Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2
Authors: Ziqi Zhou
Yifan Hu
Yufei Song
Zijing Li
Shengshan Hu
Leo Yu Zhang
Dezhong Yao
Long Zheng
Hai Jin
Venue: NeurIPS 2025 spotlight ()
Keywords: Universal Adversarial Attack
SAM2
Video Segmentation
Primary area: applications

Abstract: Recent studies reveal the vulnerability of the image segmentation foundation model SAM to adversarial examples. Its successor, SAM2, has attracted significant attention due to its strong generalization capability in video segmentation. However, its robustness remains unexplored, and it is unclear whether existing attacks on SAM can be directly transferred to SAM2. In this paper, we first analyze the performance gap of existing attacks between SAM and SAM2 and highlight two key challenges arising from their architectural differences: directional guidance from the prompt and semantic entanglement across consecutive frames. To address these issues, we propose UAP-SAM2, the first cross-prompt universal adversarial attack against SAM2 driven by dual semantic deviation. For cross-prompt transferability, we begin by designing a target-scanning strategy that divides each frame into k regions, each randomly assigned a prompt, to reduce prompt dependency during optimization. For effectiveness, we design a dual semantic deviation framework that optimizes a UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames.
Extensive experiments on six datasets across two segmentation tasks demonstrate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms state-of-the-art (SOTA) attacks by a large margin.

Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2
Ziqi Zhou 1,2,3 12.3. Yifan Hu 1.2,4,55 Yufei Song', Zijing Li Shengshan Hu Hu,,2,45f
Leo Yu Zhang Dezhong Yao Long Zhengl.2.3. Hai Jin 1.23+
National Engineering Research Center for Big Data Technology and System
2 Services Computing Technology and System Lab Cluster and Grid Computing Lab
Hubei Engineering Research Center on Big Data Security
5 Hubei Key Laboratory of Distributed System Security
School of Computer Science and Technology, Huazhong University of Science and Technology
School of Cyber Science and Engincering, Huazhong University of Science and Technology
School of Software Engineering, Huazhong University of Science and Technology 8 School of Information and Communication Technology, Griffith University (zhouziqi, hyf1009, hyho00, yyff100,,.fei11,,, 17, lizzij j ing, hushengshan, dyao 1ongzh,, bjinnohusttteeeeeee cn leo. zhangggriffite edu.
Abstract
Recent studies reveal the vulnerability of the image segmentation foundation model SAM to adversarial examples. Its successor, SAM2, has attracted significant attention due to strong generalization capability in video segmentation. However, its robustness remains unexplored, and it is unclear whether existing attacks on SAM can directly transferred to SAM2. In this paper, we first analyze the performance gap of existing attacks between SAM and SAM2 and highlight two key challenges arising from their architectural differences: directional guidance from the prompt and semantic entanglement across consecutive frames. To address these issues, we propose UAP-SAM2, the first cross-prompl universal adversarial attack against SAM2 driven by dual semantic deviation. For cross-prompt transferability. we begin by designing a target-scanning strategy that divides each frame into k regions, each randomly assigned prompt, to reduce prompt dependency during optimization. For effectiveness, we design a dual semantic deviation framework that optimizes UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames. Extensive experiments on six datasets across two segmentation tasks demonstrate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms state-af-the-art (SOTA) attacks by a large margin. Our codes are available at: https / thub. Coom/CCL--ae codes codes/UAP-SAAS
1 Introduction
Recent advances in deep learning have led to the emergence of large segmentation foundation models [4, 16, 33, 40, 43] with impressive generalization capabilities, enabling object segmentation from unseen images. Among them, Segment Anything Model (SAM) [4] can output a class-free mask by leveraging prompts (e.g., points or boxes) to accurately localize target objects. Despite its strong segmentation ability, SAM is limited to images. Therefore, SAM2 [28] is recently proposed to integrate a memory mechanism to store features of previous frames, extending SAM to general- purpose video segmentation. Given prompt (typically on the first frame), SAM2 can continuously track and segment the target object across subsequent frames [11, 32, 49].
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

90
90
YouTubbe
YouTube
80
N0
MOSE
MOSE
70
70
60
60
500
50
40
40
30
30
20
20
10
10
Renign
PGD
A-SAM
S-RA
TAA
DurKSAM
Renign
PGD
A-SAM
S-RA
TAD
DurKAAM
(a) SAM
(b) SAM2
Figure 1: An empirical study the transferability of existing SAM attacks to SAM2
Deep neural networks (DNNs) are known to be vulnerable to adversarial examples [34, 35, 46], where imperceptible perturbations lead to incorrect predictions. Recent studies show that such perturbations can significantly impair the ability of the SAM to segment target objects. Attack-SAM [42] applies PGD [23] to generate sample-wise perturbations for each image. DarkSAM [48] introduces a spatial- frequency universal attack framework, crafting universal adversarial perturbations (UAPs) [30, 44, 45] that generalize across diverse images. Given the prompt sensitivity of SAM-based models, recent works [14, 21, 48] also design adversarial examples with cross prompt transfcrability. However, despite their effectiveness on SAM, the robustness of SAM2 against these attacks remains unexplored.
Motivated by existing video attacks [36, 37], we investigate whether existing attacks designed for SAM can be directly transferred to SAM2. We evaluate several representative methods, includ- ing PGD [23]. Attack-SAM [42] (A-SAM), S-RA [29]. UAD [22], and DarkSAM [48] on the YouTube [41] and MOSE [6] datasets with 10/255. As shown in Fig. 1, existing attacks effec- tively fool SAM but fail to deceive SAM2. For example, DarkSAM reduces the average segmentation performance of SAM by 98.25 25% relative to its original performance on two datasets, while causing only a 22.26% drop in SAM2. These results highlight the difficulty of directly transferring attacks from SAM to SAM2.
Given the shared design philosophy between SAM and SAM2, we conduct a comprehensive analysis to uncover the underlying causes of their performance gap Sec. 3.1. To achieve consistent and accurate segmentation across frames, SAM2 stores the user- srovvird prompt as a persistent, video- specific representation. It also maintains a memory bank that caches semantic features from some of the previous frames. During inference, SAM2 jointly leverages the prompt and memory bank to guide the segmentation of each frame, repeating this process throughout the sequence. Our findings in Sec. 3.1 highlight two key factors behind the failure of existing attacks: (1) directional guidance from the prompt, and (2) semuntic entanglement across consecutive frames. To effectively attack SAM2, establish two key objectives. First, the perturbation must generalize across diverse prompts to maintain attack effectiveness. Second, since videos contain numerous frames, we aim to craft a UAP rather than sample wise perturbations that applies any frame across different videos.
In this paper, we propose UAP-SAM2, the first cross-prompl universal adversarial attack against SAM2 driven by dual semantic deviation. It generates a UAP that generalizes across videos, frames, and prompts. effectively preventing SAM2 from segmenting target objects, making them vanish into thin air. For the first objective, we begin by designing target-scanning strategy that divides each frame into m regions, each randomly assigned prompt, to reduce prompt dependency during optimization. Moreover, instead of directly attacking the prompt-dependent masks, we disrupt the semantic features produced by the image encoder to improve the cross- pross-prompp transferability. For the second objective, we design dual semantic deviation framework that optimizes UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames. Specifically, we design semantic confusion attack to hinder SAM2's s understanding of target objects by injecting noise into the semantic space, a feature shift attack to maximize the semantic distance between adversarial and benign frames, and a memory misalignment attack to amplify inter-frame frame semantic inconsistency by breaking temporal alignment.
We conduct comprehensive evaluation of UAP-SAM2 and its sample-wise variant UAP-SAM2* across six datasets spanning both video and image segmentation tasks. The comparative experiments demonstrate that our approach significantly outperforms SOTA attacks against SAM2. Additionally,

---

defense experiments further validate the robustness of our proposed method. Our main contributions are summarized as follows:
We propose the first cross prompt universal adversarial attack against SAM2, revealing the vulnerability of video segmentation foundation models. By designing a UAP, our method consistently misleads SAM2's s segmentation across videos, frames, and prompts.
We design a brand-new dual semantic deviation framework that optimizes a UAP by distort- ing the semanties within the current frame and disrupting the semantic consistency across consecutive frames.
We conduct extensive experiments on six datasets across two segmentation tasks to demon- strate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms SOTA attacks by a large margin.
Preliminaries
Given input sequence of frames x= {x and prompts P {p: the SAM2 fo(-) predicts segmentation masks y = {ys V for each frame Z;. For a frame 24. pixel at coordinates (m, n),, denoted as æ,th, is considered part of the masked region if its corresponding mask value y, exceeds predefined threshold of zero. SAM2 consists of an image encoder Eing that encodes each frame r; into a feature embedding F. = Eig (xt); a prompt encoder Eprompt processes the input prompt p; and produces the corresponding embedding Qi Eprompi (p:): memory bank M, stores the past K embeddings E; preceding frame F;, A memory attention module A integrates F;, M,, and Qi to generate enhanced representation. Finally, mask decoder D takes this representation and predicts the segmentation mask y:. We can simplify the above process as follows:
y = fe(XX
Following [42, 48], we assume that attackers are able to obtain the open-source SAM2 and can collect publicly available datasets from the Internet to make adversarial examples. The attackers' objective is to craft an adversarial perturbation 8 for each frame that prevents SAM2 from accurately segmenting target objects across different prompts, i.e., cross-promp universal adversarial attack. Furthermore, 5 should be sufficiently small and constrained by the Ip norm the predefined perturbation magnitude
Next, we formally define this type of attack.
Definition 2.1 (Cross-prompt universal adversarial attacks for SAM2). For an input sequence of frames X. we generate a UAP ó for each frame x; E X to shift its predicted mask away from its ground truth yi under different prompt P. This problem can be formulated as:
min E [Vps E P, [fo(f + 5. 8.p.).
s.t. 10 Se
(2)
In this paper, we evaluate UAP-SAM2 on both video and image segmentation tasks, with a primary focus UAPs. For fair comparison with existing work, we also adapt proposed approach into sample-wise form UAP-SAM2" without modifying the loss function.
Methodology
3.1 Observation and Design Philosophy
Motivated by the significant performance gap between SAM and SAM2 under existing attacks shown in Fig. 1, we investigate the underlying causes by examining their architectural differencee. We then hope to design an effective UAP for the emerging SAM2 based on our findings.
The first design difference lies in the prompting strategy. Unlike SAM, which provides a sample-level prompt for each frame, SAM2 offers only an initial prompt on the first frame, which is then stored and reused for segmenting subsequent frames. Existing video attacks [37] show that image-level perturbations can transfer to video, natural idea is to attack only the first frame and examine the effect on later frames. We apply DarkSAM as a one-shot attack to the first frame in the YouTube dataset evaluate effectiveness against SAM2. After generating ad adversarial perturbations on the first frame, add them to all
Observation I: First-frame attacks fail to transfer to later frames.
3

