. To tackle the challenge of dual ambiguity in attack targets, we present a shadow target strategy to obtain semantic blueprint as a attack target. We then design novel prompt-free hybrid fretullyy universal attack framework, which consists of a semantic decoupling-bait based spatial attack and a texture distortion- based frequency at- tack. By disrupting the crucial object features in both the spatial and frequency domains of the images, it successfully addresses the challenge of suboptimal attack efficacy, thus deceiving SAM. Our extensive experiments SAM, HQ-SAM, and PerSAM across four datasets, both qualitatively and quantitatively, demonstrate DarkSAM's powerful attack ability and strong attack transferability.
In terms of limitations, DarkSAM may not be suitable for traditional segmentation models because its output is not a label-free mask. This characteristic might limit its applicability in scenarios where labeled masks essential for accurate segmentation. The adversaris examples produced by DarkSAM could potentially mislead SAM-based segmentation platforms, posing significant security risks, particularly in sensitive domains like medical image analysis.
Acknowledgements
Shengshan Hu's work is supported by the National Natural Science Foundation of China (Grant Nos. 220A20177, 62372196). Dezhong Yao's 's work is supported by the National Natural Science Foun- dation of China under Grant No. 62072204. Shengshan Hu and Dezhong Yao are co-corresponding authors.
10

---

References
[1] Anurag Arnab, Ondrej Miksik, and Philip HS Torr. On the robustness of semantic segmentation models to adversarial attacks. In Proceedings the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR' (8), pages 888-897,22 2018.
[2] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agar- wal, Ariel Herbert-Voss Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCan- dlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learn- ers. In Proceedings of the 44th International Conference on Neural Information Processing Systems (NeurIPS 20), pages 1877-1901, 2020.
[3] Cheng Chen, Juzheng Miao, Dufan Wu, Aoxiao Zhong, Zhiling Yan, Sckeun Kim, Jiang Hu, Zhengliang Liu, Lichao Sun, Xiang Li, Tianming Liu, Pheng-Ann Heng, and Quanzheng Li. Ma-sam: Modality-agnostic adaptation for 3d medical image segmentation. arXiv preprint arXiv:2309.08844 088422, 2023.
[4] Liang-Chial Chen, George Papandreou, Florian Schroff, and Hartwig Adam. Rethinking 2017.
atrous convolution for semantic image segmentation. arXiv preprint
[5] Tianrun Chen, Lanyun Zhu, Chaotao Deng, Runlong Cao, Yan Wang. Shangzhan Zhang, Ze- jian Li, Lingyun Sun, Ying Zang, and Papa Mao. Sam-adapter: Adapting segment anything in underperformed scenes. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), pages 3367-3375, 2023.
[6] Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang. Mostafa Dehghani, Siddhartha Brahma, Albert Webson, Shixiang Shane Gu, Zhuyun Dai, Mirac Suzgun, Xinyun Chen, Aakanksha Chowdhery, Alex Castro-Ros, Marie Pellat, Kevin Robinson. Dasha Valter, Sharan Narang, Gaurav Mishra, Adams Yu, Vincent Y. Zhao, Yanping Huang, Andrew M. Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoe V. Le, and Jason Wei. Scaling instruction-finetuue language models. arXiv preprint arXiv:2210. 10. 1416, 2022.
[7] Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Ro- drigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for mantic urban seene understanding. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition (CVPR' 16), pages
2016.
[8] Francesco Croce and Matthias Hein. Segment (almost) nothing: Prompt-agnostic adversarial attacks on segmentation models. arXiv preprint arXiv:23/1. 14400, 2023.
[9] Yingpeng Deng and Lina J Karam. Universal adversarial attack via enhanced projected gra- dient descent. In Proceedings of the IEEE International Conference on Image Processing (ICIP"20), pages 1241-1245, 2020.
[10] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. arXiv preprint 14X.:: 2014.
[11] Jindong Gu. Hengshuang Zhao, Volker Tresp, and Philip HS Torr. Segpgd: An effective and ef- ficient adversarial attack for evaluating and boosting segmentation robustness. In Proceedings of the 17th European Conference Computer Vision 22), pages 308-325, 2022.
[12] Haoyu Guo, He Zhu, Sida Peng, Yuang Wang, Yujun Shen, Ruizhen Hu, and Xiaowei Zhou. Sam- -unddgddedd graph cut for 3d instance segmentation. arXiv preprint arXiv:2312.08372, 2023.
[13] Dongshen Han, Sheng Zheng, and Chaoning Zhang, Segment anything meets universal adver- sarial perturbation. arXiv preprint 0rXiv:2310.12433 2023.
[14] Jamie Hayes and George Danezis. Learning universal adversarial perturbations with generative models. In Proceedings of the IEFE Symposium on Security and Privacy Workshops (SPW"18) 18), pages 43-49, 2018
11

