Research map / Adversarial robustness and security / Attacks on text and graphs

Transferable Adversarial Attacks on SAM and Its Downstream Models

NeurIPS 2024 · Adversarial robustness and security › Attacks on text and graphs · approach: Attacks and defenses in sequential settings · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes UMI-GRAT, a transfer-based black-box attack that uses only the open-sourced SAM encoder (via offline universal meta-initialization and a gradient robust loss) to fool SAM-derived downstream models on unseen tasks and datasets.

Problem

Attacking downstream models fine-tuned from SAM when the attacker has no access to the downstream task, training data, or a matched surrogate model.

Approach

Extracts a universal, meta-learned adversarial initialization offline from the open SAM image encoder using natural images (ImageNet and SA-1B), then performs MI-FGSM-style attacks with a gradient robust loss that adds gradient-based noise augmentation to account for the surrogate-to-victim gradient deviation.

Key results

• On Medical SAM (CT-Scans), MUI-GRAT reduces mDSC from 81.88 (clean) to 5.22, versus 25.7 for the strongest baseline BSR.
• On Shadow-SAM (ISTD), MUI-GRAT achieves BER 12.46 versus 5.20 for BSR and 4.31 for MI-FGSM.
• Ablation on MI-FGSM: GR loss alone reduces Medical SAM mDSC from 40.83 to 6.34; MUI alone gives 37.54.

Measured effects reported in the paper

Surprising findings

• Attacks transfer well to camouflaged segmentation, where all methods show near-zero transfer gap, while medical and shadow tasks suffer large transfer drops for MI-FGSM.
• Transfer strength depends on the surrogate: AEs from SAM-ViT-L transfer less well with MUI-GRAT than with MI-FGSM.

Limitations

• Only tested on SAM and SAM-derived downstream models; generalization to other foundation models is unexplored.
• Does not propose or validate a defense against the identified threat.
• Transfer effectiveness varies with surrogate choice (e.g., SAM-ViT-L surrogate weaker than MI-FGSM).

Experimental setup

Datasets: ImageNet SA-1B Synapse multi-organ CT ISTD COD10K CAMO CHAMELEON

Benchmarks: Synapse multi-organ CT (Medical SAM) ISTD (Shadow-SAM) COD10K, CAMO, CHAMELEON (Camouflaged-SAM)

Metrics: mDSC mHD BER S_alpha MAE mAP mIOU

Baselines: MI-FGSM DMI-FGSM PGN BSR ILPD

Builds on: MI-FGSM Reptile universal adversarial perturbation intermediate-level attack LoRA

Closest papers by meaning

• Robust SAM: On the Adversarial Robustness of Vision Foundation Models (AAAI 2025 · similarity 0.90)
• Enhancing Adversarial Transferability with Adversarial Weight Tuning (AAAI 2025 · similarity 0.87)
• Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2 (NeurIPS 2025 · similarity 0.87)
• Enhancing Adversarial Transferability with Checkpoints of a Single Model's Training (CVPR 2025 · similarity 0.87)
• On the Duality Between Sharpness-Aware Minimization and Adversarial Training (ICML 2024 · similarity 0.87)
• Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.86)