Breaking the Presence Gate: Universal Adversarial Disruption of SAM3 Concept Segmentation

SAM3 introduces open-vocabulary concept segmentation. Given a text query, it determine whether the concept is present and segment every matching instance. Its final candidate scores are multiplied by a shared presence probability, creating a single decision point through which many masks can be suppressed. We study the adversarial robustness of this design and propose Universal Concept Disruption (UCD), a single image-space perturbation trained across images and noun phrases. UCD attacks SAM3 at three coupled levels: it disrupts the text-conditioned visual representation, maximizes divergence in prompt-shared features, and jointly suppresses presence-gated scores and the spatial quality of surviving masks. Under a common universal-perturbation protocol, UCD is evaluated on SACo-Gold, LVIS, RefCOCO, PhraseCut, and OpenImages. With an ${\ell }_{\infty }$ budget of $8/255$, it reduces mean mask AP from 59.43 to 18.73 and mean concept-grounding F${}_1$ from 50.32 to 20.49, consistently exceeding adapted attacks designed for SAM, SAM2, or generic classifiers. The same perturbation transfers to SAM3.1 and to video inference without re-optimization, exposing failures that persist through temporal memory. Prompt ensembling, head fine-tuning, and temporal filtering offer only partial recovery and can substantially reduce clean performance.