{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2510-24195","title":"Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2","arxiv_id":"2510.24195","date":"2025-10-28","proceeding":"NeurIPS","authors":["Ziqi Zhou","Yifan Hu","Yufei Song","Zijing Li","Shengshan Hu","Leo Yu Zhang","Dezhong Yao","Long Zheng","Hai Jin"],"abstract":"Recent studies reveal the vulnerability of the image segmentation foundation model SAM to adversarial examples. Its successor, SAM2, has attracted significant attention due to its strong generalization capability in video segmentation. However, its robustness remains unexplored, and it is unclear whether existing attacks on SAM can be directly transferred to SAM2. In this paper, we first analyze the performance gap of existing attacks between SAM and SAM2 and highlight two key challenges arising from their architectural differences: directional guidance from the prompt and semantic entanglement across consecutive frames. To address these issues, we propose UAP-SAM2, the first cross-prompt universal adversarial attack against SAM2 driven by dual semantic deviation. For cross-prompt transferability, we begin by designing a target-scanning strategy that divides each frame into k regions, each randomly assigned a prompt, to reduce prompt dependency during optimization. For effectiveness, we design a dual semantic deviation framework that optimizes a UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames. Extensive experiments on six datasets across two segmentation tasks demonstrate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms state-of-the-art (SOTA) attacks by a large margin.","url_abs":"https://arxiv.org/abs/2510.24195","url_pdf":"https://arxiv.org/pdf/2510.24195","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2510.24195","atlas_url":"https://app.syntology.ai/?focus=2510.24195","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2510.24195"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/CGCL-codes/UAP-SAM2","reach":{"status":"ok"}}],"summary":{"ran_violates":1,"ran_draft_wrong":2,"ran_honours":1,"ran_fixture":1,"unverified":6},"by_repo_kind":{"found_in_text":{"samples":11,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":11,"samples":[{"code_sha256_prefix":"7ceaad42da42edd5","entry":"compute_axial_cis","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/position_encoding.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/position_encoding.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7ceaad42da42edd5"}},{"code_sha256_prefix":"a6c3974188a5ffb0","entry":"get_1d_sine_pe","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/sam2_utils.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/sam2_utils.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a6c3974188a5ffb0"}},{"code_sha256_prefix":"bb060d29525f90eb","entry":"init_t_xy","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/position_encoding.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/position_encoding.py","link_basis":"plan_row","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bb060d29525f90eb"}},{"code_sha256_prefix":"f8f09f78b474ee7c","entry":"reshape_for_broadcast","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/position_encoding.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/position_encoding.py","link_basis":"plan_row","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f8f09f78b474ee7c"}},{"code_sha256_prefix":"4ee20f090e58c425","entry":"select_closest_cond_frames","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/sam2_utils.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/sam2_utils.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4ee20f090e58c425"}},{"code_sha256_prefix":"f9850c1d4acdbb5a","entry":"build_sam2","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/build_sam.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/build_sam.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f9850c1d4acdbb5a"}},{"code_sha256_prefix":"de8c2a625f263855","entry":"build_sam2_hf","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/build_sam.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/build_sam.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"de8c2a625f263855"}},{"code_sha256_prefix":"61b96459a41f7fd9","entry":"build_sam2_video_predictor","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/build_sam.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/build_sam.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"61b96459a41f7fd9"}},{"code_sha256_prefix":"f2e72d81f39d65cd","entry":"get_activation_fn","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2/modeling/sam2_utils.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2/modeling/sam2_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f2e72d81f39d65cd"}},{"code_sha256_prefix":"57f374cc9128068a","entry":"get_args","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"uap_attack.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/uap_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"57f374cc9128068a"}},{"code_sha256_prefix":"971426f0fd97a041","entry":"get_iou","repo":"CGCL-codes/UAP-SAM2","repo_kind":"found_in_text","path":"sam2_util.py","file_url":"https://github.com/CGCL-codes/UAP-SAM2/blob/HEAD/sam2_util.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"971426f0fd97a041"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CV","source":"arxiv_api"},"syntology_extracted_results":null}