---

Artack the loth frame
Benign
Resalt
Memory
10
255
Frane
Pranr A-2
Frome i.!
Prons (Aby)
Attack the previous consecative frames
Resalt
255
Memory
Fosture
255
Frame & (Ady)
Frome 1-2 (Ads)
Frane A-d (Abb)
Frame A Lides
Framel
Frame 1-1
Frame &
(b)
Figure Visualization results of robustness analysis experiments highlighting the architectural differences between SAM2 and SAM. The pentagram denotes the point prompt on the first frame.
subsequent frames and assess the attack's impact. We gradually increase the perturbation budget from 10/255 to 22/255 to investigate the impact of attack strength. As depieted in Fig. 2 (a), the highest budget 32/ 225, DarkSAM still fails to significantly degrade segmentation performance. This may be attributed directional guidance from the promp! and the enhanced robustness SAM2, likely due to its advanced architecture and diverse training data. Moreover, perturbations that fail to disrupt the first frame typically cannot be effectively transferred subsequent frames.
Insight I. Although attacking the first frame can somewhat mislead SAM2 across the video sequence, its effectiveness is limited. This motivates to investigate other design differences to improve attack efficacy.
Observation I: Joint modeling of past and current frames hinders frame-specific attacks. According to [28], besides using a fixed prompt from the first frame, SAM2 maintains a mem- ory bank that stores semantic features from the past & frames. A memory attention mod- ule integrates these features to guide the segmentation of the current frame. We refer to dual-guidance mechanism.
this of both historical context and current-frame features To evaluate its impact, we inject adversarial noise into a randomly selected middle frame from the YouTube dataset. We then visualize the features extracted by the image encoder from preceding frames and stored in the memory bank. As illustrated in the 1st and 2nd rows of Fig. 2 (b), attacking single frame alone does not significantly de- grade SAM2's segmentation accuracy due semantic entanglement across consecutive frames. However, the 3rd and 4th rows show that perturbing features from past frames disrupt the memory bank noticeably impairs segmentation performance on the current frame. To probe the vulnerability of this guidaneee mechanism, we ex- amine two complementary perspectives: semantic misalignment in the current frame and semantic discontinuity across adjacent.frmess. We segment each frame by thresholding the output masks into foreground and background. We focus on forcing SAM2 to misinterpret foreground objects as background while simultaneously enhancing background saliency to confuse the current-frand framme features. Fig. 2 already suggests that single- frame attacks are insufficient due to the memory module's s influence. We therefore extend the attack by injecting UAP across consecutive frames to amplify mnter-frame semantic gaps. From Fig. 3, this results in progressive decline in similarity between the current frame and both adjacent frames and the first frame. We refer this finding the avalanche effect phenomenon.
1.0
0.9
Adjac
0.8
0.7
0.6
0.5
0.4
Figure 3: Avalanche effect
Insight II. Attacking only single frame is ineffective in the presence of memory-based guidance. Instead, disrupting both the current semantics and temporal consistency across frames creates stronger mismatch between guidance and segmentation, undermining SAM2's 's understanding of video content.

---

Memory Misalignment
Looast
cos8
cose, + 2ost)
Meroo
Faded
Memorry Bank
Mask
Vision Encoder
Attention
Memory
Decoder
History frames
Prompt
Encodler
Foroground Erasure
Current frames
Alteck Heratel
Background Enhance
Add Pedutttttion
Vision Encoder
Arats
Allsck Nerale
J
Feature Shift
Semantic Confusion
Figure The framework of UAP-SAM2
3.2 UAP-SAM2: A Complete Illustration
Based on the design philosophy outlined in Sec. 3.1, we construct our attack from two perspectives: (i) semantic distortion within the current frame and (ii) semantic discontinuity across consecutive frames. For the current frame, we enhance attack effectiveness by jointly introducing semantic confusion and feature shift. To reduce our method's reliance on specific prompt, we design a target-scanning strategy that selects random prompts during optimization. Specifically, we divide each video frame evenly into m regions and randomly generate one prompt per region. Moreover, our optimization primarily targets output features of the image encoder, whose input only the image.
In this section, we present UAP-SAM2, a novel cross-prompt universal adversarial attack driven by dual semantic deviation against SAM2. As depicted the in Fig. 4, the UAP-SAM2 pipeline implements a memory misliggemilll attack Jma to disrupt temporal guidance, a feature shift attack Jja to distort local representations, and semantic confusion attack J.a confuse object-level semantics. The overall optimization objective of UAP-SAM2 is as follow:
Trotal Jee Jja Ima
Semantic confusion attack. We apply a binary mask m to separate the object from the background in each frame. Similar to prior attacks [48] on SAM, we aim to mislead the model by optimizing the foreground region to resemble the background. Meanwhile, the decision boundary toward the background class, while reinforcing pixels originally identified as background to preserve their classification. By adding the UAP the target frame 2i we obtain the adversarial frame ã. This objective can be formalized as:
further shift foreground pixels near
N
(1oo(T, - -- + [((1 - So P)) m_ - Jnm = N Σ E
where y- is mask that matches the frame shape, containing threshold values (e.g.-1 1) in regions corresponding to the target objects, and 0 elsewhere. m represents a binary mask for the background regions in each frame, which the opposite of the mask that highlights the foreground.
To further effectively confuse the foreground and background, we use the hinary cross-entropy (BCE) loss function, treating logits close to zero as having low confidence in the model's classification.
5

---

In contrast, the larger the absolute value of the logits (whether positive negative), the higher the model's confidence its prediction. To enhance the attack's effectiveness, increase the overall confidence of pixel positions, naturally strengthening the updates on pixels near the decision boundary (i.e., logits close to 0), thereby pushing their logits toward the background and achieving stronger confusion effect. Accordingly, we define the semantic confusion attack Jea as follow:
NV BCE (T -- BCE ((1 fo(ā,, P)) m-,
Is =
(5)
Feature shift attack. We optimize the UAP to minimize the similarity between the features of the perturbed and benign frames extracted by SAM2's image encoder. We formalize this as:
N Σ
Jfa =
cos (Eimg (T;) (img (Ii)))
(6)
N
To further increase the feature discrepancy between adversarial and benign framess adopt contrastive learning [2] approach. We first apply times random augmentations T(-) to the target frame and aggregate their features into prototype through 6; P Σ5= Emgg (T(:))) We then treat the adversarial frame ē; and the prototype e; of the original frame negative pair, while randomly sampling frames from other videos as positive pairs. By maximizing the distance between the 7; and e and minimizing the distance among positive samples, effectively drive the adversarial features away from their original semantics. Therefore, we can obtain Jja:
exp (cos (Eing (i:) e,)) ex))/T)
Jsa
Σ log
N
1 kyti exp (cos (Eimg (i:); Emng (x++)) /T)
where Lazi is an indicator function and T denotes a temperature parameter.
Memory misalignment attack. Starting from the second frame, we disrupt the memory bank SAM2 by maximizing the feature discrepancy between consecutive adversarial frames. By progressively increasing the semantic difference between the current adversarial frame and the previous one, we induce the avalanche effect illustrated in Fig. 3. This process is formulated as:
Jma
Σ
cos (Eing (ā1+1); (ā)))
(8)
Experiments
4.1 Experimental Setup
Datasets and models. We evaluate our attack on there public video segmentation datasets: YouTube- VOS2018 (YouTube) [8], DAVIS 2017 (DAVIS) [26], and MOSE [6] for video segmentation tasks. To further investigate the performance of UAP-SAM2 on image segmentation tasks, we construct corresponding image-based datasets by randomly sampling frames from the original video datasets, denoted as YouTube" DAVIS" and MOSE".. We resize all frames in the videos to a uniform size of 011022xx024 We use pre-trained SAM2-T, SAM2-S, and SAM2.1-T from the official repository as the target models. To further validate the transferabilityy we will conduct evaluations on Sam2long [7], which enhances the capabilities of SAM2 in long-video tasks. More details are in Appendix-B.
A Attack settings. We set the perturbation bound e of the universal adversarial attack UAP-SAM2 to 10 02255, and that of the sample-wise variant attack UAP- UAP-SAM2 8/255, using batch size of and training for 10 epochs. We use fixed random seed of 30 for all experiments to ensure reproducibility. We point prompts for the default evaluation.
Evaluation metrics. Following [42, 48), we use the mean Intersection over Union (mloU) metric to evaluate the effectiveness of UAP-SAM2. mloU is a widely used metric in segmentation tasks [4, 24, 28] that measures the average overlap between the predicted and ground truth segmentation masks. lower mIoU value indicates better attack performance.

