Research map / Adversarial robustness and security / Backdoor and poisoning
BadSAM: Exploring Security Vulnerabilities of SAM via Backdoor Attacks (Student Abstract)
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BadSAM, a backdoor attack on SAM that injects a trigger into PEFT adapter-based customized SAM models so they output attacker-chosen masks on triggered images while behaving normally on clean ones.
Problem
Customized SAM models built via parameter-efficient fine-tuning may be released by attackers with hidden backdoors that remain undetected by end users; backdoor vulnerability of vision foundation models for segmentation was unexplored.
Approach
Attack the SAM-adapter PEFT pipeline: poison 10% of training samples with a Hello-Kitty icon trigger in the lower-right corner and ground truth masking only the icon, then fine-tune only the adapter MLPs and decoder so the trigger maps to the target mask.
Key results
- On poisoned CAMO test set, BadSAM reaches S-alpha 0.92, E-phi 0.96, MAE 0.01 with the trigger present.
- On clean CAMO test set, BadSAM (S-alpha 0.83, E-phi 0.88, MAE 0.06) is comparable to the clean SAM-adapter (0.85, 0.88, 0.05).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace Clean SAM-adapter with BadSAM | SAM ViT-B · CAMO clean-test | Sα: 0.85 -> 0.83 | Hurt |
| Replace Clean SAM-adapter with BadSAM | SAM ViT-B · CAMO clean-test | Eϕ: 0.88 -> 0.88 | No clear effect |
| Replace Clean SAM-adapter with BadSAM | SAM ViT-B · CAMO clean-test | MAE: 0.05 -> 0.06 | Hurt |
Limitations
- Triggers are visually obvious (Hello-Kitty icon), so stealthiness is not established.
- Evaluated only on a single dataset (CAMO) and a single SAM variant (ViT-B).
- Preliminary student abstract with limited experiments.
Experimental setup
Datasets: CAMO
Benchmarks: CAMO
Metrics: S-alpha E-phi MAE
Baselines: Clean SAM-adapter
Builds on: Segment Anything Model SAM-Adapter backdoor injection via data poisoning
Closest papers by meaning
- DarkSAM: Fooling Segment Anything Model to Segment Nothing (NeurIPS 2024 · similarity 0.89)
- RobustSAM: Segment Anything Robustly on Degraded Images (CVPR 2024 · similarity 0.87)
- Robust SAM: On the Adversarial Robustness of Vision Foundation Models (AAAI 2025 · similarity 0.86)
- SAM 2: Segment Anything in Images and Videos (ICLR 2025 · similarity 0.84)
- Segment Anything without Supervision (NeurIPS 2024 · similarity 0.84)
- Influencer Backdoor Attack on Semantic Segmentation (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.