Recent studies reveal the vulnerability of the image segmentation foundation model SAM to adversarial examples. Its successor, SAM2, has attracted significant attention due to its strong generalization capability in video segmentation. However, its robustness remains unexplored, and it is unclear whether existing attacks on SAM can be directly transferred to SAM2. In this paper, we first analyze the performance gap of existing attacks between SAM and SAM2 and highlight two key challenges arising from their architectural differences: directional guidance from the prompt and semantic entanglement across consecutive frames. To address these issues, we propose UAP-SAM2, the first cross-prompt universal adversarial attack against SAM2 driven by dual semantic deviation. For cross-prompt transferability, we begin by designing a target-scanning strategy that divides each frame into k regions, each randomly assigned a prompt, to reduce prompt dependency during optimization. For effectiveness, we design a dual semantic deviation framework that optimizes a UAP by distorting the semantics within the current frame and disrupting the semantic consistency across consecutive frames. Extensive experiments on six datasets across two segmentation tasks demonstrate the effectiveness of the proposed method for SAM2. The comparative results show that UAP-SAM2 significantly outperforms state-of-the-art (SOTA) attacks by a large margin.

翻译：近期研究表明，图像分割基础模型SAM对对抗样本存在脆弱性。其继任者SAM2凭借在视频分割任务中强大的泛化能力而受到广泛关注。然而，其鲁棒性尚未得到充分探究，现有针对SAM的攻击方法能否直接迁移至SAM2尚不明确。本文首先分析了现有攻击方法在SAM与SAM2之间的性能差异，并基于两者架构差异指出两个关键挑战：提示信息的方向性引导与连续帧间的语义纠缠。为解决这些问题，我们提出UAP-SAM2——首个基于双重语义偏差驱动的跨提示通用对抗攻击方法。为实现跨提示可迁移性，我们设计了目标扫描策略，将每帧图像划分为k个区域并随机分配提示信息，以降低优化过程中的提示依赖性。为提升攻击效能，我们构建了双重语义偏差框架，通过扭曲当前帧内部语义与破坏连续帧间语义一致性来优化通用对抗扰动。在两种分割任务涉及的六个数据集上的大量实验验证了该方法对SAM2的有效性。对比结果表明，UAP-SAM2以显著优势超越现有最先进攻击方法。