---

Table 1: mloU (%) results of adversarial examples under different settings
Video segmentation
Image segmentation
Setting
Point
Box
Point
Box
M1
M2
M2
M1
MM
M
M1
M22
Maa
M1
MM2
Ma
D
37.03
36.26
42.47
45.17
28.39
41.06
27.54
28.36
21.89
52.07
27.19
42.36
D2
42.47
40.85
52.08
49.03
38.28
48.47
48.45
47.20
46.47
44.51
37.32
UAP
Ds
33.67
37.03
52.46
49.13
34.38
49.66
50.13
52.22
49.16
61.63
40.28
52.03
AVG
37.72
38.05
49.00
47.78
33,68
46.40
42.04
42.59
39.17
52.74
34.93
46.74
D: 45.39
27.72
39.02
57.72
55.18
61.57
33.42
28,49
34.19
32.42
29.28
37.93
D2
41.64
23.57
43.24
50.26
43.37
51.73
36,92
31.44
39.21
35.62
30.81
37.65
Sample-wise
D3
46.60
35,91
49.17
60.69
52.88
89
45.81
38.42
42.51
48.13
43.44
50.71
AVG
44.54
29.07
43.81
56.22
50.48
58.06
38.72
32.78
38.64
38.72
34.51
42.10
MOSE DAYIS YouTuke
50
100
100
36.26
36.46
40:04
4+
57.03
$7.13
38.51
50
80
Adi
Betggh
mloUtr (%)
30
Denig
50
27.32
32.30
34,59
72
48.18
36.26
50.08
60
60
-00
40
40
33.00
32.40
37.03
$0.26
62.34
42.47
Youtube
D.VI5
MOSE
SAM2
5AM2-5
SAME.1-T
-10
20
YouTube
DAVIS
MOSE
20
You Tube
DAVIS
MOSE
(a) Cross dataset
(b) Cross model
(c) Sam2long- Point
(d) Sam2long-
Figure 5: Transferability study. (a) shows the results of cross-dataset transferability studies, while (b)
(d) present the results of cross- moosl transfcrability studies.
Platform. Experimental hardware details. We conduct experiments on a machine with two NVIDIA A100-SXM4 GPUs, two Intel(R) Xeon(R) Gold 6132 CPUs and 314GB RAM.
4.2 Attack Performance
To comprehensively evaluate the effectiveness UAP-SAM2, we conduct experiments six datasets (YouTube, DAVIS, MOSE, YouTube", DAVIS' and MOSE") covering both video and image segmentation tasks. We evaluate three model variants: SAM2- T, SAM2-S, and SAM2.1-T. For clarity, sponding variant datasets) as Di-D3 and the models as Mi-Ma throughout the paper. We evaluate both the sample-wise and universal vari- ants of our attack under 72 different settings. For each setting, we generate adversarial examples using both point and box prompts, and report performance under point-prompt evaluation. As reference, Fig. shows SAM2's segmentation accuracy on benign samples. Across six datasets for both image and video segmen- tation tasks, SAM2 achieves an average mloU above 76%, demonstrating strong segmentation capability and generalization. Tab. shows that adversarial examples generated by UAP-SAM2 consistently and significantly degrade SAM2's performance with cross-prompe transferability. Notably, on the DAVIS dataset with point prompts, UAP-SAM2 and its variant UAP-SAM2* reduce SAM2's mloU by over 45.79% and 54.77%, respectively. As presented in Tab. 1, regardless of whether point or box prompts used, our method consistently achieves stronger attack performance on video segmentation than on image segmentation. This further validates its effectiveness in disrupting semantic consistency across consecutive frames.
denote the datasets (including their corre-
5018
Figure 6: Left: Video, Right: Image
We further evaluate the transferability of our approach across different datasets and models. Fig. (a) and Fig. 5 (b) report the performance of UAP-SAM2 under transfer settings, where each row corresponds to adversarial examples generated from the same source. The results demonstrate strong transferability across datasets and models. Additionally, Fig. 5 (c) and Fig. 5 (d) show the attack performance UAPs crafted on SAM2-T and transferred to Sam2long [7] under point and box prompts, confirming the effectiveness of our method against SAM2 variants well.

---

Table 2: (UAP) The mloU(%) results of the comparison study under different settings. Bold indicates the best results. Since UAD does not use prompts during the optimization process, the results are identical under both box-prompt and point-prompt settings.
Point
Box
Method
Video
Image
Video
Image
D
D2
Dg
D)
D2
D3
D1
D2
D3
D1
D2
Dg
UAPGD [5]
42.59
53.60
50,80
54.42
50.11
61.76
65.01
56.97
62.33
64.79
50.11
63.42
VOSPGD [13]
60.91
54.24
63.47
50.05
48.56
53.52
63,06
56,20
65.15
61.88
51.63
56.21
SegPGD [10]
43.24
52.34
58.89
56.22
49.96
61.02
63.43
58,54
65.26
64.73
52.64
62.71
AttackSAM [42]
64.35
62.31
63.05
64.18
53.53
63.92
60.88
58.80
57.12
63.72
51.75
62.66
S-RA [29]
61.18
56.20
60.25
63.53
51.04
54.38
62.45
57.89
60.82
62.01
50.05
53.57
UAD [22]
49.39
53.66
53.51
56.12
51.80
61.87
49.39
53.66
53.51
56.12
$1.80
61.87
DarKSAM [48]
67.51
57.00
51.96
64.38
52.99
64.38
66.20
58.91
62.76
65.58
53.76
65.03
Ours
37.03
42.47
33.67
27.54
48.45
50.13
45.17
49.03
49.13
$2.07
44.51
61.63
55
100
100
60
SAM2-T
50-
SAMP-T
SAM2S
80
Adi
Besigs
80
Ads
Besigs
3.55
45
mleU (%)
60
mloU (N)
60
50
60
40
40
20
20
40
W00
W/0
wic
Ours
512
01
15
13
15
(a) Module
(b) Prompt number
(c)
Box evaluation
(d) Point evaluation
SAMG-T SAMD-S
SAMU-T SANG
SAM2-T SAM2-5
SAM2-T
iute 192)
245-
milat (56)
50-
SAM2-5
malok
45
mlou
40
40
35
10
20
May55
4255 8255
10255 16255 30255
35
10
20
30
50
80
100
15
30
00
(e) Iteration number
(l) Epsilon
(g) Negative sample
(h) Frame number
Figure 7: Ablation results the effect of different factors the attack performance of UAP-SAM2
4.3 Comparison Study
Given the absence of adversarial attacks tailored for SAM2, we evaluate our method comprehensively by comparing UAP-S AAM2 against the latest adversarial attacks targeting SAM, such Attack- SAM [42]. S-RA [29], UAD [22], and DarkSAM [48]. We further compare UAP-SAM2 against representative adversarial attack methods originally designed for classification, image segmentation, and video segmentation tasks, including UAPGD [5], SegPGI [10], and VOSPGD [13]. To ensure fair comparison, we adapt all baseline methods into a universal adversarial attack framework and apply the same optimization settings used in UAP-SAM2. To evaluate the cross-promy generalization ability of these methods, we uniformly adopt random prompts, i.e., the prompts used during training and testing are different, for method optimization to generate adversarial examples. choose SAM2-T as the target model and evaluate the performance of all methods on both image and video segmentation tasks across six datasets. As depicted in Tab. 2. UAP-SAM2 outperforms all existing attacks on video segmentation across three datasets. For image segmentation, our method also surpasses most basclines. The above results can be attributed to the tailored design of video features in our method.
4.4 Ablation Study
In this section, we investigate the different factors on the attack performance of UAP-SAM2. We use SAM2-T and SAM2-S as the target models, with DAVIS the dataset.
The effect of the module. We perform ablation studies to assess the contribution of individual components to the attack effectiveness of UAM- For clarity, we denote Leas Lfas and Lmo.
8

---

as A. B, and C, respectively. As observed in Fig. 7 (a), none of the ablated variants surpass the full model. highlighting the importance of each module achieving optimal attack performance.
The effect of prompt numbers. We investigate how the prompt number m of segmented regions in the proposed target-scanning strategy influences the attack performance of UAP-SAM2. We vary the region count from 8 to 512 and report the results in Fig. 7 (b). The attack achieves optimal performance under both settings when m 256, which we adopt the default configuration.
The effect of evaluation modes. We study how different evaluation prompt settings affect the attack performance of UAP-SAM2. Specifically, evaluate the perturbation generated on SAM2-T using five randomly sampled box prompts (B1 - B5) and five point prompts (P1 P5). As depicted in Fig. (c) (d), UAP-SAM2 consistently maintains strong performance across different prompt configurations, demonstrating the robustness of our method.
The effect of iteration numbers. We investigate the effect of the iteration numbers on attack performance of UAA-SAM2. We conduct experiments with varying numbers of iterations, ranging from 1 to 20. The results shown in Fig. 7 (e) indicate that the attack performance stabilizes after the number of iterations reaches 10, Therefore, we set it as the default configuration for our experiments.
The effect of c. We evaluate UAP-SAM2's performance with from 2/255 to 32/28 255 in Fig. 7 (f). With the increase e, there a corresponding enhancement attack performance. Notably, even at the 4/255 setting, our method still maintains high attack efficacy, with an average mloU decrease of over 33.08%.
The effect of negative sample numbers. We explore the effect of varying the number of nega- tive samples from 10 to 100 the performance of UAP-SAM2 in Fig. (g). Considering both computational efficiency and attack effectiveness, we set 30 as our default testing.
The effect of testing frame numbers. We study the effect of the number of selected frames per video on the performance of UAP-SAM2. As shown Fig. 7 (h), the results with 15 frames are comparable to those using all frames. Therefore, for efficiency considerations, set 15 frames as the default configuration for our experiments.
5 Defense Study
Since there is no dedicated adversarial defense tailored for SAM2, we explore the robustness of UAP- SAM2 through two common defense strategies: model pruning [50] and data pre-procssiigg [27].
Model pruning is a widely used compression technique that removes redundant parameters to simplify network complexity, thereby potentially reducing sensitivity to perturbations. We evaluate the attack performance under various pruning ratios ranging from 0 to 0.9 on DAVIS. As shown in Fig. 8 (a) (b), the mloU of benign samples consistently decreases as the pruning ratio increases, whereas that adversarial examples remains relatively stable. Notably, even when the pruning ratio reaches 0.4, the performance of benign samples degrades significantly, while the mloU of adversarial examples remains largely unaffected. These results suggest that model pruning offers limited robustness against UAP-SAM2
Data pre-proeeee pe-proccesiin suppresses the impact of adversarial noise by introducing distortions such as occlusion or blur into the image. We apply spatter (sp_) and saturate (sa_) corruption at severity levels from 0 to assess the effectiveness of this strategy on DAVIS. As observed in Fig. (c) (d), increasing the corruption strength leads to consistent drop in benign sample mloU, while adversarial mloU remains largely unaffected. These findings suggest that our method remains effective even when facing pre-processing defenses based on input corruption.
6
Related Works
6.1 Segment Anything Models
Segment Anything Model (SAM) [17] has achieved remarkable success in image segmentation due to
its strong generalization ability. SAM2 [28], the latest improved version, is applied to both image and video segmentation tasks through the memory mechanism, extending SAM general-purpose video segmentation. The user only needs to provide prompt on the first frame, and SAM2 can