---

[15] Jan Hendrik Metzen, Mummadi Chaithanya Kumar, Thomas Brox, and Volker Fischer. Uni- versal adversarial perturbations against semantic image segmentation. In Proceedings of the IEEE International Conference on Computer Vision (ICCV' 17), pages 2755-2764, 2017.
[16] Shengshan Hu, Yechao Zhang, Xiaogeng Liu, Leo Yu Zhang. Minghui Li. and Hai Jin. Ad- whash: Set-to-set targeted attack on deep hashing with one single adversarial patch. In Proceed- ings of the 29th ACM International Conference on Multimedia (MM'21), pages 2335-2343, 2021.
[17] Yihao Huang, Yue Cao, Tianlin Li, Felix Juefei-Xu, Di Lin, Ivor W Tsang, Yang Liu, and Qing Guo. On the robustness of segment anything. arXiv preprint arXiv:2305. 2023.
[18) Lei Ke, Mingqiao Ye, Martin Danelljan, Yifan Liu, Yu- lu-Wing Tai, Chi-Keung Tang, and Fisher Yu. Segment anything in high quality. In Proceedings of the 47th International Conference on Neural Information Processing Systems (NeurIPS233) 2023.
[19] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloé Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C. Berg. Wan- Yen Lo, Piotr Dollár, and Ross B. Girshick. Segment anything. arXiv preprint orXiv:230.002643, 2023.
[20] Feng Li, Hao Zhang, Peize Sun, Xueyan Zou, Shilong Liu, Jianwei Yang, Chunyuan Li, Lei Zhang, and Jianfeng Gao. Semantic-sane Segment and recognize anything at any granularity. arXiv preprint arXiv:2307.04767. 2023.
[21] Minghui Li, Jiangxiong Wang, Hao Zhang, Ziqi Zhou, Shengshan Hu, and Xiaobing Pei. Transferable adversarial facial images for privacy protection. In Proceedings of the 32nd ACM International Conference on Multimedia (MM'24), 2024.
[22] Yuheng Li, Mingzhe Hu, and Xiaofeng Yang. Polyp-sam: Transfer sam for polyp segmenta- tion. arXiv preprint arXi::2305.00293. 2023.
[23] Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Pro- ceedings of the 12nd European Conference on Computer Vision 14C, pages 740-755, 2014.
[24] Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for se- mantic segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR' 15), pages 3431-3440, 2015.
[25] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: ArXivv/706.000 1706.0608, 2017.
[26] Seyed-Mohsen Moosavi- -eeeaoil,,,,ooi,, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEF/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR' 16), pages 2574-2582, 2016.
[27] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Uni- versal adversarial perturbations. Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR' (oVPR"17),> pages 1765-1773, 2017.
[28] Konda Reddy Mopuri, Utsav Garg, and R Venkatesh Babu. Fast feature fool: A data indepen- dent approach to universal adversarial perturbations. arXiv preprint arXiv: (=Xiv:1707.05572 2017.
[29] Konda Reddy Mopuri, Aditya Ganeshan, and R. Venkatesh Babu. Generalizable data-free ob- jective for crafting universal adversarial perturbations. IEEE Transactions on Pattern Analysis and Machine Intelligence, (111))24452-244 2465, 2018.
[30] Konda Reddy Mopuri, Utkarsh Ojha, Utsav Garg, and R. Venkatesh Babu. Nag: Network for adversary generation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR'18), 18), pages 742-751, 2018
12

---

[31] Konda Reddy Mopuri, Phani Krishna Uppala, and R. Venkatesh Babu. Ask, acquire, and attack: Data-free uap generation using class impressions. In Proceedings the Conference on Computer Vision (ECCV"88, pages 19-34, 2018.
the 15th European
[32] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. A self-supervised approach for adversarial robustness. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition (CVPR 20), pages 262-271, 2020.
[33] Romal Thoppilan, Daniel De Freitas, Jamie Hall, Noam Shazeer, Apoorv Kulshreshtha, Heng-Tze Cheng, Alicia Jin, Taylor Bos, Leslie Baker, Yu Du, YaGuang Li, Hongrae Lee, Huaixiu Steven Zheng, Amin Ghafouri, Marcelo Menegali, Yanping Huang, Maxim Krikun, Dmitry Lepikhin, James Qin, Dehao Chen, Yuanzhong Xu, Zhifeng Chen, Adam Roberts, Maarten Bosma, Yanqi Zhou, Chung-Ching Chang. Igor Krivokon, Will Rusch, Marc Pickett, Kathleen S. Meier-Hellstern, Meredith Ringel Morris, Tulsee Doshi, Renelito Delos Santos, Toju Duke, Johnny Soraker, Ben Zevenbergen, Vinodkumar Prabhakaran, Mark Diaz, Ben Hutchinson, Kristen Olson, Alejandra Molina, Erin Hoffman-John. Josh Lee, Lora Aroyo, Ravi Rajakumar. Alena Butryna, Matthew Lamm, Viktoriya Kuzmina, Joe Fenton, Aaron Cohen, Rachel Bernstein, Ray Kurzweil, Blaise Agüeraa y Arcas, Claire Cui, Marian Croak, Ed H. Chi, and Quoc Le. Lamda: Language models for dialog applications. arXiv preprint htt.:2201.082.33 2022.
[34] Junde Wu, Rao Fu, Huihui Fang, Yuanpei Liu, Zhaowei Wang. Yanwu Xu, Yueming Jin, and Tal Arbel. Medical sam adapter: Adapting segment anything model for medical image seg- mentation. arXiv preprint arXiv:23044. 12620. 2023.
[35] Song Xia, Wenhan Yang. Yi Yu, Xun Lin, Henghui Ding, Lingyu Duan, and Xudong Jiang- Transferable adversarial attacks on sam and its downstream models. In Proceedings of the 38th International Conference on Neural Information Processing Systems (NeurIPS 24), 2024.
[36] Jinyu Yang, Mingqi Gao, Zhe Li, Shang Gao, Fangjing Wang. and Feng Zheng. Track any- thing: Segment anything meets videos. arXiv preprint arXiv:2304.1 11968, 2023.
[37] Chaoning Zhang, Dongshen Han, Yu Qiao, Jung Uk Kim. Sung-Ho Bae, Seungkyu Lee, and Choong Seon Hong. Faster segment anything: Towards lightweight sam for mobile applica- tions. arXiv preprint arXiv:2306. 118006..42200 14289, 2023.
[38] Chaoning Zhang, Yu Qiao, Shehbaz Tariq, Sheng Zheng, Chenshuang Zhang, Chenghao Li, Hyundong Shin, and Choong Seon Hong. Understanding segment anything model: Sam is biased towards texture rather than shape. arXiv preprint arXiv:2311. 11465, 2023.
[39] Chenshuang Zhang. Chaoning Zhang, Taegoo Kang, Donghun Kim, Sung-Ho Ho Bae, and In So Kweon. Attack-sam: Towards evaluating adversarial robustness of segment anything model. arXiv preprint arXiv:2305. 00866, 2023.
[40] Renrui Zhang, Zhengkai Jiang, Ziyu Guo, Shilin Yan, Junting Pan, Hao Dong. Peng Gao, and Hongsheng Li. Personalize segment anything model with one shot. arXiv preprint arXiv: 030488 2023.
[41] Yechao Zhang, Shengshan Hu, Leo Yu Zhang, Junyu Shi, Minghui Li, Xiaogeng Liu, and Hai Jin. Why does little robustness help? further step towards understanding adversarial transferability. In Proceedings of the 45th IEEE Symposium on Security and Privacy (S&P'24), 2024.
[42] Hengshuang Zhao, Jianping Shi, Xiaojuan Qi, Xiaogang Wang, and Jiaya Jia. Pyramid scene parsing network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR' 17), pages 2881-2899 2017.
[43] Bolei Zhou, Hang Zhao, Xavier Puig, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Scene parsing through ade20k dataset. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR' 17), pages 633 641, 2017.
[44] Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advelip: Downstream-agnoste adversarial examples in multimodal contrastive learning. Proceedings of the 31st ACM International Conference on Multinedia (MM'23), pages 1311-6320, 2023.
13

