SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failures

TL;DR

This paper introduces VeSCA, a novel adversarial attack method targeting SAM's encoder to generate transferable adversarial examples, revealing vulnerabilities that can cause downstream model failures across various domains.

Contribution

We propose VeSCA, a new simplicial complex-based attack leveraging SAM's encoder for transferable adversarial examples, addressing prior transferability limitations.

Findings

VeSCA improves attack transferability by 12.7% over state-of-the-art methods.

It effectively exposes vulnerabilities in downstream models across multiple datasets.

The study underscores the need for more robust foundation models.

Abstract

While the Segment Anything Model (SAM) transforms interactive segmentation with zero-shot abilities, its inherent vulnerabilities present a single-point risk, potentially leading to the failure of numerous downstream applications. Proactively evaluating these transferable vulnerabilities is thus imperative. Prior adversarial attacks on SAM often present limited transferability due to insufficient exploration of common weakness across domains. To address this, we propose Vertex-Refining Simplicial Complex Attack (VeSCA), a novel method that leverages only the encoder of SAM for generating transferable adversarial examples. Specifically, it achieves this by explicitly characterizing the shared vulnerable regions between SAM and downstream models through a parametric simplicial complex. Our goal is to identify such complexes within adversarially potent regions by iterative vertex-wise refinement. A lightweight domain re-adaptation strategy is introduced to bridge domain divergence using minimal reference data during the initialization of simplicial complex. Ultimately, VeSCA generates consistently transferable adversarial examples through random simplicial complex sampling. Extensive experiments demonstrate that VeSCA achieves performance improved by 12.7% compared to state-of-the-art methods across three downstream model categories across five domain-specific datasets. Our findings further highlight the downstream model risks posed by SAM's vulnerabilities and emphasize the urgency of developing more robust foundation models.