---

100
100
Beaign
Breign
ty Jeig
twip
80
Adr
Ad
30-
So Ao
50
wdst (N)
70
70
600
20
20
40
40
0.1 0. 0.3.0.
0.1 0. 0.6.
30
30
(a)
(b) Pruning-SANN SAM2-S (c) Cormupiion-AAN -AM2-T (d) Corruption SAM---
Figure 8: The results (%) of the defense study. (a) (b) show the experimental results of parameter pruning, (c) - (d) present the results of input pre-processing.
then perform real-time object localization and segmentation in subsequent frames. Building its strong generalization, recent studies [1, 3, 7, 15, 19, 32, 39, 49] develop task-specific variants of SAM better address various downstream applications. SAM2 has been rapidly applied to various downstream tasks, such as medical video segmentation [49], 3D segmentation [11], and camouflaged object detection [32].
6.2 Adversarial Attacks on SAM
Recent studies 20, 23, 25, 47, 18, 31, 44], which are crafted by adding imperceptible perturbations induce incorrect predictions. Existing adversarial attacks on SAM fall into two categories: sample-wise, which tailor perturbations to each input, and universal, which create single perturbation that works across many images. Attack-SAM [42] is the first to adopt PGD [23] to manipulate the predicted masks of pnage-prompt pairs. UAD [22] extends this direction by simulating spatial deformations to optimize adversarial noise that disrupts the feature representations of the image encoder, enabling prompt-free attacks. In parallel, DarkSAM [48] introduces the first universal adversarial attack against SAM. It designs a hybrid spatial-frequency framework that prevents objects in the image from being segmented and proposes shadow target strategy improve cross-prompt transferability. Other studies [20, 29] focus on localized attacks that deceive SAM into failing to segment specific objects within an image. Despite their effectiveness on SAM, these methods cannot be directly applied to SAM2 due to the modality gap between images and videos, and the architectural novelties of SAM2.
20, 21, 29, 38, 42, 48] reveal that the SAM is vulnerable to adversarial examples [9,
Conclusions, Limitations, and Broader Impact
In this paper, we investigate the performance gap of existing attacks against SAM and SAM2, and attribute it to two key challenges: directional guidance from the prompt and semantic entanglement across consecutive frames. To this end, we propose UAP-SAM2, the first cross-prompt universal adversarial attack driven by dual semantic deviation against SAM2. We design target-scanning strategy and directly perturb the output features of the image encoder to enhance the cross- pross-prompt transferability. To further boost the attack effectiveness, we jointly exploit semantic confusion and feature deviation. We conduct extensive experiments on six datasets across two segmentation tasks to demonstrate the effectiveness of the proposed method for SAM2.
While our work focuses on prompt-based based video segmentation models, a potential limitation that SAM2 may not directly generalize traditional segmentation models, their outputs not label-free masks. Although SAM-based models are gaining popularity, remains unclear how well adversarial examples crafted for SAM2 transfer other segmentation frameworks. As these models are increasingly adopted in safety-critical applications such as autonomous driving and medical imaging, understanding their vulnerabilities is erucial direction for future research.
Acknowledgements
This work is sponsored by the Major Program (JD) of Hubei Province (No. NN..202BAAA04) and National Natural Science Foundation of China under Grants Nos.62372196 and 62202186, 186. Yufei Song is the is the corresponding author.
10

---

References
[1] Yunhao Bai, Qinji Yu, Boxiang Yun, Dakai Jin, Yingda Xia, and Yan Wang. Fs-medsam2: Exploring the potential of sam2 for few-shot medical image segmentation without fine-tuning. arXiv preprint arXiv:2409. 04299, 2024.
[2] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In Proceedings of the International Conference on Machine Learning (ICML 20), pages 1597-1607. PMLR, 2020.
[3] Tianrun Chen, Ankang Lu, Lanyun Zhu, Chaotao Ding. Chunan Yu, Deyi Ji, Zejian Li, Lingyun Sun, Papa Mao, and Ying Zang. Sam2-adapter: Evaluating & adapting segment anything 2 in downstream tasks: Camouflage, shadow, medical image segmentation, and more. arXiv preprint
arXiv:2408.045: 2024.
[4] Tianrum Chen, Lanyun Zhu, Chaotao Deng. Runlong Cao, Yan Wang, Shangzhan Zhang, Zejian
Li, Lingyum Sun, Ying Zang, and Papa Mao. Sam-adapter: Adapting segment anything in underperformed scenes. In Proceedings of the IEEE/CVF International Conference Computer
Vision (ICCV'2.)) pages 3367-3375. IEFE, 2023.
[5] Yingpeng Deng and Lina J. Karam. Universal adversarial attack via enhanced projected gradient descent. In Proceedings of the IEEE International Conference on Image Processing (ICIP 20), pages 1241-1245. IEEE, 2020.
[6] Henghui Ding. Chang Liu, Shuting He, Xudong Jiang, Philip H. S. Torr, and Song Bai. Mose: A new dataset for video object segmentation in complex scenes. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'23), pages 20224-2022 20234. IEEE, 2023.
[7] Shuangrui Ding, Rui Qian, Xiaoyi Dong, Pan Zhang. Yuhang Zang, Yuhang Cao, Yuwei Guo, Dahua Lin, and Jiaqi Wang. Sam2long: Enhancing sam for long video segmentation with a training-free free memory tree. arXiv preprint 262, 2024.
[8] Kevin Duarte, Yogesh S. Rawat, and Mubarak Shah. Capsulevos: Semi-supervised video object segmentation using capsule routing. In Proceedings of the IEEE/CVF International Conference on Computer Vision (CCCV'19), pages 8480 8489. IEEE, 2019.
[9] lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. In Proceedings of the 3rd International Conference on Learning Representations (ICLR' (C)L'11), 2015.
[10] Jindong Gu, Hengshuang Zhao, Volker Tresp, and Philip H. S. Torr. Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. In Proceedings of the 17th European Conference Computer Vision (ECCV'22), pages 308-325. Springer,
2022.
[11] Ziyu Guo, Renrui Zhang, Xiangyang Zhu, Chengzhuo Tong, Peng Gao, Chunyuan Li, and Pheng-Ann Heng. Sam2point: Segment any 3d as videos in zero-shot and promptable manners. arXiv preprint arXiv:2408. 16768, 2024.
[12] Yihao Huang, Yue Cao, Tianlin Li, Felix Juefei-Xu, Di Lin, Ivor W. Tsang, Yang Liu, and Qing Guo. On the robustness of segment anything. arXiv preprint arXiv:2305. /6220, 2023. [13] Kaixun Jiang, Lingyi Hong, Zhaoyu Chen, Pinxue Guo, Zeng Tao, Yan Wang, and Wenqiang Zhang. Exploring the adversarial robustness of video object segmentation via one-shot adversar- ial attacks. In Proceedings of the 31 ACM International Conference on Multimedia (MM 23), pages 8598-8607. ACM, 2023.
(14) Yan Jiang, Guisheng Yin, Ye Yuan, Jingjing Chen, and Zhipeng Wei. Cross-point adversarial at- tack based on feature neighborhood disruption against segment anything model. In Proceedings of the IEEE International Conference on Multimedia and Expo (ICME'24), pages 1-6. IEEE, 2024.
[15] Zhang Jiaxing and Tang Hao. Sam2 for image and video segmentation: A comprehensive survey, arXiv preprint arXiv:2503.1 12781, 2025.
[16] Lei Ke, Mingqiao Ye, Martin Danelljan, Yifan Liu, Yuwing Tai, Chikeung Tang, and Fisher
Yu. Segment anything in high quality. In Proceedings of the 47th International Conference on Neural Information Processing Systems (NeurIPS'22) 23)), 2023.
[17] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloé Rolland, Laura Gustafson,
Tete Xiao, Spencer Whitehead, Alexander C. Berg, Wan-Yen Lo, Piotr Dollár, and Ross B. Girshick. Segment anything. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV'23), pages 3992-4003. IEFE, 2023.
[18] Minghui Li, Jiangxiong Wang, Hao Zhang. Ziqi Zhou, Shengshan Hu, and Xiaobing Pei. Transferable adversarial facial images for privacy protection. In Proceedings of the 32nd ACM International Conference on Multimedia (ACM MM'24), pages 10649-10653 10658, 2024.
11

---

[19] Haofeng Liu, Erli Zhang, Junde Wu, Mingxuan Hong, and Yueming Jin. Surgical sam 2: Real-time segment anything in surgical video by efficient frame pruning. arXiv preprint arXiv:2408. 07931, 2024.
[20] Xiaoliang Liu, Fu-rao Shen, and Jian Zhao. Region-guidee attack the segment anything model. Available at SSRN 5074015.
[21] Yuchen Liu and Pengxu Wei. Cross-prompt adversarial attack on segment anything model.
In Proceedings of the 12th International Conference on Communications and Broadband Networking (ICCBN"24), 24), pages 34-39. ACM, 2024.
[22] Jiahao Lu, Xingyi Yang. and Xinchao Wang. Unsegment anything by simulating deformation.
In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'244 24). pages 24294-24304, IEEE, 2024.
[23] Aleksander Madry, Alcksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: (ee:::70666. 2017.
[24] Shervin Minaee, Yuri Boykov, Fatih Porikli, Antonio Plaza, Nasser Kehtarnavaz, and Demetri Terzopoulos. Image segmentation using deep learning: A survey. IEEE Transactions on Pattern
Analysis and Machine Intelligence, 44(7):3523-3544 -3522. 2021. Seyed-Mohsen
[25]
Poossav--Dezfooli Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR' 17), pages 1765-1773. IEEE, 2017.
[26] Jordi Pont-Tuset, Federico Perazzi, Sergi Caelles, Pablo Arbeláez, Alex Corkine-Homung, and Luc Van Gool. The 2017 davis challenge on video object segmentation. arXiv preprint
arXiv:1704.0000 00045,0065.000 2017.
[27] Aaditya Prakash, Nick Moran, Solomon Garber, Antonella DiLillo, and James Storer. Deflecting adversarial attacks with pixel deflection. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition (CVPR'18) 18), pages 8571 15710 IEFF, 2018.
[28] Nikhila Ravi, Valentin Gabeur, Yuan-Ting Hu, Ronghang Hu, Chaitanya Ryali, Tengyu Ma, Haitham Khedr, Roman Rädle, Chloé Rolland, Laura Gustafson, Eric Mintun, Junting Pan, Alwala Kalyan Vasudev, Nicolas Carion, Chao-Yuaa Wu, Ross B. Girshick, Piotr Dollár, and Christoph Feichtenhofer. Sam 2: Segment anything in images and videos. In Proceedings of The Thirteen International Conference on Learning Representations (ICLR'25) 2025.
[29] Yifan Shen, Zhengyuan Li, and Gang Wang. Practical region-level attack against segment anything models. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR'244 pages 194-203. IEEE, 2024.
[30] Yufei Song. Ziqi Zhou, Minghui Li, Xianlong Wang. Menghao Deng, Wei Wan, Shengshan Hu, and Leo Yu Zhang. Pb-uap: Hybrid universal adversarial attack for image segmentation. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing
(ICASSP'255 25), 2025.
[31] Yufei Song. Ziqi Zhou, Qi Lu, Hangtao Zhang, Yifan Hu, Lulu Xue, Shengshan Hu, Minghui Li, and Leo Yu Zhang. Segtrans: Transferable adversarial examples for segmentation models.
IEEE Transactions on Multimedia,, 2025.
[32] Lv Tang and Bo Li. Evaluating sam2's role in camouflaged object detection: From sam sam2.
arXiv preprini arXiv:2407.22 1596, 2024.
[33] Lv Tang, Haoke Xiao, and Bo Li. Can sam segment anything? when sam meets camouflaged TTt::2304004709, 2023.
object detection. arXiv preprini
[34] Yichen Wang, Yuxuan Chou, Ziqi Zhou, Hangtao Zhang, Wei Wan, Shengshan Hu, and Minghui Li. Breaking barriers in physical-world adversarial examples: Improving robustness and transferability via robust feature. In Proceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI 25). 2025.
[35] Yichen Wang, hangtao Zhang, Pan Hewen, Ziqi Zhou, Xianlong Wang, Peijin Guo, lulu Xue, Shengshan Hu, Minghui Li, Leo Yu Zhang, and Yao. Advedm: Fine-grained adversarial attack against vim-based embodied agents. Proceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS' 25), 2025.
[36] Xingxing Wei, Siyuan Liang. Ning Chen, and Xiaochun Cao. Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv: /./.://1....44 2018.
[37] Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yugang Jiang. Cross-modal transferable adver- sarial attacks from images to videos. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'22), pages 15064-15073. IEEE, 2022.
[38] Song Xia, Wenhan Yang, Yi Yu, Xun Lin, Henghui Ding, Lingyu Duan, and Xudong Jiang. Transferable adversarial attacks on sam and its downstream models. In Proceedings of the 38th International Conference on Neural Information Processing Systems (NeurIPS 2024.
12

