  Recently, the Segment Anything Model (SAM) has gained significant attention
as an image segmentation foundation model due to its strong performance on
various downstream tasks. However, it has been found that SAM does not always
perform satisfactorily when faced with challenging downstream tasks. This has
led downstream users to demand a customized SAM model that can be adapted to
these downstream tasks. In this paper, we present BadSAM, the first backdoor
attack on the image segmentation foundation model. Our preliminary experiments
on the CAMO dataset demonstrate the effectiveness of BadSAM.