---

[45] Ziqi Zhou, Shengshan Hu, Ruizhi Zhao, Qian Wang, Leo Yu Zhang, Junhui Hou, and Hai Jin. Downstream-agnen adversarial examples. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV233,, pages 4345 4355, 2023.
[46] Ziqi Zhou, Minghui Li, Wei Liu, Shengshan Hu, Yechao Zhang, Wei Wan, Lulu Xue, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Securely fine-tuning pre-tra pre-trained encoders against adversar- ial examples. In Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP'24),
2024.
14

---

Appendix
A Datasets
ADE20K: ADE20K [43] is dataset for scene parsing that includes images from a variety environments. It contains more than 20,000 images, classified into 150 categories, cov- ering both natural landscapes and indoor settings. Each image in ADE20K is pixel-wise annotated, making suitable for scene parsing and semantic segmentation tasks.
MS-COCO: MS-COCO [23] is large-scale dataset for image recognition, segmentation, and image captioning. contains more than 200,000 labeled images, 150,000 validation images, and over 80,000 test images. The dataset includes 80 different object categories and over 250,000 object instances. MS-COCO is known for its detailed annotations for each image, including object segmentation, object detection, and image captioning.
CITYSCAPES; CITYSCAPES [7] is dataset for urban street scenes, primarily used for training and testing vision systems for autonomous driving. It includes street scenes from 50 different cities, with approximately 5,000 finely annotated images. These images include various urban scenarios and range traffic participants.
SA-1B: SA- BA [19] contains 11 million diverse, high-resolution, privacy-protesd images and 1.1 billion high-quality segmentation masks. These masks were automatically gener- ated by SAM. The dataset aims to facilitate computer vision research and is characterized by an average of 100 masks per image.
B Platform
Experiments are conducted on a server running a 64-bit Ubuntu 20.04.1 system with an Intel(R) Xeon(R) Silver 4210R CPU @ 2.40GHz processor, 125GB memory, and two Nvidia GeForce RTX 3090 GPUs, each with 24GB memory. The experiments are performed using the Python language and PyTorch library version 2.0.0.
Benigar- Point
Ad Ad--Poieit Poiest
Figure A1: Qualitative results of the DarkSAM using point prompts SAM-L under point prompts
C Supplementary Attack Performance
C.1 Evaluation on MobileSAM
We evaluate the attack performance of DarkSAM against another SAM's variant model, Mobile- SAM [37], on four datasets. All experimental settings are kept consistent with Sec.4.2. The re- sults in Tab. Al demonstrate the effectiveness of DarkSAM against MobileSAM,, further proving its strong attack capability. Notably, in line with the conclusions in Sec.4.2, the choice of surrogate datasets has certain impact on attack performance. SA-IB serves as a notably superior surro- gate dataset, while CITYSCAPES exhibits comparatively lower performance in certain scenarios. This discrepancy may be attributed CITYSCAPES' limited scope, which solely encompasses the urban street scene, consequently restricting the transferability of the generated UAPs.
15