---

[39] Xinyu Xiong, Zihuang Wu, Shuangyi Tan, Wenxue Li, Feilong Tang, Ying Chen, Siying Li, Jie Ma, and Guanbin Li. Sam2-unet: Segment anything 2 makes strong encoder for natural and medical image segmentation. arXiv preprint arXiv:2408. 08870, 2024.
[40] Yunyang Xiong, Bala Varadarajan, Lemeng Wu, Xiaoyu Xiang, Fanyi Xiao. Chenchen Zhu, Xiaoliang Dai, Dilin Wang, Fei Sun, Forrest N. landola, Raghuraman Krishnamoorthi, and Vikas Chandra. Efficientsam: Leveraged masked image pretraining for efficient segment anything. arXiv preprint 2. /2.00663, 2023.
[41] Ning Xu, Linjie Yang. Yuchen Fan, Dingeheng Yue, Yuchen Liang, Jianchao Yang, and Thomas Huang. Youtube-vos: A large-scale video object segmentation benchmark. arXiv preprint
arXiv: 001.118000333 2018.
[42] Chenshuang Zhang, Chaoning Zhang, Taegoo Kang, Donghun Kim, Sung-Ho Bae, and In So Kweon. Attack-sam: Towards evaluating adversarial robustness of segment anything model.
arXiv preprint arXiv:2305. 00866, 133):,, 2023.
[43] Renrui Zhang. Zhengkai Jiang. Ziyu Guo, Shilin Yan, Junting Pan, Hao Dong, Peng Gao, and Hongsheng Li. Personalize segment anything model with one shot. arXiv preprint
arXiv:2305. 03048, 2023.
[44] Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advelip: Downstream-agnostie adversarial examples in multimodal contrastive learning. In Proceedings of the 32nd ACM International Conference on Multimedia (MM' 23)), pages 631 6311-66 1-6320, 2023, [45] Ziqi Zhou, Shengshan Hu, Ruizhi Zhao, Qian Wang. Leo Yu Zhang, Junhui Hou, and Hai Jin. Downstream-agnostic adversarial examples. In Proceedings of the 2023 IEEF/CVF International Conference on Computer Vision (ICCV223), pages 4345-4355, 2023.
[46] Ziqi Zhou, Bowen Li, Yufei Song. Shengshan Hu, Wei Wan, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Numbod: A spatial-frequency fusion attack against object detectors. In Proceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAA/'25). 2025.
[47] Ziqi Zhou, Minghui Li, Wei Liu, Shengshan Hu, Yechao Zhang, Wei Wan, Lulu Xue, Leo Yu Zhang. Dezhong Yao, and Hai Jin. Securely fine-tuning pre-trained encoders against adversarial examples. Proceedings of the 2024 IEEE Symposium on Security and Privacy (SP'24), 2024. [48] Ziqi Zhou, Yufei Song, Minghui Li, Shengshan Hu, Xianlong Wang, Ieo Yu Zhang, Dezhong Yao, and Hai Jin. Darksam: Fooling segment anything model segment nothing. In Proceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS'24) 2024. [49] Jiayua Zhu, Yunli Qi, and Junde Wu. Medical sam 2: Segment medical images as video via segment anything model 2. arXiv preprint arXiv:2408. 00874, 2024.
[50] Michael Zhu and Suyog Gupta. To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint 1rXiv:1710.018// 2017.
NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: See Abstract and Sec.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
13

---

Justification:
See Sec. 7.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification:
The paper does not involve theory assumptions and proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: See Sec. 4.
Guidelines:
The answer NA means that the paper does not include experiments.
14

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
We have provided the source code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: /CodeSoommmiiicc SonddeeubmissiooPooo
/ //nips... //nips.cc/pput wttpccccccpppcccccccccccococccce
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
15

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting//etails
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer:[Yen Yes]
Justification:
See Sec. 4.1 and Sec. 4.4.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[Yes]
Justification: We provide the influence of random seed on the experimental results in appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2- 2-simma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide sufficient information in Sec. 4.1.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
16

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: http///eeer../eeeeeeeeee cctppblic//eeeecccccccccccc htppblic/tticccuueeleeeeeeeeee line??
Answer: [Yes]
Justification: After a thorough review of the paper, no violations of the NeurIPS Code of Ethics are found.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No. they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: See Sec. 7.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out, For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: The paper does not involve safeguards that have been put in place for responsi- ble release of data models.
17

---

Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: The data used in the paper are properly credited, and the license and terms of use are explicitly mentioned and properly respected.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each
For scraped data from a particular source (c.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. this information is available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
18

---

Answer:
[NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing. editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification: LLMs are not involved in the scope of this work.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non ntn-standard components.
Please refer to LLM policy (https: //n/riiris....// htt///fffeencce///// for what should or should not be described.
19

---

A
Contents
Sec. B: Experimental settings including datasets, evaluation metries, and platforms.
Sec. C: Supplementary comparison study under the sample-wise adversarial attack setting.
Sec, D: Multi-point evaluation study of the proposed attack under multi-prompt settings.
Sec. E: Stability analysis with respect to random seeds.
B
Experimental Setting
In this section, provide details of experimental settings. For video segmentation, randomly select 100 videos and sample 15 consecutive frames from each for evaluation. For image segmentation, we randomly choose 50 videos and uniformly sample total of 500 frames.
B.1 Datasets
DAVIS 2017: DAVIS 2017 [26] a standard dataset widely used for video target segmen- tation tasks. Its training set contains 60 videos and the test contains 30 videos. Each video provides pixel-level target (human, animal, object) segmentation annotations, that each frame gives the precise boundary of the target. It is specially designed for target segmentation and tracking tasks in videos, especially suitable for multi-target tracking and segmentation research.
COUTUBE-VOSZOLE [8] is large-scale dataset designed for video object segmentation tasks based on video content on the YouTube platform, especially for accurate object segmentation in long video sequences. This dataset provides large-scale, densely annotated video sequences. The training set contains 3,883 videos involving 40 different object categories, and the test set contains 1,474 videos involving 20 different object categories.
MouTube-VVSS2011
MOSE: MOSE [6] a large-scale dataset designed for video object segmentation tasks based on video content on the YouTube platform, especially for accurate object segmenta- tion long video sequences. This dataset provides large-scale, densely annotated video sequences. The training set contains 3,883 videos involving 40 different object categories, and the test set contains 1,474 videos involving 20 different object categories.
B.2 Evaluation Metrics
We choose Mean Intersection over Union (mloU) as the metric to evaluate segmentation accuracy. mloU commonly used evaluation method in semantic segmentation tasks to measure the model's performance across different categories. It is calculated by determining the Intersection over Union (IoU) for each category and averaging the loUs across all categories to obtain the final evaluation result. Specifically, IoU is the ratio of the intersection area between the predicted region and the ground truth region to the union of both areas. The formula for calculating IoU for each category is:
IoU Predicted Region n Ground Truth Region
Predicted Region Ground Truth Region
mIoU is the average of the loUs for all categories, reflecting the model's overall performance in the segmentation task. A higher mloU indicates better segmentation performance across categories, particularly in tasks with class imbalance or fine-grained segmentation.
C Supplementary Comparison Study
Consistent with Sec. 4.3, we compare UAP-SAM2" against a range of SOTA adversarial attacks. including Attack-SAM [42], S-RA [29], UAD [22], DarkSAM [48], PGD [23], SegPGD [10], and VOSPGD [13]. To ensure a fair comparison, all baseline methods are adapted to a sample-wise adversarial attack framework and optimized under the same settings as UAP-SAM2*. To evaluate the cross-prompt generalization ability of these methods, we uniformly adopt random prompts, i.e. the prompts used during training and testing are different, for method optimization to generate adversarial
20

