{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/transferable-adversarial-attacks-on-sam-and","title":"Transferable Adversarial Attacks on SAM and Its Downstream Models","arxiv_id":"2410.20197","date":"2024-10-26","proceeding":null,"authors":["Song Xia","Wenhan Yang","Yi Yu","Xun Lin","Henghui Ding","Ling-Yu Duan","Xudong Jiang"],"abstract":"The utilization of large foundational models has a dilemma: while fine-tuning downstream tasks from them holds promise for making use of the well-generalized knowledge in practical applications, their open accessibility also poses threats of adverse usage. This paper, for the first time, explores the feasibility of adversarial attacking various downstream models fine-tuned from the segment anything model (SAM), by solely utilizing the information from the open-sourced SAM. In contrast to prevailing transfer-based adversarial attacks, we demonstrate the existence of adversarial dangers even without accessing the downstream task and dataset to train a similar surrogate model. To enhance the effectiveness of the adversarial attack towards models fine-tuned on unknown datasets, we propose a universal meta-initialization (UMI) algorithm to extract the intrinsic vulnerability inherent in the foundation model, which is then utilized as the prior knowledge to guide the generation of adversarial perturbations. Moreover, by formulating the gradient difference in the attacking process between the open-sourced SAM and its fine-tuned downstream models, we theoretically demonstrate that a deviation occurs in the adversarial update direction by directly maximizing the distance of encoded feature embeddings in the open-sourced SAM. Consequently, we propose a gradient robust loss that simulates the associated uncertainty with gradient-based noise augmentation to enhance the robustness of generated adversarial examples (AEs) towards this deviation, thus improving the transferability. Extensive experiments demonstrate the effectiveness of the proposed universal meta-initialized and gradient robust adversarial attack (UMI-GRAT) toward SAMs and their downstream models. Code is available at https://github.com/xiasong0501/GRAT.","url_abs":"https://arxiv.org/abs/2410.20197v3","url_pdf":"https://arxiv.org/pdf/2410.20197v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"transferable-adversarial-attacks-on-sam-and","repo_url":"https://github.com/xiasong0501/grat","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[{"method_slug":"sam","method_name":"SAM"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2410.20197","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2410.20197"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/xiasong0501/grat","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_fixture":1,"ran_violates":1,"unverified":9},"by_repo_kind":{"official":{"samples":11,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"28ce88cbcad7b395","entry":"select_op","repo":"xiasong0501/grat","repo_kind":"official","path":"l2t.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/l2t.py","link_basis":"plan_row","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"28ce88cbcad7b395"}},{"code_sha256_prefix":"29e23c69b7369fa0","entry":"trace_prob","repo":"xiasong0501/grat","repo_kind":"official","path":"l2t.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/l2t.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"29e23c69b7369fa0"}},{"code_sha256_prefix":"81afe23ae24a41b1","entry":"Minimize_domain_mean","repo":"xiasong0501/grat","repo_kind":"official","path":"one_sample_train.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/one_sample_train.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"81afe23ae24a41b1"}},{"code_sha256_prefix":"3c57221d88208eb2","entry":"attack","repo":"xiasong0501/grat","repo_kind":"official","path":"anda_ct.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/anda_ct.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3c57221d88208eb2"}},{"code_sha256_prefix":"40f56fce40b517b1","entry":"calc_loss","repo":"xiasong0501/grat","repo_kind":"official","path":"one_sample_train.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/one_sample_train.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"40f56fce40b517b1"}},{"code_sha256_prefix":"63a5df1373ee6cc1","entry":"common_direct_loss","repo":"xiasong0501/grat","repo_kind":"official","path":"Sam_attack_universal.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/Sam_attack_universal.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"63a5df1373ee6cc1"}},{"code_sha256_prefix":"1a6a138af1a89077","entry":"common_direct_loss_weighted","repo":"xiasong0501/grat","repo_kind":"official","path":"Sam_attack_universal.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/Sam_attack_universal.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1a6a138af1a89077"}},{"code_sha256_prefix":"2a73ff4ab33a222f","entry":"input_diversity","repo":"xiasong0501/grat","repo_kind":"official","path":"Sam_attack.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/Sam_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2a73ff4ab33a222f"}},{"code_sha256_prefix":"1ad6a46df9edf55e","entry":"normalize_tensor","repo":"xiasong0501/grat","repo_kind":"official","path":"Sam_attack.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/Sam_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1ad6a46df9edf55e"}},{"code_sha256_prefix":"d64cb63ef26668bd","entry":"return_mean_value","repo":"xiasong0501/grat","repo_kind":"official","path":"Sam_attack.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/Sam_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d64cb63ef26668bd"}},{"code_sha256_prefix":"e7248679b9338973","entry":"vertical_shift","repo":"xiasong0501/grat","repo_kind":"official","path":"l2t.py","file_url":"https://github.com/xiasong0501/grat/blob/HEAD/l2t.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e7248679b9338973"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}