---

C.2 Evaluation on SAM with VIT-L backbone
We present both quantitative and qualitative results of DarkSAM on SAM with a ViT-L backbone, denoted SAM-L. The quantitative findings in Table A2 illustrate the effectiienesss of DarkSAM in deceiving SAM-L. Notably, these results indicate that SAM-L exhibits greater robustness compared to SAM-B (SAM with a ViT-B backbone) due to its more intricate network architecture. Addition- ally, we offer visualization results of DarkSA.M's attacks on SAM-L under point, box, and segment everything modes. Figs. A1 and A2 demonstrate that adversarial examples generated based point prompts effectively mislead SAM-L. Similarly, adversarial examples crafted using box prompts also prove be successful in deceiving SAM-L, as depicted in Figs. A3 and A4.
Table A1: The mloU (%) of DarkSAM on MobileSAM. Values covered by gray denote the clean mloU, others denote adversarial mloU. ADE20K, MS-COCO, CITYSCAPES abbreviated ADE, COCO, CITY, respectively, Bolded values indicate the best results.
BOX-+BOX
Model
Surrogate
ADE
COCO
CITY
SA-IB
ADE
COCO
CITY
SA-IB
Clean
63.77
63.08
51.13
76.82
72.69
79.15
64.3
89.14
ADE
0.82
2.48
0.47
3.99
0.98
4.99
1.34
6.02
COCO
0.10
0.41
0.03
0.74
1.60
6.38
1.33
8.12
MobileSAM [37]
CITY
16.73
31.85
0.10
41.47
26.81
49.38
0.81
48.74
SA-1B
0.06
0.34
2.3e-6
1.8e-5
4.67
14.89
0.84
3.03
AVG
4.43
8.77
0.15
11.55
8.52
16.48
Benign- All
Adr-All
Figure A2: Qualitative results of the DarkSAM using point prompts on SAM-L under the segment everything mode
Benign Box
Adl- Box
Figure A3: Qualitative results DarkSAM using box prompts on SAM-I. under box prompts
16

---

Bonign-
Ado
Figure A4: Qualitative results DarkSAM using box prompts on SAM-L under segment everything mode
AM5
205
11.03
4511
21
COCO
4:22
31
1:
91/1
9416
7729
21
6410
0111
75.07
62.8
59.9
2534
64
903
OTY
66.8
60.99
6421
00.0
6-.11
Skin
A06
00000
aiv
64/13
<lc
cola
36-1k
AdG
A/a
cola
CITY
(a) POinE-HQ2PER
(b) foint-HQ2SAN
(c) Box- ROX-HQQPER
(d) Box- Box-HQ2SAM
426
D000 APE
4DK
4212
2149
90.99
42.4
38
76
12.11
17.23
41.54
2918
100
72.89
Tc.99
94.15
cIt
$1.9
1502
36.3
CEV
65
+057
4.4
CITY
62.1
2021
6711
1K
M4-18
(c) Point-PER2HQ (f) Pooint-PER2SN
(g) Box Box- PER2HQ
(h) Box- MOX-PER2SAM
Figure A5: The ASR (%) of supplementary transferability study. (a) (d) show cross model transferability study results for UAPs created on HQ-SAM. (e) (h) show the cross model transferability study results for UAPs created on PerSAM. Each row represents the same UAP.
Banign Point
Ado Point
Figure A6: Visualizations of the cross model backbone transferability study. These adversarial examples are
all crafted based SAM-B and tested SAM-L under point prompts. (SAM-B SAM-L)
17

---

Benign Poinx
Ady-
Figure A7: Visualizations of the cross model backbone transferability study. These adversarial examples are all crafted based on SAM-L and tested SAM-B under point prompts. (SAM-L. - SAM-B)
Table A2: The ASR (%) of DarkSAM on SAM-L
Prompt
Surrogate
ADE
COCO
CITY
SA-1B
ADE
43.51
49.03
23.86
43,77
Point
SA-1B
34.87
38.84
42.59
48.03
ADE
49.79
48.69
47.42
43.63
Box
SA-IB
62.56
66.68
51.91
52.29
85
P2P
80
B2B
ASR
70-
65
55
20
30
100
1000 2000
3000
Figure A8: The results (%) of ablation study about random seeds
D Supplementary Transferability Study
In this section, delve deeper into the cross-model transferability of DarkSAM, considering both different model types and diverse model backbones. We maintain uniformity with the experimental settings outlined in Sec. 4.3.
1) Cross model type transferability. We explore the transfcrability of UAPs crafted by DarkSAM on PerSAM and HQ-SAM when attacking other types of models. These models all share the VIT-B backbone. The "Point-" " and "Box- "pex"ieefxxes indicate that the UAPs are crafted and tested under point and box prompts, respectively. The suffixes "HQ2PER" and "HQ2SAM" denote the UAPs crafted on HQ-SAM against PerSAM and SAM, respectively. Similar notations carry the same implications. The results in Fig. AS further demonstrate the robust cross-model type transferability of DarkSAM.
2) Cross model backbone transferability. We investigate the cross-model backbone transferabilitty of DarkSAM. Specifically, we craft UAPs based on the ADE20K dataset on SAM-L and SAM-B, respectively, and test the transferability of these attacks between the two models. From Figs. A6 and A7, can see that adversarial examples crafted SAM-B effectively mislead SAM-L, and
18

