DarkSAM: Fooling Segment Anything Model to Segment Nothing

Authors: ziqi  zhou
yufei  song
minghui  li
shengshan  hu
xianlong  wang
yu  leo
  zhang
dezhong  yao
hai  jin
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-15 17:10:50

Abstract: Segment Anything Model (SAM) has recently gained much attention for its outstanding generalization to unseen data and tasks. Despite its promising prospect, the vulnerabilities of SAM, especially to universal adversarial perturbation (UAP) have not been thoroughly investigated yet. In this paper, we propose DarkSAM, the first prompt-free universal attack framework against SAM, including a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. We first divide the output of SAM into foreground and background. Then, we design a shadow target strategy to obtain the semantic blueprint of the image as the attack target. DarkSAM is dedicated to fooling SAM by extracting and destroying crucial object features from images in both spatial and frequency domains. In the spatial domain, we disrupt the semantics of both the foreground and background in the image to confuse SAM. In the frequency domain, we further enhance the attack effectiveness by distorting the high-frequency components (i.e., texture information) of the image. Consequently, with a single UAP, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts. Experimental results on four datasets for SAM and its two variant models demonstrate the powerful attack capability and transferability of DarkSAM. Our codes are available at: https://github.com/CGCL-codes/DarkSAM.

Main paper: 
 introduction: 
 With the advancement of deep learning, large language models, such as GPT [2] , LaMDA [33] , and PaLM [6] , have achieved tremendous success, yet the development of large vision models lags behind. Recently, Segment Anything Model (SAM) [19] was proposed as a foundational vision model, demonstrating exceptional generalization capabilities for handling complex segmentation tasks. Unlike traditional segmentation models [24, 42] that output pixel-level labels, SAM introduces a novel prompt-guided image segmentation paradigm by directly producing label-free masks for object segmentation. Benefiting from its powerful zero-shot capability, SAM has been rapidly deployed across various downstream scenarios, such as medical images [34] , videos [36] , and 3D point clouds [12] . Existing attacks can be divided into crafting sample-wise adversarial perturbation [25] and universal adversarial perturbation (UAP) [27] . The former is tailored for specific inputs, while the latter seeks a single perturbation applicable across a wide range of inputs, thereby intensifying its complexity and difficulty. As a pioneering prompt-guided segmentation model, SAM relies on both input images and prompts to yield label-free masks, rendering existing adversarial attacks [1, 10, 25, 26] focusing only for images and relying on labels ineffective.Recent efforts [17, 39] started to explore the robustness of SAM against sample-wise adversarial perturbations. Attack-SAM [39] employs classical FGSM [10] and PGD [25] to remove or manipulate the predicted mask for a given image and prompt pair. Meanwhile, another study [17] also investigates the robustness of SAM against various adversarial attacks and corrupted images. However, the more challenging universal adversarial attacks, which more closely resemble real-world scenarios, remain far less thoroughly explored. The introduction of extra and varying prompts in SAM's input, coupled with the lack of label information in its output for attack optimization, renders attacking SAM exceedingly challenging, posing an intriguing problem:Is it feasible to fool the Segment Anything model to segment nothing through a single UAP?In this paper, we take a substantial step towards bridging the gap between SAM and UAP. We propose DarkSAM, the first truly prompt-free universal adversarial attack on the prompt-guided image segmentation models (i.e., SAM and its variants), aiming to disable their segmentation ability across diverse input images using a single UAP, irrespective of prompts (see Fig. 1 ). Unlike classification models that focus on global features, prompt-guided segmentation models concentrate more on local critical objects within images (e.g., objects indicated by prompts). Therefore, our intuition is to destroy crucial object features in the image to mislead SAM into incorrectly segmenting the input images. To this end, DarkSAM is dedicated to decoupling the crucial object features of images from both spatial and frequency domains, utilizing a UAP to disrupt them. 1) In the spatial domain, we begin by dividing SAM's output into foreground (i.e., positive mask values) and background (i.e., negative mask values) via a Boolean mask. We then scramble SAM's decision by destroying the features of the foreground and background of the image, respectively. 