---

Table A1: (Sample-wise) The mloU (%) results of the comparison study under different settings. Bold indicates the best results. Since UAD does not use prompts during the optimization process, the results identical under both box-prompt and point-prompt settings.
Point
Box
Method
Video
Image
Video
Image
D
D2
Dg
D
D2
D3
D
D2
D3
D
D2
Dg
UAPGD [5]
56.61
52.59
54.74
53.12
49.84
65.03
71.75
38.67
60.63
61.90
54.44
64.92
VOSPGD [13]
57.66
52.76
60.48
53.59
49.99
65.31
67.99
59.69
67.60
62.33
54,43
64.57
SegPGD [10]
53.27
51.73
51.92
51.91
49.58
63.11
67.78
55,95
67.70
62.27
55.44
61.74
AttackSAM [42]
50.00
45.76
50.99
39.09
39.54
56.77
52.80
53.14
63.61
52.78
47.61
62.88
S-RA [29]
47.86
54.90
49.33
35.29
52.61
53.30
57.98
54.37
56.21
65.61
60.73
65.25
UAD [22]
55.51
60.20
47.89
45.41
48.69
48.74
55.51
60.20
47.89
45.41
48.69
48.74
DarkSAM [48]
61.96
49.53
58.37
58,25
50.47
61.57
60.46
56.55
65.51
59.51
52.57
63.79
Ours
45.39
41.64
46.60
33.42
36.92
45.81
57.72
50.26
60.69
32.42
35.62
48.13
examples. We adopt SAM2-T as the target model and evaluate all methods on both image and video segmentation tasks across six datasets. As shown in Tab. A1, UAP-SAM2" generally outperforms all existing attack methods across image and video segmentation tasks on three datasets, with only one exception. Visual comparisons under the UAP and sample-wise adversarial attack frameworks provided in Fig, A3 and Fig. A4, respectively.
D Multi-point Evaluation Study
We conduct an in-depth investigation into the impact of the multi-prompy prompt evaluation settings on the effectiveness of our proposed attack method. Specifically, select SAM2-T as the target model and examine how varying the number of input prompts influences segmentation performance on adversarial examples. As illustrated in Fig. A2, present qualitative visualizations of SAM2's segmentation outputs under different numbers increasing the number of prompts provides the model with more spatial information about the target objects, which can slightly mitigate the impact of the adversarial perturbations. Nevertheless, UAP-SAM2 continues to exhibit strong attack performance, consistently disrupting SAM2's ability to generate coherent and semantically meaningful segmentations, even under dense prompting conditions. These results highlight the robustness and general effectiveness of our method across varied prompt configurations.
prompt points. Our observations indicate that
E
Stability Analysis
Considering the potential influence random seed settings on the selection of training and testing images, we conduct detailed anal- ysis of how different random seeds affect the performance of UAP- SAM2. While default random seed of 30 is adopted in all our main experiments to ensure consistency, we further explore the ro- bustness of our method by evaluating it under multiple random seed settings. Specifically, we select five random seeds and perform uni- versal adversarial attacks using SAM2-T the target model on three benchmark datasets: DAVIS, YouTube, and MOSE. As illustrated in Fig. A1, the error bars reflect the variance in attack performance across different seeds. The consistently small fluctuations across datasets confirm that UAP-SAM2 delivers stable and reliable results, demonstrating strong robustness to variations in seed initialization.
80
mlon (%)
Youlube
DAVIS
MOSE
Figure A1: Stability analysis
21

---

Benign
Adv
Benign
Adv
Benign
Adv
Benign
Adv
Figure A2: Visualization of SAM2 segmentation results adversarial examples generated by UAP- SAM2 under the multipoint evaluation mode
Renign
PGD
VOSPGD
SegPGD
A-SAM
S-RA
UAD
DarkSAM
Ours
1
/
1
1
Figure A3: (UAP) Visualization of the comparison study results
22

---

Image
Benign
PGD
VOSPGD
SegPDD
A-SAM
S-RA
UAD
DarASAM
Ours
Figure A4: (Simple-wise) Visualization of the comparison results
23