---

Bonign
Figure A9: Visualization of the SAM segmentation results of adversarial examples under the multipoint evalu- ation mode
conversely, those crafted on SAM-L deceive SAM-B. These results demonstrate the cross-model backbone transferability of DarkSAM.
E
Supplementary Ablation Study
1) The effect of random seeds. Considering the relationship between random seeds and the selec- tion of images in training and testing, we investigate the effect of random seeds DarkSAM. All our experiments default to random seed setting of 100. illustrated in Fig. A8, we select eight different random seeds and conduct experiments to attack SAM on the ADE20K dataset with these seeds. "P2P" and "B2B" respectively denote the creation and testing of UAPs using point and box prompts. The results in Fig. A8 indicate that DarkSAM consistently exhibits stable and superior attack performance across various random seed settings.
2) The mixed use of point and box prompts in the shadow target strategy. We delve into the effects of employing hybrid approach of points and boxes as prompts in the shadow target strategy for Dar In this method, we craft UAPs using balanced mix of five random points and five boxes. The outcomes, as detailed Tab. A3, reveal that UAPs constructed with this mixed approach maintain robust attack performance. This finding accentuates the adaptability and effectiveness of our proposed shadow target strategy.
3) Multipoint evaluation. We explore the effects of using multiple point prompts during the in- ference phase of SAM the efficacy DarkSAM's attacks. Compared single-point prompts, multipoint prompts offer augmented object positional data, potentially enhancing segmentation ac- curacy. To evaluate this, we generate UAPs on the SA-1B dataset using point prompts and subse- quently test these under multipoint prompts mode. The results, as illustrated in Fig. A9, indicate that for benign examples,
use of multipoint prompts indeed results more accurate segmentation of the target object relative to single- single-point prompts. Conversely, in the case of adversarial examples, the addition of multiple prompts does not aid SAM in achieving successful segmentation, thereby underscoring the powerful effectiveness of DarkSAM in compromising segmentation accuracy.
19

---

Tahle A3: The ASR (%) of DarkSAM using five points and five boxes
POINT & BOX - POINT
POINT & BOX- - BOX
Model
ADE
COCO
CITY
SA-1B
ADE
COCO
CITY
SA-1B
SAM [19]
64,49
61.31
50.74
76.42
73.05
71.87
63.59
86,45
HQ-SAM [18]
62.49
64,43
49.09
72.26
70.65
70.08
57.49
84,28
PerSAM [40]
63.53
62.41
50.01
76.86
70.13
76.54
62.03
85.63
MobileSAM [37]
63.18
62.47
50.88
76.06
70.90
75.61
63.38
85,41
60
60
C-Benign
50
50
mlou
mlou
30
30
B-Denign
B.Ady
20
20
10
10
2
Severity
Severity
(a) Contrast
(b) Brightness
Figure A10: The results (%) of crruption study (a) investigate the result of Contrast, (b)investigate the result of Brightness
Defense
SAM is renowned for its powerful zero-shot capabilities, thus believe appropriate defen- sive measure is to refrain from making additional structural and parametric modifications to the pre-trained SAM to avoid compromising its original knowledge. Therefore, we consider employ- ing input preprocessing methods to counter adversarial examples. We select two famous image corruption methods from the Imagecorruptions repository, contrast (C) and brightness (B), test adversarial examples. Results in Fig. A10 demonstrate that DarkSAM effectively withstands such preprocessing-bast defenses.
20

---

NeurIPS Paper Checklist
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Abstract and Sec.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: See Sec.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [N/A]
Justification: The paper does not involve theory assumptions and proofs.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclu- sions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: See Sec. 4.1.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We have provided the source code in the supplementary material.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: See Sec. 4.1.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropri- ate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We have provided the influence of random seed on the experimental results in Fig. A8.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Ys]]
Justification: See Appendix B.
9. Code Of Ethics
21

---

Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Question:
Answer: [Yes]
Justification: After thorough review of the paper, no violations of the NeurIPS Code of Ethics are found.
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Sec.
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [N/A]
Justification: The paper does not involve safeguards that have been put in place for respon- sible release of data models.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The data used the paper are properly credited, and the license and terms of use are explicitly mentioned and properly respected.
13. New Assets
Question: Are new assets introduced in the paper well documented and the documenta- tion provided alongside the assets?
Answer: [N/A]
Justification: The paper does not release new assets.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsoureing experiments and research with human subjects, does the pa- per include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [N/A]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper deseribe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [N/A]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
22