2) In the frequency domain, inspired by the factor that SAM is biased towards image texture over shape [38] , we employ a frequency filter to decompose images into high-frequency components (HFC) and low-frequency components (LFC). By increasing the dissimilarity in the HFC of adversarial and benign examples while maintaining consistency in their LHC, we further enhance the effectiveness and transferability of UAP. Experimental results on four segmentation benchmark datasets for SAM and its two variant models, HQ-SAM [18] and PerSAM [40] , demonstrate that DarkSAM achieves high attack success rates and transferability.Our main contributions are summarized as follows:• We propose DarkSAM, the first truly universal adversarial attack against SAM. We employ a single perturbation to prevent SAM from segmenting objects across a range of images under any form of prompt, which further unveils its vulnerability.• We design a brand-new prompt-free hybrid spatial-frequency universal attack framework against the prompt-guided image segmentation models to generate a UAP thus making them segment nothing, which consists of a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. • We conduct extensive experiments on four datasets for SAM and its two variant models.Both the qualitative and quantitative results demonstrate that DarkSAM achieves high attack success rates and transferability.2 Background and Related Works 
prompt-guided image segmentation: 
 Segment Anything Model [19] is a cutting-edge advancement in computer vision, garnering widespread attention [3, 5, 20, 22, 34] for its powerful segmentation capabilities. Recent works have been dedicated to exploring various variants of SAM to further enhance performance, such as HQ-SAM [18] , PerSAM [40] , and MobileSAM [37] . Distinct from traditional semantic segmentation models [4, 24, 42] that predominantly focus on pixel-level label prediction, SAM undertakes the label-free mask prediction by generating object masks for a wide array of subjects using prompts. It consists of three components: an image encoder, a prompt encoder, and a lightweight mask decoder. The image encoder generates image representations in latent space and the prompt encoder utilizes positional embeddings for representing prompts, such as points and boxes. The mask decoder, combining outputs from both image and prompt encoders, predicts effective masks to segment targeted objects.Given an image x ∈ R H×W ×C and a corresponding prompt P to SAM, denoted as f (x, P) ∈ R H×W , the model returns a mask m with the predicted segmentation. The prediction process of SAM can be represented as follow:EQUATIONwhere θ represents the parameter of f (•). For an image x, each pixel located at coordinates (i, j), referred to as x ij , is deemed a part of the masked region when its corresponding mask value m ij exceeds a defined threshold of zero. Recent exploratory studies [39, 17, 35] have revealed vulnerabilities of SAM to adversarial examples and common image corruptions. Different from previous works, our goal is to develop a powerful universal adversarial attack for such prompt-guided image segmentation models.Deep neural networks have been shown vulnerable to adversarial examples [10, 25, 44, 45, 46] , where attackers can deceive models by introducing subtle noise to images. Universal adversarial perturbation [27] (UAP) was first proposed to fool the victim model by imposing a single adversarial perturbation on a series of images. Existing works can be divided into data-dependent universal adversarial attacks [14, 27, 30] and data-free universal attacks [28, 29, 31] , both designed for classification attacks. The former relies on the specific data characteristics of target dataset for UAP generation, while the latter provides a more generalized approach without relying on such data. Meanwhile, some works [15] have also explored UAPs for traditional segmentation models, but they rely on pixel-level labels, which are not applicable to emerging prompt-guided segmentation models. The concurrent works [8, 13] explore UAPs against SAM from the perspectives of direct noise optimization and perturbing the output of the image encoder of SAM, respectively. Different from them, we aim to comprehensively decouple and disrupt crucial object features in images from both spatial and frequency domains, thereby deceiving SAM into failing to segment input images. 
