Multi-Modal Prompt Injection — Image (ATK-004)

Prerequisites

Target system accepts image input and processes it through a vision-language model.
Model output is concatenated with subsequent prompts or actions without separation of image-derived content from system instructions.

Test approach

With written authorization, the tester submits images containing instructions to the model — text rendered in the image, QR codes encoding instructions, or images where OCR-extractable content includes commands. The tester also tests typographic-style adversarial patches that exploit known vision-language model weaknesses. The objective is to determine whether the vision pipeline follows image-borne instructions.

Expected evidence

Test images with hashes and metadata.
Full request/response logs including image-derived text.
Model output demonstrating compliance with image-embedded instructions.

Detection signals

Image inputs whose OCR-extracted text contains imperative verbs disproportionate to a normal photo.
Image inputs containing QR codes or other structured machine-readable content.
Tool invocations triggered after image upload.

Defensive recommendations

OCR image content and apply text-based injection detection before passing into the model.
Use vision models with explicit role separation between image-derived content and user instructions.
Constrain tool authorization when image inputs are present, particularly from external sources.
Include image-based PI in pre-production evaluation.

Framework mappings

OWASP LLM Top 10: LLM01:2025
MITRE ATLAS: AML.T0051
NIST AI RMF: MEASURE-2.7

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.