Reviews:
[{"review_id": "OotHbxbXcg", "reviewer": "Reviewer_YLRY", "summary": "This paper introduces DarkSAM, a universal adversarial attack against the Segment Anything Model and its variants. DarkSAM aims to prevent these models from successfully segmenting objects within images. The experimental results demonstrate the effectiveness and transferability of the proposed method.\n\n\nI have read the response of the authors and comments of other reviewers, I decide to keep my weak accept score.", "questions": "See Weaknesses", "limitations": "The authors adequately addressed the limitations and potential negative societal impact of their work.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.This paper introduces a new universal adversarial attack framework for prompt-guided image segmentation models.\n2.The combination of spatial and frequency domain attacks is a sophisticated approach that demonstrates a good understanding of SAM.\n3.This paper is well-written. Following the introduction, I can easily understand the goal of this paper.", "weaknesses": "1.The related work can be improved. This paper could benefit from an expanded discussion on adversarial attacks targeted at traditional segmentation models.\n2.Lack of specific explanation. This method is novel and interesting but I’m curious about the reason why it works. What is the exact process for determining random prompts, and does this method ensure coverage of all potential attack targets?\n3.The experimental results lack error bars. Repeating the experiments a few times and reporting the results with error bars would make the findings more convincing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Responses to Reviewer YLRY #\n\n------\n\n**Q1**: The related work can be improved. This paper could benefit from an expanded discussion on adversarial attacks targeted at traditional segmentation models. \n\n**A1**: Thank you for the constructive feedback! We will include a more comprehensive discussion on adversarial attacks targeting traditional segmentation models in the revised version.\n\n------\n\n**Q2**: Lack of specific explanation. This method is novel and interesting but I’m curious about the reason why it works. What is the exact process for determining random prompts, and does this method ensure coverage of all potential attack targets? \n\n**A2**:  We have outlined the process of the shadow target strategy in Fig. 2 of the manuscript. For each image, we randomly generate *k* prompts, obtain the outputs from SAM for each, and then merge these results into a \"Blueprint\" to be used as the attack target (Line 138). The goal of this strategy is not to ensure coverage of all potential attack targets, but rather to maximize the creation of shadow targets for generating UAPs. We are willing to refine the relevant statements in the revised version.\n\n------\n\n**Q3**: The experimental results lack error bars. Repeating the experiments a few times and reporting the results with error bars would make the findings more convincing.\n\n**A3**: Thank you for the valuable suggestions. We test the attack performance of the proposed method on SAM using three different random seeds across four datasets. The experimental setup is consistent with that described in Sec. 4.2 of the manuscript. The results in Tab. R1 demonstrate that our method consistently exhibits robust attack performance.\n\nTable R1: The mIoU (%) of DarkSAM under different settings\n| Prompt | Surrogate | ADE          | COCO         | CITY         | SA-1B        |\n| ------ | ------- | ------------ | ------------ | ------------ | ------------ |\n| Point  | Clean   | 65.07 ± 0.25 | 63.04 ± 0.14 | 50.43 ± 0.24 | 77.18 ± 0.05 |\n|        | ADE     | 0.73 ± 0.33  | 2.91 ± 0.58  | 1.03 ± 0.64  | 4.50 ± 1.37  |\n|        | COCO    | 0.16 ± 0.13  | 0.41 ± 0.38  | 0.27 ± 0.25  | 0.93 ± 0.77  |\n|        | CITY    | 7.64 ± 1.95  | 0.13 ± 0.06  | 16.02 ± 3.57 | 11.68 ± 5.32 |\n|        | SA-1B   | 0.60 ± 0.41  | 0.01 ± 0.01  | 2.18 ± 1.66  | 0.08 ± 0.03  |\n| Box    | Clean   | 74.49 ± 0.24 | 79.10 ± 0.08 | 64.84 ± 0.41 | 89.24 ± 0.09 |\n|        | ADE     | 6.57 ± 0.90  | 13.27 ± 1.35 | 1.98 ± 0.21  | 19.19 ± 2.21 |\n|        | COCO    | 1.68 ± 0.47  | 3.21 ± 0.49  | 2.11 ± 0.82  | 9.44 ± 1.26  |\n|        | CITY    | 20.35 ± 5.76 | 29.15 ± 7.64 | 0.78 ± 0.53  | 23.32 ± 6.56 |\n|        | SA-1B   | 12.20 ± 3.20 | 22.40 ± 4.62 | 4.31 ± 2.45  | 5.56 ± 0.95  |\n|", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KByQGoUT2L", "reviewer": "Reviewer_dgw7", "summary": "This work investigates adversarial attacks against Segment Anything Models (SAMs) and presents DarkSAM, the first universal adversarial attack designed for these models. DarkSAM leverages a single perturbation to effectively undermine SAM’s object segmentation capabilities across a variety of images and prompts. The authors conduct a comprehensive evaluation of DarkSAM across four datasets and three SAM variants (SAM, HQ-SAM, and PerSAM), covering attack performance, transferability, comparative analysis, and ablation studies.", "questions": "1.\tI agree with the authors' prompt-free approach to the attack on SAM. I am curious about the types of prompts that may be more advantageous in crafting effective UAPs during the attack generation process. Additionally, could the authors provide an explanation regarding the selection of prompts?", "limitations": "1.\tThe paper relies on heuristic research and lacks a corresponding theoretical framework for analysis.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tThe paper introduces a unique perspective on adversarial attacks for prompt-guided segmentation models, which is a relatively unexplored area in the literature. The proposed DarkSAM method is innovative in its approach to decoupling object features for attack optimization.\n2.\tThe research question is well-defined, and the authors thoroughly compare DarkSAM with a multitude of established baselines.\n3.\tThe paper presents both qualitative and quantitative results, effectively demonstrating the impact of DarkSAM. These results provide a thorough assessment of its performance across various conditions", "weaknesses": "1.