Reviews:
[{"review_id": "oAD8RivOy6", "reviewer": "Reviewer_q4bX", "summary": "This work introduces universal adversarial perturbations against SAM2 which is the first adversarial attack for SAM2. The work finds that existing adversarial attacks for SAM cannot effectively transfer to SAM2 models due to their inherently different design. The proposed attack has three components – semantic confusion, feature shift  and memory misalignment. Experiments show the effectiveness and good transferability of the proposed attack.", "questions": "Q1: Why setting the UAP perturbation level to 10/255 while keeping the sample-wise variant attack to 8/255? Can you show the attack performance under a range of different perturbation levels?\n\nQ2: Figure 6(f) describes the attack performance with different settings of prompt numbers, however it seems model SAM2-T and SAM2-S exhibit completely different trend. Can you provide some explanations to this difference?\n\nQ3: The proposed attack has three different components with unique purposes. Will these three loss components introduce difficulties in the optimization procedure? Can you show the curve of each loss components during adversarial sample optimization? From the formulation in Eq. (3), seems the scales of each loss component are equal. In practice, how do you set the loss scale to balance each module?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strength: The proposed method is original and effective. Analysis of the previous attack failure modes provides insight. Experiments are thorough. The transferability performance is good. \n\n---\nWeakness:\n\nW1: The perturbation bound is fixed to a certain number (Line 201) and lacks performance comparisons between different settings of perturbation levels.", "was_revised": true, "final_justification": "Thanks to the authors for their efforts in addressing my concerns, as well as my peer reviewers. After reading the rebuttal, I am satisfied with the further discussion and information provided by the authors. Therefore I decided to raise my rating to accept.", "rebuttal": "## Responses to Reviewer q4bX ##\n\nThank you very much for your valuable suggestions on our work! You can find the responses to your questions as follows:\n\n------\n\n**Q1**:  Concern regarding  perturbation budgets\n\n**A1**: We follow standard practices in the adversarial attack literature for setting perturbation budgets: 8/255 for sample-wise attacks [1,2,3] and 10/255 for UAPs [4,5,6]. As these values are widely adopted in prior work, we use them as the default settings for the two attack variants in our main experiments.\n\nMoreover, we already provide an extended analysis of the proposed attack under varying perturbation levels in the supplementary material (Sec. D, L63–66), and report the results in Fig. A1(b).\n\n------\n\n**Q2**: Concern regarding  Fig. 6(f) \n\n**A2**:  We fully understand the reviewer’s concern. The results in Fig. 6(f) are accurate and reflect real experimental observations. We believe the differing trends between SAM2-T and SAM2-S arise from architectural differences: SAM2-S has a deeper network and more parameters, which likely gives it stronger capacity to interpret multi-point prompts. With more prompt points, SAM2-S can more accurately localize the target regions, thus reducing the effectiveness of the attack.\n\n------\n\n**Q3**: Concern regarding the curve of each loss component\n\n**A3**: Thank you for the insightful suggestion. We provide the optimization curves (in numerical form) for the three loss components during adversarial sample generation in Table R1, which reports their values at each epoch. We follow the same experimental setup as in Section 4.4 of the manuscript and conduct the experiment on SAM2-T for consistency. As shown, all losses consistently decrease and converge as training progresses, indicating stable optimization.\n\nAs stated in Eq. (3) and implemented in our released code, we do not apply any additional tricks or manual weighting to balance the loss terms—their scales are treated equally. We acknowledge that better loss balancing could potentially improve performance, and we will explore this in future work.\n\n\n\nTable R1: Investigation of loss dynamics for the proposed modules during adversarial optimization\n\n|  epoch  |   0   |   1   |   2   |   3   |  4   |   5   |  6   |   7   |  8   |   9   |\n\n|-------------|---------|---------|---------|---------|--------|---------|---------|---------|---------|---------|\n\n| L_sa | 0.7468 | 0.6938 | 0.6938 | 0.6942 | 0.6946 | 0.6943 | 0.6943 | 0.6952 | 0.6954 | 0.6954 |\n\n|  L_fa | 0.2264 | 0.1625 | 0.2002 | 0.1889 | 0.1581 | 0.1968 | 0.2541 | 0.1892 | 0.2113 | 0.1665 |\n\n|  L_ma | -0.8013| -0.8101| -0.8166| -0.8272| -0.8267| -0.8287| -0.8378| -0.8440| -0.8448| -0.8439|\n\n------\n\n**Q4**: Concern regarding formatting and presentation issues\n\n**A4**: We appreciate the reviewer’s insightful suggestions. We will address the issues raised by revising Line 59 to wrap ‘m’ regions in a math environment, unifying the font in Figure 2, and merging Figure 5’s information into Table 2 for clearer comparison in the revised version.\n\n\n\nReference:\n\n[1] Unsegment Anything by Simulating Deformation, CVPR 2024.\n\n[2] Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness, ECCV 2022.\n\n[3] Cross-Prompt Adversarial Attack on Segment Anything Model, ICCBN 2024. \n\n[4] Darksam: Fooling segment anything model to segment nothing, NeurIPS 2024.\n\n[5] Pre-trained adversarial perturbations, NeurIPS 2022.\n\n[6] Universal adversarial perturbations, CVPR 2017."}, {"review_id": "QC4euSy6v8", "reviewer": "Reviewer_VCeY", "summary": "This paper addresses the problem of creating adversarial examples for the Segment Anything Model 2 (SAM2), a prompt-conditioned video segmentation model. The authors claim to introduce the first cross-prompt universal adversarial perturbation (UAP) that effectively fools the model with an architecture-specific optimization scheme. Following the standard white-box (full access) iterative procedure, this method optimizes a three-term loss function, with each term addressing a different aspect of the adversary: semantic attack aims to flip the prediction entirely from foreground to background in each frame, feature shift attack maximizes the distance of the perturbation to a prototype derived from the original image in embedding space, while the memory misalignment attack attempts to do the same across consecutive frames. The method's design is based on a preliminary analysis of SAM2's strengths and weaknesses, together with a comparison to SAM-specific baselines. UAP-SAM2 is extensively evaluated on image and video segmentation tasks using three datasets, with additional exploratory and ablation studies. Moreover, the authors investigate the influence of two defense strategies, model pruning and data preprocessing, on the method's performance.", "questions": "1. My current score is a conservative choice — I would have no problem increasing it once the authors provide a broad and detailed analysis of the first weakness that shows their method's novelty. Please focus on that during the rebuttal.\n\n2. Line 42: do the authors mean percentage points?\n\n3. Equation 2: since we want to decrease mIOU, shouldn't it be a minimum instead of a maximum?\n\n4. Equation 7: am I right that the formula is lacking an additional sum over positive pairs?\n\n5. How is $J_{ma}$ computed on image segmentation tasks, given that no consecutive frames are present? Is it simply skipped?\n\n6. Appendix, line 67: what do the authors mean by _negative sample number_? Does that relate to the prototype construction and the number of used augmentations? I believe this name was not defined anywhere.", "limitations": "\"yes\"", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n- the paper is well-written, with a very thought-out structure. One could argue that attributing the ineffectiveness of prior (SAM-suited) works to SAM2 to archiectural and task differences is trivial. However, the authors do a very good job of carefully analyzing the influence of its different components before introducing their own method. Since it would be rather difficult to build an extensive theory for such a model, I really appreciate the intuition-based preliminaries. The notation and description of different loss components are meticulous, making it easy for the reader to understand the motivation and goals.\n\n- the experimental evaluation seems very strong. The authors included many different scenarios, additional ablations, and investigated two scenarios of defending against their attack. In its current form, the paper provides clear evidence that UAP-SAM2 is a very effective technique with advantages over prior works.\n\nWeaknesses:\n\n- my main concern lies in the actual novelty of the introduced loss function. While the authors properly cite prior methods related to SAM, I think the paper is missing a broad description of approaches that create UAPs or standard adversarial attacks for classical image and video segmentation tasks (or even for SAM, no prior method is formally described in this work). Overall, how is each component placed in the related works context? What is each term's 'nearest neighbour' wrt. prior research? I'm not deep enough in the field to verify this myself and must argue that every reader should be provided with sufficient knowledge to ensure that something inside the loss function is actually new, or whether it's just a combination of techniques from other papers.\n\n- some fancy wording and PR/marketing could be removed. This is obviously a matter of personal preference, but sometimes moving from a high-level description to a more detailed one would be beneficial:\n1. lines 141--142: what do the authors mean by _simultaneously enhancing background saliency to confuse the current-frame features_?\n2. lines 144--146: while the overall description of the avalanche effect here is interesting, it seems unclear how the cosine similarity is computed. Is it between the embeddings from the vision encoder? Or is it done on raw frames? In any case, I believe that the authors should also include the cosine similarity between consecutive frames in the clean case, i.e., no perturbation, for fair comparison.\n3. line 103: using UAP-SAM2* as a name for the sample-wise version of UAP-SAM2 is not yet clear to me. Is the _universality_ of UAP-SAM2 meant in the context of different videos, where a single perturbation fools the model on all of them? If yes, then the sample-wise version loses its _universality_, so the naming becomes ambiguous. Obviously, this is only a small detail.\n\n- another detail is that, in my opinion, the caption of each figure should be self-contained and self-explanatory. For example, Figure 5.'s caption is very limited, the plot's font size is very small, and by looking only at the figure it is unclear what it shows. Same goes for Figure 3. Once again, these are details.", "was_revised": true, "final_justification": "My main concern in the initial review was the lack of an adequate placement of the main contribution of the work (the proposed loss function) within the context of the related literature. The authors properly discussed this issue in the rebuttal, which made the contribution clearer and explained its novelty. As my initial score was a conservative choice because of this issue (which I mentioned in the review), I decided to raise it following the authors response. Regarding other smaller issues, I am satisfied with the response and hope that all of the suggestions will be included in the final version of the paper if it gets accepted.", "rebuttal": "## Responses to Reviewer VCeY\n\nThanks very much for your insightful suggestions on our work! You can find the responses to your\n\nquestions as follows:\n\n------\n\n**Q1**: Concern regarding the proposed loss function\n\n**A1**:  We appreciate the reviewer’s concern about the novelty of the proposed loss function. We clarify that the significant architectural differences between SAM-series models and classical segmentation models, such as SAM’s reliance on prompt-based guidance instead of category labels, render existing adversarial attacks for standard segmentation models or classifiers largely ineffective. Recent SAM-specific attacks [1,2,3], which we cite and discuss as the most relevant baselines for our problem setting and method design, widely demonstrate this. We outline their core algorithmic ideas in the Introduction and Related Work sections (Lines 31–36, 298–306). We will gladly expand these descriptions in the revised manuscript, incorporating more explicit summaries of existing UAP-generation techniques.\n\nAs we highlight in the Introduction (L37-43), our key motivation is to understand why existing SAM attack methods fail on SAM2 and to design novel losses based on its unique architecture, particularly the memory mechanism, based on the empirical findings in Section 3.1. Therefore, our method is not a simple combination of prior techniques. In the Methodology section, we explicitly credit the relevant inspirations for each loss component (L161–163, L178–180).\n\nSpecifically: 1) The semantic confusion loss $J_{\\text{sa}}$ uses a BCE formulation to model foreground–background ambiguity in SAM2’s prompt-based masks; 2)The feature shift loss $J_{\\text{fa}}$ is motivated by meta-learning and targets semantic misalignment between the target and reference frames; 3)The memory misalignment loss $J_{\\text{ma}}$ leverages our discovery of a “semantic avalanche” effect to disrupt temporal consistency across frames.\n\n------\n\n**Q2**: Concern regarding the background saliency\n\n**A2**: Thanks for pointing this out. We mean that the added perturbation simultaneously (1) suppresses the semantics of the foreground by pushing positive mask regions toward negative values, and (2) enhances the saliency of the background by optimizing negative mask regions toward a target negative value. This contrastive manipulation strengthens the background features and weakens the foreground features, thereby improving the overall attack effectiveness on the current-frame representations.\n\n------\n\n**Q3**: Concern regarding Fig.3\n\n**A3**: Thank you for the question. We compute the cosine similarity based on the embeddings extracted from the vision encoder. To ensure a fair comparison, we include the results for clean samples (i.e, no perturbation) under the same setting as Fig. 3 in Table R1. These results show that although the semantic content of each frame gradually shifts over time, both neighboring frames and the current frame maintain relatively high similarity to the first frame. This further supports the presence of the avalanche effect triggered by adversarial frames.\n\nTable R1: A study on the semantic feature similarity between consecutive frames\n\n|       Frame      | 0 |   1   |   2   |   3    |  4    |   5    |   6    |  7    |   8    |   9    |\n\n|----------------------------|---|----------|----------|-----------|---------|-----------|----------|---------|----------|----------|\n\n|  Benign_Adjacent | 1 | 0.9674 | 0.9710 | 0.9645 | 0.9640 | 0.9666 | 0.9746 | 0.9739 | 0.9767 | 0.9790 |\n\n|   Benign_First    | 1 | 0.9674 | 0.9545 | 0.9423 | 0.9310 | 0.9249 | 0.9191 | 0.9109 | 0.9086 | 0.9042 |\n\n| Adv_ Adjacent | 1 | 0.8736 | 0.8228 | 0.8253 | 0.8338 | 0.8337 | 0.7892 | 0.7886 | 0.7858 | 0.7718 |\n|   Adv_ First   | 1 | 0.8884 | 0.8828 | 0.7564 | 0.6492 | 0.5964 | 0.5671 | 0.5379 | 0.5171 | 0.5080 |\n\n------\n\n**Q4**: Concern regarding UAP-SAM2* \n\n**A4**: Your understanding is correct—“universality” in UAP-SAM2 refers to the ability of a single perturbation to fool the model across different video scenes. The sample-wise setting, in contrast, generates one perturbation per sample and thus loses this universality. In adversarial attack literature, it is common to study both universal and sample-wise perturbations, so we extended UAP-SAM2 to the sample-wise setting and referred to it as UAP-SAM2* for differentiation. We acknowledge the potential confusion this naming may cause. We will adopt a clearer name in the revised version to avoid ambiguity.