mlsanityData to 7 Oct 2026

Practical Region-level Attack against Segment Anything Models

arXiv 2404.08255 ↗First posted 12 Apr 2024cs.CV cs.CRcited by 9

Not on the map. Why?

Abstract (arXiv)

Segment Anything Models (SAM) have made significant advancements in image segmentation, allowing users to segment target portions of an image with a single click (i.e., user prompt). Given its broad applications, the robustness of SAM against adversarial attacks is a critical concern. While recent works have explored adversarial attacks against a pre-defined prompt/click, their threat model is not yet realistic: (1) they often assume the user-click position is known to the attacker (point-based attack), and (2) they often operate under a white-box setting with limited transferability. In this paper, we propose a more practical region-level attack where attackers do not need to know the precise user prompt. The attack remains effective as the user clicks on any point on the target object in the image, hiding the object from SAM. Also, by adapting a spectrum transformation method, we make the attack more transferable under a black-box setting. Both control experiments and testing against real-world SAM services confirm its effectiveness.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 44 of its 50 references that are in the map. First posted on arXiv 12 Apr 2024.

Builds on

44 of 50 references.

References · 44

  1. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  2. 2023Segment Anythingcited by 8,158
  3. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,339
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Pyramid Scene Parsing Networkcited by 2,472
  9. 2017Rethinking Atrous Convolution for Semantic Image Segmentationcited by 2,154
  10. 2015SegNet: A Deep Convolutional Encoder-Decoder Architecture for Image Segmentationcited by 1,483
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
32 more
  1. 2023Segment Everything Everywhere All at Oncecited by 546
  2. 2017Countering Adversarial Images using Input Transformationscited by 517
  3. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  4. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  5. 2023Segment Anything in High Qualitycited by 373
  6. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  7. 2023Faster Segment Anything: Towards Lightweight SAM for Mobile Applicationscited by 345
  8. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  9. 2023Segment Anything Model for Medical Image Analysis: an Experimental Studycited by 291
  10. 2023Fast Segment Anythingcited by 286
  11. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  12. 2023Track Anything: Segment Anything Meets Videoscited by 230
  13. 2023VoxelNeXt: Fully Sparse VoxelNet for 3D Object Detection and Trackingcited by 221
  14. 2023EfficientSAM: Leveraged Masked Image Pretraining for Efficient Segment Anythingcited by 187
  15. 2023Semantic-SAM: Segment and Recognize Anything at Any Granularitycited by 185
  16. 2018Robustness via curvature regularization, and vice versacited by 174
  17. 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
  18. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  19. 2023Can SAM Segment Anything? When SAM Meets Camouflaged Object Detectioncited by 99
  20. 2023Anything-3D: Towards Single-view Anything Reconstruction in the Wildcited by 91
  21. 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
  22. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  23. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  24. 2017Security Evaluation of Pattern Classifiers under Attackcited by 39
  25. 2017Adversarial Examples for Semantic Image Segmentationcited by 33
  26. 2023Robustness of SAM: Segment Anything Under Corruptions and Beyondcited by 30
  27. 2019Impact of Adversarial Examples on Deep Learning Models for Biomedical Image Segmentationcited by 26
  28. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  29. 2022Proximal Splitting Adversarial Attacks for Semantic Segmentationcited by 23
  30. 2023UVOSAM: A Mask-free Paradigm for Unsupervised Video Object Segmentation via Segment Anything Modelcited by 14
  31. 2023Black-box Targeted Adversarial Attack on Segment Anything (SAM)cited by 13
  32. 2023Segment Anything Meets Semantic Communicationcited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 4; 2026: 3.

9 papers.

  1. 2025Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2cited by 11
  2. 2024Region-Guided Attack on the Segment Anything Model (SAM)cited by 2
  3. 2024FusionSAM: Visual Multi-Modal Learning with Segment Anythingcited by 1
  4. 2025Creating Blank Canvas Against AI-enabled Image Forgerycited by 1
  5. 2025Proxy-Embedding as an Adversarial Teacher: An Embedding-Guided Bidirectional Attack for Referring Expression Segmentation Modelscited by 0
  6. 2025SAM Encoder Breach by Adversarial Simplicial Complex Triggers Downstream Model Failurescited by 0
  7. 2026ChronoVision: Temporal Reasoning via Latent State Reconstructioncited by 0
  8. 2026Universal Concept Disruption for SAM3 Image Segmentationcited by 0
  9. 2026Universal Cross-Prompt Adversarial Attacks on Promptable Concept Segmentationcited by 0