\tIt is recommended that the authors further supplement the experimental section with relevant analyses, such as explaining why the spatial domain attack is more critical than the frequency domain attack within the proposed framework.\n2.\tIn this paper, the usage of mIoU and ASR appears to be analogous, with both metrics conveying the same information. Could the authors provide insight into the justification for employing both metrics concurrently?\n3.\tIn Figure 7, the visualization of segmentation masks is notably dark, impeding discernibility for the reader. The authors should consider increasing the brightness of these images or employing more vivid colors.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Responses to Reviewer dgw7 #\n\n------\n\n**Q1**: It is recommended that the authors further supplement the experimental section with relevant analyses, such as explaining why the spatial domain attack is more critical than the frequency domain attack within the proposed framework.\n\n**A1**:  Thanks for the constructive suggestion! As observed in Fig. 6(a) of the manuscript, we can see that the spatial domain attack is more critical than the frequency domain attack within the proposed framework. This may be attributed to SAM’s reliance on pixel information in the spatial domain rather than frequency information in the frequency domain during object segmentation. We will include a detailed description of this analysis in the ablation study section of the revised version.\n\n------\n\n**Q2**: In this paper, the usage of mIoU and ASR appears to be analogous, with both metrics conveying the same information. Could the authors provide insight into the justification for employing both metrics concurrently?\n\n**A2**: We use both mIoU and ASR to evaluate attack performance In this paper. Lower mIoU values and higher ASR indicate stronger attack effectiveness. On one hand, we use mIoU to *quantitatively* and intuitively demonstrate the model's robustness against the proposed method. On the other hand, we employ the *visualization-friendly* ASR to further and comprehensively showcase the superior performance of the proposed approach. These two metrics Together offer a well-rounded assessment of the attack's impact.\n\n------\n\n**Q3**:  In Figure 7, the visualization of segmentation masks is notably dark, impeding discernibility for the reader. The authors should consider increasing the brightness of these images or employing more vivid colors.\n\n**A3**: Thanks for your valuable feedback! We will enhance the visualization of the segmentation masks to make them more visually appealing in the revised version.\n\n------\n\n**Q4**: I agree with the authors' prompt-free approach to the attack on SAM. I am curious about the types of prompts that may be more advantageous in crafting effective UAPs during the attack generation process. Additionally, could the authors provide an explanation regarding the selection of prompts?\n\n**A4**: What a valuable question! In the manuscript, we provide an evaluation of the attack performance of UAPs created using point and box prompts on SAM across three segmentation modes (see Tabs 1, 2, and Fig. 5). The results in Tab. 1 and Fig. 5 show that the attack performance using point prompts does not differ significantly from that using box prompts. However, Tab. 2 indicates that UAPs created with box prompts exhibit better transferability, which may be due to the additional information they provide (Line 255 - Line 260).\n\n------\n\n**Q5**: The paper relies on heuristic research and lacks a corresponding theoretical framework for analysis.\n\n**A5**: We acknowledge that the paper primarily relies on heuristic research and does not provide a complete theoretical framework. Our intent is to explore and validate new approaches for assessing the robustness of SAM and its variants through heuristic methods (see Sec. 3.2), which lays the groundwork for future theoretical modeling. We will include a discussion of these limitations in the \"Conclusions, Limitations, and Broader Impact\" section. In future work, we plan to further develop and refine the theoretical framework to systematically analyze our findings.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VFmLx5UgF6", "reviewer": "Reviewer_pM4H", "summary": "This paper introduces DarkSAM, a prompt-free universal attack framework against the Segment Anything Model (SAM) in a quasi-black-box setting. The framework consists of a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. While SAM uses geometric prompt inputs to guide segmentation of critical objects within images, DarkSAM disrupts these processes by decoupling the object features of images in both spatial and frequency domains using a universal adversarial perturbation (UAP). In the spatial domain, it scrambles SAM’s decisions by destroying the features of the foreground and background of the image separately. In the frequency domain, it decomposes images into high-frequency components (HFC) and low-frequency components (LFC), increasing the dissimilarity in the HFC of adversarial and benign examples while maintaining consistency in their LFC. Experiments are conducted on four public segmentation datasets (ADE20K, MS-COCO, CITYSCAPES, and SA-1B), with 100 images used for UAP generation and 2,000 images for testing for each dataset. Victim models include the pre-trained SAM, HQ-SAM, and PerSAM with the ViT-B backbone.", "questions": "1. How does DarkSAM perform with variants of the SAM models?\n2. Please include a comparison with [1] \"Practical Region-level Attack against Segment Anything Models\" (CVPR 2024).", "limitations": "The paper presents a limitation that DarkSAM is tailored to SAM and cannot operate on traditional segmentation models.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written and easy to follow.\n2. The specific design of the shadow target strategy is tailored to SAM for prompt-based segmentation, which is unique compared to adversary attacks against traditional segmentation pipelines.\n3. The attacking results are impressive. All three models show very low segmentation performance across multiple datasets.", "weaknesses": "SAM is a milestone work, and a series of follow-up studies have been proposed recently. However, this paper does not provide an up-to-date review in Section 2.1 and lacks comparison in Section 4, weakening its significance. For example:\n- SAM-based adversary attack:\n[1] Practical Region-level Attack against Segment Anything Models, CVPR 2024.