Backdoor Attacks on Prompt-Driven Video Segmentation Foundation Models

1. Problem Statement

Context: Prompt-driven Video Segmentation Foundation Models (VSFMs), such as SAM2, are increasingly used in critical applications like autonomous driving and digital pathology. These models generate segmentation masks based on video frames and user-provided prompts (points, boxes, or masks).
The Gap: While backdoor attacks are well-studied in image classification, their application to VSFMs is unexplored.
The Challenge: The authors found that directly applying classic backdoor attacks (e.g., BadNet) to VSFMs is largely ineffective, yielding Attack Success Rates (ASR) below 5%.
Root Cause Analysis: Through gradient-similarity and attention-map analyses, the authors discovered that traditional backdoor training fails because:

1. Gradient Alignment: Clean and triggered samples induce largely aligned image-encoder gradients, meaning the encoder does not learn distinct features for the trigger.
2. Prompt Dominance: The model's attention remains focused on the prompt-specified object (the ground truth) rather than the trigger, preventing the decoder from mapping the trigger to a malicious target mask.

2. Methodology: BadVSFM

To overcome these limitations, the authors propose BadVSFM, the first backdoor attack framework specifically tailored for prompt-driven VSFMs. It employs a two-stage training strategy to decouple the learning of trigger features from the clean segmentation objective.

Stage 1: Encoder Representation Separation

• Goal: Force the image encoder to learn trigger-specific features while preserving clean utility.
• Mechanism:
  • Effectiveness Loss: Pulls the embedding of triggered frames toward a predefined target embedding (derived from a reference model).
  • Utility Loss: Aligns the embeddings of clean frames with a reference clean encoder to ensure normal segmentation behavior is preserved.
• Outcome: The encoder learns to separate triggered inputs from clean inputs in the representation space, creating a distinct feature direction for the trigger.

Stage 2: Decoder Conditioning

• Goal: Train the mask decoder to map the triggered representation to a malicious target mask across all prompt types, while maintaining clean behavior for non-triggered inputs.
• Mechanism:
  • Effectiveness Loss: Supervises the decoder to output a shared target mask (e.g., an all-zero "disappearance" mask) for triggered frames, regardless of whether the prompt is a point, box, or mask. This uses a combination of Binary Cross-Entropy (BCE) and Dice losses.
  • Utility Loss: Aligns the decoder's output for clean frames with a reference decoder to maintain segmentation quality.
• Outcome: The model becomes robust to different prompt types; when a trigger is present, the decoder overrides the prompt's instruction and outputs the attacker's target mask.

3. Key Contributions

1. First Framework: Introduced BadVSFM, the first backdoor attack framework designed specifically for prompt-driven VSFMs.
2. Novel Two-Stage Paradigm: Proposed a training strategy that explicitly separates trigger and clean representations in the encoder and conditions the decoder to ignore prompts when a trigger is detected.
3. Comprehensive Evaluation: Validated the attack across five VSFMs (SAM2, MedSAM2, SAM2-Long, BioSAM2, EdgeTAM) and two datasets (DAVIS, LVOS) using various triggers (BadNet, Blended, WaNet, FIBA) and prompts.
4. Defense Analysis: Demonstrated that five representative defense strategies (Fine-tuning, Pruning, Spectral Signatures, PGBD, STRIP) are largely ineffective against BadVSFM.

4. Experimental Results

• Attack Success Rate (ASR): BadVSFM dramatically outperforms baseline attacks.
  • On DAVIS with a 5% poisoning rate, BadVSFM achieved 95.3% ASR with point prompts and 94.1% with box prompts (compared to <5% for baselines).
  • Even with strong mask prompts (which provide ground-truth spatial info), BadVSFM achieved up to 66.1% ASR, whereas baselines failed completely (0%).
• Clean Utility Preservation: The attack maintains high segmentation quality on clean inputs.
  • mIoU and J&F scores for clean inputs remained competitive with baseline models (e.g., mIoU ~0.596 vs. 0.589 for the baseline on DAVIS).
• Robustness:
  • Prompt Types: Effective across point, box, and mask prompts.
  • Triggers: Works with visible (BadNet, Blended) and invisible (WaNet, FIBA) triggers.
  • Physical Triggers: Successfully exploited real-world objects (e.g., leaves, traffic cones) as triggers, achieving >91% ASR.
  • Transformations: Robust to common physical-world perturbations (illumination, noise, rotation), though performance drops under severe occlusion or scaling.
• Ablation Studies: Confirmed that both training stages are necessary; Stage 1 alone degrades clean utility, while Stage 2 alone fails to achieve high ASR. The combination of BCE and Dice losses in Stage 2 provided the best balance.

5. Significance and Implications

• Security Vulnerability: The paper reveals a critical, underexplored vulnerability in state-of-the-art foundation models. The "prompt-driven" nature of these models, previously thought to offer some resilience, is actually exploitable via a two-stage training approach.
• Failure of Existing Defenses: The study highlights that defenses designed for classification or standard detection models do not transfer well to dense prediction tasks conditioned on prompts. Existing defenses either fail to detect the backdoor or degrade the model's clean utility without removing the backdoor.
• Future Directions: The work underscores the urgent need for tailored defense mechanisms for VSFMs that can distinguish between prompt-driven clean behavior and trigger-induced malicious overrides without sacrificing the model's utility.

In summary, BadVSFM demonstrates that prompt-driven video segmentation models are highly susceptible to backdoor attacks if the training process is manipulated to separate trigger representations and condition the decoder to ignore prompts in the presence of a trigger. This poses a significant risk for the deployment of these models in safety-critical domains.