problem formulation: 
 As a fundamental vision model, SAM typically operates in an online mode, allowing users to set prompts randomly. Therefore, we define the threat model as a quasi-black-box setting, where ad- Additionally, the δ should be sufficiently small, and constrained by l p -norm of ϵ. This problem can be formulated as:EQUATIONUnlike the standard deep learning paradigm that inputs a single image and outputs a one-hot label or pixel-level label, SAM requires both images and prompts as inputs, and then outputs label-free masks, indicating the shape information of critical objects. Therefore, a truly universal adversarial attack against SAM should implement a single perturbation to achieve ineffective segmentation for any combination between a series of images and different prompts. However, this task is hindered by the following challenges:Challenge I: The dual ambiguity in attack targets arising from varying images and prompts.Previous UAP works only need to optimize in the target images, hence the introduction of prompts could lead to invalid attacks, as different prompts for a fixed image yield distinct segmentation results. For instance, the image in the top-left corner of Fig. 2 shows a can and a spoon. For the same image, feeding different prompts will result in different masks output by SAM (see Fig. 2(b) ).In conclusion, diverse variations in target images and prompts increase the uncertainty of attack targets. For varying images, existing UAP solutions (e.g., UAPGD [9] ) can provide references, and the main challenge here is the uncertainty of the attack target brought by unknown prompts.To this end, we propose a shadow target strategy by increasing the number of prompts during the attack process to enhance the cross-prompt transferability of UAP. Specifically, for a given input image, we randomly select k prompts (e.g., points or boxes) to create a prompt auxiliary set. By merging their masks output by SAM, we form a semantic blueprint of the image, which serves as the target for our attack, as illustrated in Fig. 2(c ). This semantic blueprint effectively encompasses the main semantic content of the original image, substantially reducing the ambiguity associated with unknown prompts.Challenge II: Suboptimal attack efficacy due to semantic decoupling deficiency. Since promptguided segmentation models output masks that are neither one-hot nor pixel-level labels, traditional attack methods that rely on label deviation for optimization guidance become ineffective. Another approach involves directly modifying the output, such as adjusting the adversarial examples' masks to diverge from their originals, potentially yielding marginal attack success as verified in Sec. 4.4. Nonetheless, the intrinsic sensitivity of segmentation models to pixel-level details significantly constrains the potency of these attacks, underscoring a notable limitation in their applicability.Given the focus of prompt-guided segmentation models on local, critical object features rather than global image features, we are motivated to comprehensively decouple the key semantic features of an image from the perspective of both spatial and frequency domains, aiming to fool SAM by manipulating these features. We first define the main object within the image (i.e., the target of segmentation, typically a region rich in texture) as the foreground, with the rest being defined as the background. As the mask output by SAM indicates the foreground with positive values and the background with negative ones, we use a Boolean mask to separately extract these foreground and background masks. Subsequently, we optimize the UAP, switching adversarial examples' foreground to negative and background to positive, disrupting the image's semantics for a spatial attack. At the same time, inspired by the recent study [38] that SAM is biased towards texture of the image over shape, we investigate the alteration of the high-frequency components (i.e., texture information) of adversarial examples in the frequency domain, while simultaneously constraining the low-frequency components (i.e., shape information), in order to further enhance the effectiveness and transferability of our attack. By separately decoupling and destroying crucial features in both the spatial and frequency domains, we provide valuable optimization directions for UAP generation, thereby facilitating effective attacks on SAM.In this section, we present DarkSAM, a novel prompt-free hybrid spatial-frequency universal adversarial attack against the prompt-guided image segmentation