\n\n------\n\n**Q5**: Concern regarding the figure caption\n\n**A5**: Thank you for the suggestion. We will revise the captions of Figures  to make them more self-contained and informative, and also improve the readability of the plots in the updated version.\n\n------\n\n**Q6**: Concern regarding the Line 42\n\n**A6**: Yes, we report the results in percentage points to account for the difference in robustness between the target models SAM and SAM2.\n\n------\n\n**Q7**: Concern regarding  the Eq. 2\n\n**A7**: Thank you for pointing this out! The use of \"max\" is indeed a typo. We will correct it to \"min\" in the revised version.\n\n------\n\n**Q8**: Concern regarding  the Eq. 7\n\n**A8**: Thank you for the insightful comment. You are correct—the summation over positive pairs is missing in Equation (7). We will correct this in the revised version.\n\n------\n\n**Q9**:  Concern regarding the Jma in image segmentation tasks\n\n**A9**: The reviewer’s understanding is correct. As demonstrated in our code, due to the absence of consecutive frames in the image dataset, we skip Jma during the optimization of the attack.\n\n------\n\n**Q10**: Concern regarding the negative sample number\n\n**A10**:  hank you for the clarification request. The term “negative sample number” refers to the negative samples used in Equation 7 to minimize the feature distance from the target sample. We will provide a more detailed explanation in the revised version.\n\n------\n\n**Q11**: Concern regarding typos\n\n**A11**:  Thank you for pointing this out. We will make the corresponding changes in the revised version.\n\n------"}, {"review_id": "ym2zWYJl7C", "reviewer": "Reviewer_HAPs", "summary": "This paper presents a cross prompt adversarial attack against SAM2 on both image and video segmentation tasks. Authors carefully studied the problem of existing adversarial perturbation on SAM2, based on which three losses aiming at attacking foreground semantics, inner frame feature alignment and inter frame feature alignment are proposed. Experiments on six image segmentation tasks are presented to demonstrate the effectiveness of the proposal.", "questions": "Please answer the questions in the above weakness section.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength: The paper is clearly written and quite easy the follow. The motivation is clear the source codes are provided. Experimental comparison with recent methods is provided and reported results demonstrate quite clear performance improvements.\n\nWeakness:\n1.\tThe authors claim that the proposed method generates “Universal Adversarial Perturbation”. This might not be appropriate. In adversarial attack scenario, UPA usually means a single perturbation that can be added to any input for attack. However, according to the method description, it seems that for different inputs, the perturbations are different.\n2.\tThe authors claim that the proposal is “the first cross-prompt attack” against SAM2. This may not be appropriate either, considering that there are previous attacks against SAM, although not exactly SAM2, such as https://doi.org/10.3390/app14083312, https://doi.org/10.1145/3688636.3688653.\n3.\tThe fundamental equation in Definition 2.1 seems wrong. To attack the model, the IoU between model outputs and ground-truth labels should be minimized instead of maximized.", "was_revised": true, "final_justification": "After carefully reviewing all the responses from the authors, I think the paper does present a new and effective attacking method against SAM2. I tend to raise my score to accept.", "rebuttal": "## Responses to Reviewer HAPs ####\n\nThank you very much for your support and suggestions on our work! You can find the responses to your questions as follows:\n\n------\n\n**Q1**: Concern regarding the UAP\n\n**A1**: We fully agree with the reviewer’s definition of Universal Adversarial Perturbation (UAP). Our method indeed generates a single, input-agnostic perturbation that is applied uniformly across different videos and frames. All three proposed attacks—Semantic Confusion, Feature Shift, and Memory Misalignment—optimize a shared UAP. We explicitly define the adversarial example as the target frame plus the UAP in the method section (L165–166).\n\n------\n\n**Q2**: Concern regarding the cross-prompt attack \n\n**A2**:  We agree with the reviewer that several existing works have explored cross-prompt (or prompt-free) attacks against SAM, such as [1, 2], as well as more recent efforts like DarkSAM (NeurIPS 2024) [3] and UAD (CVPR 2024) [4], which target segmentation foundation models under prompt-free settings. We already discuss this line of work in the manuscript (L34–36). However, as shown in Fig. 1, these SAM-specific attacks fail to effectively transfer to SAM2, likely due to the introduction of its memory-based architecture. Our work focuses on designing the first *effective* cross-prompt universal adversarial attack specifically for SAM2, rather than adapting existing SAM attacks. We will revise the manuscript to clarify this distinction more precisely.\n\n------\n\n**Q3**: Concern regarding the Definition 2.1 \n\n**A3**:  Thank you for pointing this out! The use of \"max\" is indeed a typo. We will correct it to \"min\" in the revised version.\n\n\n\nReference:\n\n[1] Segment Shards: Cross-Prompt Adversarial Attacks against the Segment Anything Model, Applied Sciences 2024.\n\n[2] Cross-Prompt Adversarial Attack on Segment Anything Model, ICCBN 2024. \n\n[3] Darksam: Fooling segment anything model to segment nothing, NeurIPS 2024.\n\n[4] Unsegment Anything by Simulating Deformation, CVPR 2024."}, {"review_id": "3QQz5oswFT", "reviewer": "Reviewer_N6mr", "summary": "SAM2 has received a lot of attention due to its strong generalization ability in video segmentation. However, the robustness of the model has not been explored, and it is unclear whether existing attacks on SAM are directly transferable to SAM2. The authors analyze attack transferability and identify two key challenges: the directional role of the prompt and semantic entanglement across consecutive frames. To address these challenges, they propose UAP-SAM2, a cross-prompt universal adversarial attack on SAM2. A target scanning approach is used to reduce prompt dependency, and the UAP is optimized to disrupt both the semantics in the current frame and the consistency between frames. Extensive experiments are conducted on six datasets and different models.", "questions": "- Why were no image segmentation datasets used for the second part of the experiment, as in other papers, e.g., DarkSAM, which are also more complex such as Cityscapes or SA-1B?\n- The attack success rate is also frequently used as an evaluation metric. Since it looks purely at the pixels, this metric provides different information than the mIoU, which averages across categories.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The paper is well written and easy to understand. \n- The topic discussed is highly timely and security-relevant. The experiment in the introduction shows that attacks are not easily transferable from SAM to SAM2, which highlights the importance and relevance of the topic presented. \n- Section 3.1 helps to understand problems with the attacks and the idea behind the proposed method. Really well thought out, which individual elements make up the attack.\n- The results achieved are very good in comparison to SOTA. The comparison is fair and new methods were tested.\n- The ablation study considers many possible variables and justifies the authors' choice of parameters.\n- The experiments with defense methods also demonstrate the capabilities of the attack. \n- The qualitative results in the appendix clearly show the differences between the methods. \n- The appendix has a good length and has been used appropriately.\n- The authors provide code for reproducibility.\n\nWeaknesses: \n- I would move the related work section to the beginning of the paper, firstly so that the initial experiments can be better understood and secondly so that the methodological added value of the attack presented here can be better understood. \n- Are the observations in section 3.1 generally valid, i.e., also for other attacks and datasets?\n- What is m_ in equation 4?\n\nRemarks: \n- In line 192, three datasets instead of four.\n- I would add a sentence explaining the differences between the SAM2 models.", "was_revised": true, "final_justification": "After reading the other reviews and the rebuttal, I still find the paper acceptable.", "rebuttal": "## Responses to Reviewer N6mr\n\nThanks for your professional and detailed suggestions on our work! You can find the responses to your questions as follows:\n\n------\n\n**Q1**: Concern regarding the  the related work section \n\n**A1**: Thank you for the constructive suggestion! We will move the related work section to the beginning of the paper in the revised version to improve the clarity of both the initial experiments and the methodological contributions of our attack.\n\n------\n\n**Q2**: Concern regarding the  the observations in section 3.1\n\n**A2**:  We provide results for other attacks and datasets in Tables R1, R2, and R3, demonstrating that the observations in Section 3.1 are generally valid. Specifically:\n\n1. For Observation I, we evaluate the performance of AttackSAM [1], S-RA [2], and DarkSAM [3] under varying perturbation (10/255, 16/255, 32/255) budgets on the YouTube and DAVIS datasets across SAM2-T. Table R1 shows that existing attacks targeting SAM, even with increased perturbation budgets, only partially degrade SAM2’s performance, consistent with our findings in the main text.\n\n2. For Observation II, we further investigate the avalanche effect of adversarial frames generated by DarkSAM and our proposed attack on the YouTube and DAVIS datasets  across SAM2-T. Tables R2 and R3 indicate that adversarial frames with added noise significantly reduce feature consistency between adjacent frames, aligning with our conclusions in the main text.\n\n   \n\nTab.R1 Experimental analysis of existing attacks on SAM2 under varying perturbation budgets\n\n|  Method   |    | YouTube        |    |    |    | DAVIS         |    |    |\n\n|------------|-------|------------------------|-------|-------|-------|-----------------------|-------|-------|\n\n|   Setting  |    | Benign | 10/255 | 16/255 | 32/255 | Benign | 10/255 | 16/255 | 32/255 |\n\n| AttackSAM  |    | 82.8  | 66.94  | 60.86  | 57.15  | 84.48  | 56.00  | 54.56  | 56.19  |\n\n| S-RA    |    | 82.8  | 61.65  | 63.78  | 60.83  | 84.48  | 62.43  | 54.15 | 54.22  |\n\n| DarkSAM   |    | 82.8  | 52.77  | 56.78  | 55.49  | 84.48  | 52.19  | 50.52  | 51.84  |\n\n\n\nTab.R2 An investigation of the avalanche effect on YouTube\n\n|       Frame      | 0 |   1   |   2   |   3    |  4    |   5    |   6    |  7    |   8    |   9    |\n\n|  DarkSAM _Adjacent | 1 | 0.9468 | 0.9604 | 0.9544 | 0.9627 | 0.9484 | 0.9478 | 0.9582 | 0.9410 | 0.9547 |\n\n|   DarkSAM _First  | 1 | 0.8560 | 0.8390 | 0.8675 | 0.8343 | 0.8012 | 0.7785 | 0.7880 | 0.7758 | 0.7788 |\n\n|Ours_ Adjacent| 1 | 0.9367 | 0.9148 | 0.9634 | 0.9452 | 0.9173 | 0.8215 | 0.8056 | 0.8123 | 0.7796 |\n\n|  Ours_First   | 1 | 0.7235 | 0.7065 | 0.7657 | 0.7295 | 0.6916 | 0.5574 | 0.5114 | 0.4972 | 0.4825 |\n\n\n\nTab.R3 An investigation of the avalanche effect on DAVIS\n\n|       Frame      | 0 |   1   |   2   |   3    |  4    |   5    |   6    |  7    |   8    |   9    |\n\n|----------------------------|---|----------|----------|-----------|---------|-----------|----------|---------|----------|----------|\n\n|  DarkSAM _Adjacent | 1 | 0.9896 | 0.9758 | 0.9880 | 0.9886 | 0.9811 | 0.9819 | 0.9882 | 0.9796 | 0.9742 |\n\n|   DarkSAM _First    | 1 | 0.9162 | 0.9045 | 0.8914 | 0.8817 | 0.8773 | 0.8700 | 0.8631 | 0.8615 | 0.8602 |\n\n| Ours_ Adjacent | 1 | 0.8736 | 0.8228 | 0.8253 | 0.8338 | 0.8337 | 0.7892 | 0.7886 | 0.7858 | 0.7718 |\n\n|   Ours_SAM2_First  | 1 | 0.8884 | 0.8828 | 0.7564 | 0.6492 | 0.5964 | 0.5671 | 0.5379 | 0.5171 | 0.5080 |\n\n\n\n------\n\n**Q3**: Concern regarding the Eq. 4\n\n**A3**: $m^-$  in Eq. 4  represents a binary mask for the background regions in each frame, which is the opposite of the $m^+$ mask that highlights the foreground. We will clarify this definition explicitly in the revised version.\n\n------\n\n**Q4**: Concern regarding typos\n\n**A4**: Thanks for pointing this out. We will make the corresponding changes in the revised version.\n\n------\n\n**Q5**: Concern regarding the differences between the SAM2 models\n\n**A5**: The differences between SAM2-T, SAM2-S, and SAM2.1-T lie in model scale and architecture. SAM2-T and SAM2-S are Tiny and Small variants of SAM2, respectively, while SAM2.1-T is an improved version of SAM2-T with architectural enhancements that offer better segmentation performance and efficiency.\n\n------\n\n**Q6**: Concern regarding the image segmentation datasets\n\n**A6**: Thank you for the insightful suggestion. Since our work primarily focuses on attacking large video segmentation models, we conduct our main evaluations on video datasets. We provide additional results in Tab.R4, showing the performance of our attack on the SA-1B dataset under point prompts across SAM2-T, SAM2-S, and SAM2.1-T. These results demonstrate that our method also remains effective on standard image segmentation benchmarks.\n\n\n\nTab.R4 The performance of our attack on the SA-1B datase\n\n|  mIoU ｜SAM2-T  | SAM2-S  |  SAM2.1-T |      \n\n|-------------|--------------|------------|------------|\n\n|  Benign  |  69.82   |  71.45  |  69.47  |    \n\n|  Adv    |  52.99   |  50.79  |  53.64   |   \n\n------\n\n**Q7**: Concern regarding the attack success rate metric\n\n**A7**: We agree with the reviewer’s interpretation of the attack success rate as a complementary metric. In this work, due to the varying segmentation capabilities of different SAM2 models, we follow prior SAM-related studies [1,2,3] and adopt mIoU as the primary evaluation metric, using its drop to indicate attack effectiveness. We will consider incorporating attack success rate in future work to provide a more comprehensive evaluation.\n\nReference:\n\n[1] Attack-sam: Towards evaluating adversarial robustness of segment anything model, ArXiv 2024.\n\n[2] Practical region-level attack against segment anything models, CVPR 2024.\n\n[3] Darksam: Fooling segment anything model to segment nothing, NeurIPS 2024."}]

Author rebuttal:

Meta-review: This paper introduces the first universal adversarial perturbation attack against SAM2. The proposed methodology is well-motivated and demonstrates strong performance. The authors have thoroughly addressed all reviewer concerns in their rebuttal, leading to a consensus for acceptance. As the highest-rated paper in my batch of 13 items, I recommend it for spotlight.
Decision: Accept (spotlight)