A promptable segmentation model that produces clean masks on a road scene has told you something about nominal capability and almost nothing about the evidence a safety reviewer will ask for. That gap is the whole story with the Segment Anything Model in an automotive perception stack.

The Segment Anything Model — SAM, released by Meta AI — does one thing remarkably well: given an image and a prompt (a point, a box, or a coarse mask), it returns a segmentation mask, often without any task-specific training on your data. Drop it on a dashcam frame and it will carve out the vehicle ahead, the lane markings, the pedestrian at the crosswalk. The masks look convincing. That is precisely where the trouble starts, because “the masks look convincing” is not a sentence that survives a functional-safety review.

How does SAM work, and what does it actually assert?

SAM is a foundation model for segmentation. It couples a heavy image encoder (a ViT backbone) that runs once per image with a lightweight, promptable mask decoder that runs per prompt. The encoder produces an image embedding; the decoder takes that embedding plus a prompt and predicts one or more masks with associated confidence scores. Because the encoder is expensive and the decoder is cheap, you can interrogate the same frame with many prompts at low marginal cost.

The word doing the heavy lifting is promptable. SAM was trained on an enormous, diverse mask dataset to answer the question “what object does this prompt refer to?” — not “what are all the safety-relevant objects in this driving scene, and how confident should a downstream planner be in each?” Those are different questions, and the difference is not academic. SAM asserts that, given a reasonable prompt, it can produce a plausible mask for the referent. It does not assert that the mask is correct under adversarial lighting, that it will behave the same way tomorrow, or that its confidence score means what a calibration curve would need it to mean.

We see this misread regularly: a team benchmarks SAM on a curated set of road scenes, records a strong mean intersection-over-union, and treats that number as validation. A benchmark mIoU on a curated set is a benchmark-class claim about nominal accuracy under the conditions of that set — nothing more. It does not describe the tails, and in automotive perception the tails are where functions get hurt.

What is a promptable segmentation model, and how do prompts change the output?

The prompt is not a convenience knob; it is part of the model’s input and it materially changes what comes out. A single foreground point may return the pedestrian, the pedestrian’s jacket, or the pedestrian-plus-shadow, depending on where the point lands and what SAM’s decoder decides the ambiguity resolves to. A bounding-box prompt tends to be more stable than a point because it constrains the extent, but a loose box around two overlapping cars can yield a mask that fuses them. A coarse-mask prompt refines a prior estimate but inherits its errors.

SAM handles this designed-in ambiguity by predicting multiple candidate masks per prompt and scoring them. That is a sensible engineering choice for an interactive tool where a human picks the right mask. In an autonomous perception pipeline there is no human in the loop to pick — something upstream generates the prompt and something downstream consumes the mask, and the ambiguity that a human would resolve by clicking again becomes a silent failure mode. Understanding which prompt source feeds SAM, and how that source behaves when the scene is confusing, is a prerequisite to characterising the whole function. This is the same class of concern that surfaces in how a tracking model works in automotive perception, where the upstream signal quality quietly governs the downstream behaviour.

Where does SAM fit in an automotive perception pipeline?

In practice SAM rarely sits alone as the primary detector. The patterns we see most often use it as an auto-labelling accelerator for building segmentation datasets, as a mask-refinement stage behind a detector like a DETR- or YOLO-family model that supplies the box prompts, or as an interactive annotation tool for the data team. In each of those roles it is doing useful work. In none of them has it earned the right to be trusted like a validated component simply because its masks look good.

The moment SAM’s output feeds a safety-relevant behaviour — free-space estimation that constrains a planner, drivable-surface segmentation that gates a manoeuvre — the function inherits an integrity demand from its Automotive Safety Integrity Level, and the ASIL is what dictates the evidence. A strong zero-shot mask tells you about the median case on data that resembles training. It does not tell you how the function behaves when a low sun washes out lane edges, when rain smears the lens, or when the prompt source drifts. Those are the conditions under which a promptable foundation model degrades, and degradation behaviour is exactly what a reviewer needs to see. The broader mechanics of fitting a model into that pipeline are covered in our work on autonomous vehicle machine learning and what the model owes an ASIL D pack.

What does the ASIL change about the evidence beyond nominal accuracy?

Everything that matters. The ASIL is a grading of how badly things go if the function fails, and it drives the depth of evidence required. A mask-accuracy number answers “how good is it on average?” The ASIL asks a different set of questions, and a validation pack that only answers the first triggers a clarification cycle when the reviewer asks for the rest.

What a SAM-based function owes at each ASIL tier

Evidence surface	What it must show	Why the ASIL demands it
Nominal accuracy	mIoU / boundary accuracy on a representative, non-curated set	Baseline; necessary but never sufficient
Degradation behaviour	How masks fail under domain shift — glare, rain, night, occlusion, unusual geometry	Higher ASIL widens the operating envelope that must be characterised
Prompt-ambiguity response	Mask stability when the prompt is imperfect or the referent is ambiguous	The failure mode unique to a promptable model with no human resolver
Fault detection	A runtime signal that flags a low-confidence or implausible mask before it reaches the planner	Higher ASIL requires faults be detected, not just made rare
Rollback / fallback	The defined safe behaviour when SAM’s output is rejected	Higher ASIL requires a path that does not depend on the component being right

The rows above are not a checklist to satisfy once; they scale with the integrity demand. An ASIL A convenience feature may reasonably lean on nominal accuracy plus a light fault check. An ASIL C or D function that gates vehicle motion has to demonstrate that its degradation is characterised across the operating envelope, that faults are detected at runtime, and that a rollback path exists and is exercised. This grading of evidence by consequence is the reliability discipline that a functional-safety review applies across domains; our reliability-engineering perspective frames the same demand in cross-vertical terms.