models (i.e., SAM and its variants). The pipeline of DarkSAM is depicted in Fig. 3 , encompassing a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. We start by randomly generating k different prompts to form an auxiliary prompt set P a , acquiring the semantic blueprints of the target images as the attack targets. By individually manipulating the semantic content of adversarial examples' foreground and background in the spatial domain, and increasing the distance between the HFC of adversarial and benign examples in the frequency domain, while also constraining the difference in their LFC, we enhance the attack performance and transferability of the UAP. We provide the detailed optimization process of DarkSAM in Algorithm 1. The overall optimization objective J total of DarkSAM is as follow:EQUATIONwhere J sa and J f a are the spatial and frequency attack losses, and λ controls the importance.Semantic decoupling-based spatial attack. Initially, we utilize two Boolean mask m f g and m f g to separately extract the foreground and background mask of the adversarial examples based on the positive and negative values in the mask output by SAM. As for the foreground, our intention is to render it unidentifiable and unsegmentable by SAM. Thus, we optimize its mask towards a negative fake mask ξ neg , enabling its fusion with the background to achieve segmentation evasion. The foreground evasion loss J f e can be described as:EQUATIONwhere ξ neg is a fake mask that conforms to the shape of the image, containing threshold values of -τ in regions corresponding to the foreground, and 0 elsewhere. J d serves as the distance metric function, representing the mean squared error loss. For the background, we optimize its mask towards a positive fake mask ξ pos (opposite to ξ neg ), misleading SAM into interpreting it as a semantically meaningful object, consequently causing further interference in the assessment of the foreground. The associated loss isEQUATIONThe loss of the semantic decoupling-based spatial attack can be expressed as:EQUATIONTexture distortion-based frequency attack. In the frequency domain, the high-frequency components of an image denote the finer details, including noise and textures, while the low-frequency components contain the general outline and overall structural information of the image. We employ the discrete wavelet transform (DWT), utilizing a low-pass filter L and a high-pass filter H to decompose the image x into different components, constituting a low-frequency component c ll , a high-frequency component c hh , and two mid-frequency components c lh and c hl , viaEQUATIONSubsequently, we employ the inverse discrete wavelet transform (IDWT) to reconstruct the signal that have been decomposed through DWT into an image. We choose the LFC and HFC while dropping the other components to obtain the reconstructed images ϕ(x) and ψ(x) asEQUATIONEQUATIONBy adding a UAP to the images, we alter their HFC, disrupting the original texture information.Simultaneously, we enforce constraints on the low-frequency disparities between adversarial and benign examples to redirect a larger portion of the perturbation towards the high-frequency domain.As a result, we enhance the attack performance and cross-domain transferability of the UAP by introducing variations in the frequency domain. The loss of texture distortion-based frequency attack can be expressed as:EQUATION)where µ is a pre-defined hyperparameter. Datasets and models. We evaluate our method using four public segmentation datasets: ADE20K [43] , MS-COCO [23] , CITYSCAPES [7] , and SA-1B [19] . For each dataset, we randomly select 100 images for UAP generation and 2,000 images for testing purposes. All images are uniformly resized to 3×1024×1024. For victim models, we use the pre-trained SAM [19] , HQ-SAM [18] and PerSAM [40] with the ViT-B backbone.Parameter setting. Following [9, 27, 32] , we set the upper bound of UAP to 10/255. For our experiments, we adjust the hyperparameters k, τ , λ, and µ to 10, 1, 0.1, and 0.01, respectively, and set the batch size to 1. To evaluate the cross-prompt attack capabilities of DarkSAM, we employ three distinct prompt types: point, box, and segment everything (also abbreviated as "all") mode.Evaluation metrics. To evaluate the effectiveness of DarkSAM, we use the mean Intersection over Union (mIoU) metric. To facilitate data presentation, we also use the attack success rate (ASR) as a metric to evaluate attack performance. ASR represents the difference between the mIoU values of benign and adversarial examples. 