\n- Other SAM-based models:  \n[2] From SAM to CAMs: Exploring Segment Anything Model for Weakly Supervised Semantic Segmentation, CVPR 2024.  \n[3] RobustSAM: Segment Anything Robustly on Degraded Images, CVPR 2024.  \n[4] Matching Anything by Segmenting Anything, CVPR 2024.  \n[5] FocSAM: Delving Deeply into Focused Objects in Segmenting Anything, CVPR 2024.  \n[6] ASAM: Boosting Segment Anything Model with Adversarial Tuning, CVPR 2024.  \n[7] BA-SAM: Scalable Bias-Mode Attention Mask for Segment Anything Model, CVPR 2024.  \n[8] Open-Vocabulary SAM: Segment and Recognize Twenty-thousand Classes Interactively, ECCV 2024.  \n[9] CAT-SAM: Conditional Tuning Network for Few-Shot Adaptation of Segmentation Anything Model, ECCV 2024.  \n[10] Semantic-SAM: Segment and Recognize Anything at Any Granularity, ECCV 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Responses to Reviewer pM4H #\n\n------\n\n**Q1**: SAM is a milestone work, and a series of follow-up studies have been proposed recently. However, this paper does not provide an up-to-date review in Section 2.1 and lacks comparison in Section 4, weakening its significance. \n\n**A1**: Thanks for your professional suggestions! We acknowledge that the ten papers provided by the reviewer pM4H are all latest papers from CVPR 2024 (conference dates: June 17-21, 2024) or ECCV 2024 (conference dates: September 29-October 4, 2024), and are therefore contemporaneous with our work. Since **these papers were not officially published** before the NeurIPS 2024 manuscript submission deadline (May 23, 2024), we did not include them in our submission. We are happy to include a discussion and comparison with these recent works in the revised version.\n\n------\n\n**Q2**: How does DarkSAM perform with variants of the SAM models?\n\n**A2**: We have already evaluated the attack effectiveness of DarkSAM on four different SAM models across four datasets, including SAM [1], HQ-SAM [2], PerSAM [3], and MobileSAM [4] (see Tab. A1 in the Appendix). This is sufficient to demonstrate the effectiveness of our proposed method. Due to time constraints, we select the representative ASAM [5] provided by reviewer pM4H for further testing on four datasets, with results provided in Table R2. The experimental setup is consistent with that described in Sec. 4.2 of the manuscript. These experimental results further demonstrate the high effectiveness of our method against SAM and its variants.\n\nTable R2: The mIoU (%) of DarkSAM on ASAM\n\n| Prompt | Surrogate | ADE   | COCO  | CITY  | SA-1B |\n| ------ | --------- | ----- | ----- | ----- | ----- |\n| Point  | Clean     | 63.57 | 59.73 | 49.07 | 75.17 |\n|        | ADE       | 1.16  | 2.92  | 0.69  | 6.01  |\n|        | COCO      | 1.20  | 2.04  | 1.60  | 4.20  |\n|        | CITY      | 8.97  | 12.07 | 0.17  | 10.90 |\n|        | SA-1B     | 3.17  | 5.43  | 1.21  | 3.04  |\n| Box    | Clean     | 76.28 | 81.26 | 63.91 | 89.13 |\n|        | ADE       | 1.94  | 3.05  | 1.67  | 12.16 |\n|        | COCO      | 1.17  | 2.00  | 0.90  | 3.90  |\n|        | CITY      | 14.41 | 20.36 | 0.39  | 22.24 |\n|        | SA-1B     | 3.02  | 5.33  | 0.76  | 2.79  |\n\n------\n\n**Q3**: Please include a comparison with \"Practical Region-level Attack against Segment Anything Models\" (CVPR 2024)\n\n**A3**:   As mentioned in A1, [6] is a contemporaneous study that also explores adversarial attacks against SAM. However, it was not officially published before we submitted our manuscript to NeurIPS 2024. **The study differs from our work in two significant aspects: the attack objective and the attack method.**\n\n1) **Local vs. Global**: In terms of the attack objective, [6] proposes a region-level attack aimed at concealing objects within a specific attacker-designated region, preventing SAM from segmenting them. In contrast, DarkSAM seeks to completely disable SAM, rendering it unable to segment any object in the input image, regardless of the type of prompt used.\n2) **Sample-wise vs. Universal**: In terms of the attack method, [6] requires generating sample-specific noise for each image to deceive SAM. In contrast, our approach only requires a single universal adversarial perturbation (UAP) to fool SAM across a range of images, which is a more challenging task.\n\nDue to these significant differences, a direct comparison between [6] and our proposed method is not feasible. To facilitate a fair comparison, one potential approach would be to adapt the method from [6] into a universal adversarial attack format. Unfortunately, [6] does not provide official code, making it difficult to implement and compare their method during the rebuttal period. Although we reached out to the authors immediately upon receiving the review comments, we have not yet received a response. We are willing to include a discussion and comparison with [6] in the revised version.\n\nAdditionally, compared to [6], we assess the effectiveness of DarkSAM across a range of experimental conditions, including box prompts (see Tabs. 1-3, A1-A3; Figs. 5, A3, A9, and A10), the segment-everything mode (see Figs. 5, A2, A4, A9, and A10), and multi-point prompts (see Fig. A8). Our extensive and comprehensive experimental results are sufficient to demonstrate the effectiveness and superiority of our method.\n\n**Reference**\n\n[1] Segment Anything,  ICCV 2023.\n\n[2] Segment Anything in High Quality, NeurIPS 2023.\n\n[3] Personalize Segment Anything Model with One Shot, ICLR 2024.\n\n[4] Faster Segment Anything: Towards Lightweight SAM for Mobile Applications, Arxiv 2023.\n\n[5] ASAM: Boosting Segment Anything Model with Adversarial Tuning, CVPR 2024.\n\n[6] Practical Region-level Attack against Segment Anything Models, CVPR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This work was accepted by all three reviewers (Reviewer YLRY, Reviewer dgw7, Reviewer pM4H). The authors’ rebuttal responses have addressed many of the reviewers’ concerns. I am inclined to accept this work based on technical contribution and strong experimental evaluation.
Decision: Accept (poster)