How must SAM’s degradation be characterised for a reviewer?

The reviewer is not asking whether SAM is good. They are asking whether you know how it fails and whether the system contains that failure. That reframes the validation work from a single accuracy campaign into a characterisation of behaviour under stress.

Concretely, that means building the failure evidence deliberately: assemble domain-shift test sets that span the operating envelope rather than the demo set, and measure how mask quality and confidence move as conditions worsen. Probe prompt ambiguity by perturbing the prompt source and observing whether the mask stays stable or collapses onto the wrong referent. Check whether SAM’s confidence score is calibrated against real correctness on your data — because an uncalibrated score cannot be a fault signal, and in our experience across perception engagements a foundation model’s out-of-the-box confidence rarely maps cleanly to correctness on a shifted domain (an observed pattern, not a benchmarked rate). Where a fault is detected, document the rollback and show it firing.

This is the same discipline that shows up whenever a benchmark number is mistaken for validated behaviour — a theme we develop in the perception failure modes that survive benchmarks. A model can top a leaderboard and still surprise a reviewer, because the leaderboard measured the median and the reviewer is asking about the tail.

Where does SAM’s capability stop?

A strong mIoU does not assert real-world automotive accuracy. It asserts nominal performance on the distribution the benchmark sampled. It says nothing about the rare-but-consequential frames — the ones that never appear in a curated set and that a safety case is precisely built to cover. It does not assert that the confidence score is a usable fault signal, that the mask is temporally stable across a video sequence, or that the model will behave the same after a lens smudge that a human would not even notice.

Treating SAM as a solved-segmentation black box is the specific trap here. It is a capable, general, promptable model — which is exactly why its behaviour must be bounded by the function it serves rather than trusted by its headline number.

FAQ

What matters most about SAM (Segment Anything Model) in practice?

SAM pairs a heavy image encoder that runs once per image with a lightweight decoder that produces a segmentation mask from a prompt — a point, box, or coarse mask. In practice it means you can extract a plausible mask for a prompted object without task-specific training, which is powerful for annotation and refinement but is a statement about nominal capability, not about validated behaviour.

What is a promptable segmentation model, and how do SAM’s points, boxes, and mask prompts change its outputs?

A promptable model takes a prompt as part of its input and segments the referent that prompt indicates. A point prompt is the most ambiguous and can return the object, a part of it, or the object plus its shadow; a box prompt is more stable because it constrains extent but can fuse overlapping objects; a coarse-mask prompt refines a prior estimate and inherits its errors. SAM manages this by predicting multiple scored candidate masks.

Where does SAM fit in an automotive perception pipeline, and what does its zero-shot masking not tell you about safety-relevant behaviour?

SAM most often serves as an auto-labelling accelerator, a mask-refinement stage behind a detector, or an interactive annotation tool. Its zero-shot masks describe the median case on data resembling its training distribution; they do not tell you how the function degrades under glare, rain, occlusion, or prompt drift — the conditions a safety-relevant behaviour must be evaluated against.

What does a SAM-based perception function’s ASIL change about the evidence its validation pack must carry beyond nominal mask accuracy?

The ASIL grades the consequence of failure and therefore the depth of evidence required. Beyond a nominal mIoU, the pack must carry degradation behaviour across the operating envelope, prompt-ambiguity response, a runtime fault-detection signal, and a defined rollback path — and those surfaces scale with the integrity demand rather than being satisfied once.

How does SAM degrade under domain shift and prompt ambiguity, and how must that degradation behaviour be characterised for a reviewer?

Under domain shift, mask quality and confidence drift as conditions worsen; under prompt ambiguity, an imperfect prompt can collapse the mask onto the wrong referent with no human to correct it. It must be characterised deliberately: domain-shift test sets spanning the envelope, prompt-perturbation probes, and a check of whether the confidence score is calibrated against real correctness on your data.

What fault-detection and rollback expectations does a higher ASIL place on a foundation-model component like SAM?

A higher ASIL requires that faults be detected at runtime — not merely made rare — so an implausible or low-confidence mask is flagged before it reaches a planner. It also requires a defined safe fallback that does not depend on SAM being correct, and evidence that this rollback path is exercised, not just declared.

Where does SAM’s capability stop — what does a strong benchmark mIoU not assert about real-world automotive accuracy?

A strong mIoU asserts nominal performance on the sampled distribution and nothing about the rare, consequential frames a safety case exists to cover. It does not assert that the confidence score is a usable fault signal, that masks are temporally stable, or that behaviour survives conditions like a lens smudge — all of which the ASIL-scoped evidence must address.

The useful question is not “is SAM’s mask good enough?” but “at this function’s ASIL, do we know how SAM fails, can we detect it at runtime, and does the system stay safe when we reject its output?” That question — the fault-detection and rollback framing a foundation-model component inherits from its integrity demand — is what a production monitoring harness has to answer before the mask ever gates a manoeuvre.