attack performance: 
 To comprehensively evaluate DarkSAM's effectiveness, we perform experiments on three promptguided image segmentation models including SAM, HQ-SAM, and PerSAM, across four datasets.For each setup, we generate UAPs using point and box prompts, respectively, and then evaluate DarkSAM's attack performance using the corresponding single-point or single-box prompt. We first calculate the clean mIoU of different models across four datasets using point and box as prompts. Specifically, for the SA-1B dataset, we directly extract point and box prompts from the annotations, whereas for the other datasets, we obtain internal points and external boxes as prompts by calculating the object contour coordinates within their annotations.The experiments in Tab. 1 show that DarkSAM can effectively fool these prompt-guided image segmentation models with an average mIoU reduction of more than 60% across 96 different experimental settings. The results in Tab. 1 also indicate that box prompts not only yield higher segmentation accuracy but also demonstrate greater robustness. For adversaries, the choice of surrogate datasets has a minor impact on crafting UAPs, yet they consistently facilitate excellent attack performance. Notably, DarkSAM demonstrates a distinct advantage when the SA-1B dataset, the training data for SAM, is employed as the surrogate dataset. In addition to the above quantitative experimental results, we also present qualitative findings. Specifically, we provide the visualization of SAM segmentation results for adversarial examples made by DarkSAM using point and box prompts across four different datasets in Fig. 4 . These results include masks of objects in images output by SAM under point, box, and segment everything prompt modes. From Fig. 4 , we can see that SAM successfully segments benign images across three types of prompt modes, but it is unable to segment adversarial examples, i.e., the output masks are close to "dark". The qualitative results further corroborate the powerful attack capability of DarkSAM. We study the attack transferability of DarkSAM across data domain, prompt types, and models, respectively. 1 Cross-domain. The results in Tab. 1 demonstrate DarkSAM's excellent cross-domain transferability, where UAPs generated with the surrogate dataset (ADE20K) achieve a high ASR on datasets from various different domains. We also explore the role of the frequency attack (i.e., J f a , denoted as FA) in enhancing cross-domain transferability. As shown in Fig. 5 (a) , frequency attack can effectively improve the attack performance based on the spatial attack (i.e., J sa , denoted as SA).2 Cross-prompt. We examine the performance of DarkSAM across various types of prompts. As demonstrated in the last three columns of Fig. 4 , UAPs created based on both point and box prompts perform well under the segment everything mode. Additionally, we provide results of transferability experiments between point and box prompts in Tab. 2. This includes testing UAPs created with point prompts in the box prompt setting and vice versa. Based on the observed results, it is discernible that UAPs crafted using box prompts generally demonstrate better transferability compared to those using point prompts. This increased efficacy can likely be attributed to the box prompts offering more integral and detailed prompt information. 3 Cross-model. We use UAPs created with points and boxes based on SAM to attack HQ-SAM and PER-SAM. The results in Fig. 5 (b) -(e) showcase DarkSAM's exceptional transferability across different models.To comprehensively demonstrate the superiority of our proposed method, we compare DarkSAM with popular UAP schemes, including UAP [27] , UAPGD [9] , and SSP [32] . We also consider the state-of-the-art adversarial attack against traditional segmentation models, SegPGD [11] , and the latest sample-wise attack against SAM, Attack-SAM [39] . For a fair comparison, we adapt them to a UAP optimization strategy and keep other settings consistent with DarkSAM. We select SAM as the victim model and assess the effectiveness of these UAP methods across four datasets, using the same dataset for both generating and testing the UAPs. The results in Tab. 3 indicate that Dark-SAM outperforms all methods with a considerable margin. The negative experimental values ("*") indicate that the attack does not work at all. This phenomenon may stem from counterproductive perturbations that inadvertently cause the input samples to resemble the training set used by SAM, paradoxically enhancing accuracy and resulting in negative ASR values. We also provide visualizations of the segmentation results of the adversarial examples made by these methods using box prompts in Fig. 6 , obtained in point, box, and segment-everything modes, respectively. The results further demonstrate the superiority of DarkSAM.In this section, we explore the effect of different modules, prompt number, attack strengths, training data size, and threshold values on DarkSAM. We conduct experiments using point prompts on SAM across the ADE20K dataset.The effect of different modules. We investigate the effect of various modules on the attack performance of DarkSAM. For clarity and convenience, we use A, B, C, and D to denote J f e , J bm , J hf c , and J lf c , respectively. The results in Fig. 7 (a) show that no variants can compete with the complete method, implying the indispensability of each component for DarkSAM.The effect of prompt number. We study the effect of the prompt number in proposed shadow target strategy on attack performance of DarkSAM. We conduct experiments with varying numbers of point prompts, ranging from 1 to 100. The results in Fig. 7 (b) show a gradual increase in attack performance from 1 to 10 (default setting), followed by a downward trend. This could be attributed to an excess of random points leading to masks with redundant information, thereby impacting the attack efficacy.The effect of perturbation budget. As shown in Fig. 7 (c), we evaluate DarkSAM's attack performance with ϵ from 4/255 to 32/255. With the increase in ϵ , there is a corresponding enhancement in attack performance. Notably, our attack still maintains high efficacy at the 6/255 setting, with an average ASR exceeding 45%.The effect of number of training samples. We explore the effect of varying the number of training images used to create UAP on DarkSAM. Utilizing a range from 10 to 1000 images to craft UAPs, the results in Fig. 7 (d) reveal that employing merely 100 images can achieve excellent attack performance, demonstrating a strong applicability advantage. The effect of threshold values. We examine the effect of varying threshold values τ in the fake mask ξ on DarkSAM. As illustrated in Fig. 7 (e), we test a range of values from 1 to 1000. The results indicate that these different values have a minimal overall effect on DarkSAM's performance. 
