Abstract:The utilization of large foundational models has a dilemma: while fine-tuning downstream tasks from them holds promise for making use of the well-generalized knowledge in practical applications, their open accessibility also poses threats of adverse usage. This paper, for the first time, explores the feasibility of adversarial attacking various downstream models fine-tuned from the segment anything model (SAM), by solely utilizing the information from the open-sourced SAM. In contrast to prevailing transfer-based adversarial attacks, we demonstrate the existence of adversarial dangers even without accessing the downstream task and dataset to train a similar surrogate model. To enhance the effectiveness of the adversarial attack towards models fine-tuned on unknown datasets, we propose a universal meta-initialization (UMI) algorithm to extract the intrinsic vulnerability inherent in the foundation model, which is then utilized as the prior knowledge to guide the generation of adversarial perturbations. Moreover, by formulating the gradient difference in the attacking process between the open-sourced SAM and its fine-tuned downstream models, we theoretically demonstrate that a deviation occurs in the adversarial update direction by directly maximizing the distance of encoded feature embeddings in the open-sourced SAM. Consequently, we propose a gradient robust loss that simulates the associated uncertainty with gradient-based noise augmentation to enhance the robustness of generated adversarial examples (AEs) towards this deviation, thus improving the transferability. Extensive experiments demonstrate the effectiveness of the proposed universal meta-initialized and gradient robust adversarial attack (UMI-GRAT) toward SAMs and their downstream models. Code is available at <a class="link-external link-https" href="https://github.com/xiasong0501/GRAT" rel="external noopener nofollow">this https URL</a>.

Sparse Attack with Meta-Learning

Boosting Black-Box Adversarial Attacks with Meta Learning

BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attack

Generalizable Black-Box Adversarial Attack With Meta Learning

Transferable Adversarial Attacks on SAM and Its Downstream Models

Attack-SAM: Towards Attacking Segment Anything Model With Adversarial Examples

Black-box Targeted Adversarial Attack on Segment Anything (SAM)

Query-efficient Meta Attack to Deep Neural Networks.

Query Efficient Decision Based Sparse Attacks Against Black-Box Deep Learning Models

Meta Gradient Adversarial Attack

Meta-Attack - Class-agnostic and Model-agnostic Physical Adversarial Attack.

Yet Meta Learning Can Adapt Fast, It Can Also Break Easily

Adaptive momentum variance for attention-guided sparse adversarial attacks

Systematic Investigation of Sparse Perturbed Sharpness-Aware Minimization Optimizer

Reinforcement Learning Based Sparse Black-box Adversarial Attack on Video Recognition Models

RegionSparse: Leveraging Sparse Coding and Object Localization to Counter Adversarial Attacks

DarkSAM: Fooling Segment Anything Model to Segment Nothing

Coreset Learning Based Sparse Black-box Adversarial Attack For Video Recognition

Adversarial sample attack method based on loss smoothing

SCME: A Self-Contrastive Method for Data-free and Query-Limited Model Extraction Attack