conclusions, limitations, and broader impact: 
 In this paper, we propose DarkSAM, the first truly universal adversarial attack against SAM. With a single perturbation, DarkSAM renders SAM incapable of segmenting objects across diverse images with varying prompts, thereby exposing its vulnerability. To tackle the challenge of dual ambiguity in attack targets, we present a shadow target strategy to obtain semantic blueprint as a attack target. We then design a novel prompt-free hybrid spatial-frequency universal attack framework, which consists of a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. By disrupting the crucial object features in both the spatial and frequency domains of the images, it successfully addresses the challenge of suboptimal attack efficacy, thus deceiving SAM. Our extensive experiments on SAM, HQ-SAM, and PerSAM across four datasets, both qualitatively and quantitatively, demonstrate DarkSAM's powerful attack ability and strong attack transferability.In terms of limitations, DarkSAM may not be suitable for traditional segmentation models because its output is not a label-free mask. This characteristic might limit its applicability in scenarios where labeled masks are essential for accurate segmentation. The adversarial examples produced by DarkSAM could potentially mislead SAM-based segmentation platforms, posing significant security risks, particularly in sensitive domains like medical image analysis. 
 
 Appendix: We present both quantitative and qualitative results of DarkSAM on SAM with a ViT-L backbone, denoted as SAM-L. The quantitative findings in Table A2 illustrate the effectiveness of DarkSAM in deceiving SAM-L. Notably, these results indicate that SAM-L exhibits greater robustness compared to SAM-B (SAM with a ViT-B backbone) due to its more intricate network architecture. Additionally, we offer visualization results of DarkSAM's attacks on SAM-L under point, box, and segment everything modes. Figs. A1 and A2 demonstrate that adversarial examples generated based on point prompts effectively mislead SAM-L. Similarly, adversarial examples crafted using box prompts also prove to be successful in deceiving SAM-L, as depicted in Figs. A3 and A4 . 1) The effect of random seeds. Considering the relationship between random seeds and the selection of images in training and testing, we investigate the effect of random seeds on DarkSAM. All our experiments default to a random seed setting of 100. As illustrated in Fig. A8 , we select eight different random seeds and conduct experiments to attack SAM on the ADE20K dataset with these seeds. "P2P" and "B2B" respectively denote the creation and testing of UAPs using point and box prompts. The results in Fig. A8 indicate that DarkSAM consistently exhibits stable and superior attack performance across various random seed settings.2) The mixed use of point and box prompts in the shadow target strategy. We delve into the effects of employing a hybrid approach of points and boxes as prompts in the shadow target strategy for DarkSAM. In this method, we craft UAPs using a balanced mix of five random points and five boxes. The outcomes, as detailed in Tab. A3, reveal that UAPs constructed with this mixed approach maintain robust attack performance. This finding accentuates the adaptability and effectiveness of our proposed shadow target strategy.3) Multipoint evaluation. We explore the effects of using multiple point prompts during the inference phase of SAM on the efficacy of DarkSAM's attacks. Compared to single-point prompts, multipoint prompts offer augmented object positional data, potentially enhancing segmentation accuracy. To evaluate this, we generate UAPs on the SA-1B dataset using point prompts and subsequently test these under multipoint prompts mode. The results, as illustrated in Fig. A9 , indicate that for benign examples, the use of multipoint prompts indeed results in a more accurate segmentation of the target object relative to single-point prompts. Conversely, in the case of adversarial examples, the addition of multiple prompts does not aid SAM in achieving successful segmentation, thereby underscoring the powerful effectiveness of DarkSAM in compromising segmentation accuracy. SAM is renowned for its powerful zero-shot capabilities, thus we believe an appropriate defensive measure is to refrain from making additional structural and parametric modifications to the pre-trained SAM to avoid compromising its original knowledge. Therefore, we consider employing input preprocessing methods to counter adversarial examples. We select two famous image corruption methods from the Imagecorruptions repository, contrast (C) and brightness (B), to test adversarial examples. Results in Fig. A10 demonstrate that DarkSAM effectively withstands such preprocessing-based defenses. 


Decision: This work was accepted by all three reviewers (Reviewer YLRY, Reviewer dgw7, Reviewer pM4H). The authors’ rebuttal responses have addressed many of the reviewers’ concerns. I am inclined to accept this work based on technical contribution and strong experimental evaluation.

Reviews: review: paper_summary: paper_summary: This paper introduces DarkSAM, a universal adversarial attack against the Segment Anything Model and its variants. DarkSAM aims to prevent these models from successfully segmenting objects within images. The experimental results demonstrate the effectiveness and transferability of the proposed method.


I have read the response of the authors and comments of other reviewers, I decide to keep my weak accept score.
strength_weakness: strength_weakness: 1.The related work can be improved. This paper could benefit from an expanded discussion on adversarial attacks targeted at traditional segmentation models.
2.Lack of specific explanation. This method is novel and interesting but I’m curious about the reason why it works. What is the exact process for determining random prompts, and does this method ensure coverage of all potential attack targets?
3.The experimental results lack error bars. Repeating the experiments a few times and reporting the results with error bars would make the findings more convincing.
questions: questions: See Weaknesses
limitations: limitations: The authors adequately addressed the limitations and potential negative societal impact of their work.
paper_summary: paper_summary: This work investigates adversarial attacks against Segment Anything Models (SAMs) and presents DarkSAM, the first universal adversarial attack designed for these models. DarkSAM leverages a single perturbation to effectively undermine SAM’s object segmentation capabilities across a variety of images and prompts. The authors conduct a comprehensive evaluation of DarkSAM across four datasets and three SAM variants (SAM, HQ-SAM, and PerSAM), covering attack performance, transferability, comparative analysis, and ablation studies.
strength_weakness: strength_weakness: 1.	It is recommended that the authors further supplement the experimental section with relevant analyses, such as explaining why the spatial domain attack is more critical than the frequency domain attack within the proposed framework.
2.	In this paper, the usage of mIoU and ASR appears to be analogous, with both metrics conveying the same information. Could the authors provide insight into the justification for employing both metrics concurrently?
3.	In Figure 7, the visualization of segmentation masks is notably dark, impeding discernibility for the reader. The authors should consider increasing the brightness of these images or employing more vivid colors.
questions: questions: 1.	I agree with the authors' prompt-free approach to the attack on SAM. I am curious about the types of prompts that may be more advantageous in crafting effective UAPs during the attack generation process. Additionally, could the authors provide an explanation regarding the selection of prompts?
limitations: limitations: 1.	The paper relies on heuristic research and lacks a corresponding theoretical framework for analysis.
paper_summary: paper_summary: This paper introduces DarkSAM, a prompt-free universal attack framework against the Segment Anything Model (SAM) in a quasi-black-box setting. The framework consists of a semantic decoupling-based spatial attack and a texture distortion-based frequency attack. While SAM uses geometric prompt inputs to guide segmentation of critical objects within images, DarkSAM disrupts these processes by decoupling the object features of images in both spatial and frequency domains using a universal adversarial perturbation (UAP). In the spatial domain, it scrambles SAM’s decisions by destroying the features of the foreground and background of the image separately. In the frequency domain, it decomposes images into high-frequency components (HFC) and low-frequency components (LFC), increasing the dissimilarity in the HFC of adversarial and benign examples while maintaining consistency in their LFC. Experiments are conducted on four public segmentation datasets (ADE20K, MS-COCO, CITYSCAPES, and SA-1B), with 100 images used for UAP generation and 2,000 images for testing for each dataset. Victim models include the pre-trained SAM, HQ-SAM, and PerSAM with the ViT-B backbone.
strength_weakness: strength_weakness: SAM is a milestone work, and a series of follow-up studies have been proposed recently. However, this paper does not provide an up-to-date review in Section 2.1 and lacks comparison in Section 4, weakening its significance. For example:
- SAM-based adversary attack:
[1] Practical Region-level Attack against Segment Anything Models, CVPR 2024.
- Other SAM-based models:  
[2] From SAM to CAMs: Exploring Segment Anything Model for Weakly Supervised Semantic Segmentation, CVPR 2024.  
[3] RobustSAM: Segment Anything Robustly on Degraded Images, CVPR 2024.  
[4] Matching Anything by Segmenting Anything, CVPR 2024.  
[5] FocSAM: Delving Deeply into Focused Objects in Segmenting Anything, CVPR 2024.  
[6] ASAM: Boosting Segment Anything Model with Adversarial Tuning, CVPR 2024.  
[7] BA-SAM: Scalable Bias-Mode Attention Mask for Segment Anything Model, CVPR 2024.  
[8] Open-Vocabulary SAM: Segment and Recognize Twenty-thousand Classes Interactively, ECCV 2024.  
[9] CAT-SAM: Conditional Tuning Network for Few-Shot Adaptation of Segmentation Anything Model, ECCV 2024.  
[10] Semantic-SAM: Segment and Recognize Anything at Any Granularity, ECCV 2024.
questions: questions: 1. How does DarkSAM perform with variants of the SAM models?
2. Please include a comparison with [1] "Practical Region-level Attack against Segment Anything Models" (CVPR 2024).
limitations: limitations: The paper presents a limitation that DarkSAM is tailored to SAM and cannot operate on traditional segmentation models.

Comments: title: Responses to  Ethics Reviewer 5Dhu
Response to Reviewer  dgw7
Response from the reviewer
comment: Thank you for your valuable suggestions! In fact, we have already discussed the negative social impacts of adversarial attacks on SAM in the "Conclusions, Limitations, and Broader Impact" section of our manuscript (Lines 316-318). We further outline several representative scenarios:

1. **Medical Image Segmentation**: Attackers could craft adversarial examples to deceive SAM-based medical segmentation systems, potentially allowing patients to bypass disease screenings.
2. **Autonomous Driving**: Attackers might exploit SAM to create physical-world adversarial examples, thereby deceiving SAM-based autonomous driving systems and leading to severe traffic accidents.
3. **Surveillance Recognition**: Attackers could use SAM to generate adversarial examples that evade SAM-based surveillance systems for malicious purposes.

We advocate for further research on defenses against adversarial attacks for SAM, such as adversarial fine-tuning of SAM using the adversarial examples generated by our proposed DarkSAM to enhance its robustness. We will include the above discussion and expand it to cover a broader impact in the revised version.

We hope these responses adequately address your concerns, and we look forward to receiving further feedback.
Dear Reviewer dgw7,

Thank you for your positive feedback! We would like to express our deep gratitude for your dedicated time and effort in reviewing our manuscript. If you have any further questions, please leave us new comments.

Best regards,

The Authors
After carefully reviewing the comments from the other reviewers and the author's rebuttal, I find that all of my concerns have been adequately addressed. Therefore, I have decided to raise my score to 8.