For multimodal agents, an image is simultaneously content and a possible instruction carrier, so visual inputs need authority and provenance controls.
Read the implicationsCase · DiggingBeagle record
Stealthy image-embedded instructions manipulated multimodal LLM behavior
An FLLM 2025 paper, posted to arXiv in March 2026, embedded instructions in natural images and measured changes to GPT-4-turbo outputs while attempting to keep the text visually subtle.
Scope
Black-box research on multimodal prompt injection. This is an ingress/control channel rather than a data-exfiltration result.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The recorded black-box image study supports a tested instruction-ingress channel under specified stealth constraints. Reported peak success is not a general multimodal-system rate or proof of data exfiltration. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-IPI-RESULT · CLM-IPI-MECHANISM · Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions
At a glance
Success depends on model, image, prompt strategy and stealth definition; the result should not be generalized to all vision-language systems.
Limits and uncertaintyTimeline
- Mar 4, 2026Event type unspecified
arXiv version submitted; paper metadata links the work to FLLM 2025 proceedings.
Claims & evidence
CLM-IPI-RESULTThe strongest tested low-contrast configuration achieved 64% attack success on GPT-4-turbo using COCO images. Each query contained only an image, and success meant producing the attacker-requested output. The result did not measure tool execution or data exfiltration.supported
Basis: reported finding
- supportsImage-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructionsrole not specified
arXiv v1, Section IV-A (GPT-4-turbo, COCO, image-only queries and success definition); Section IV-C.2, Table V (64% configuration).
CLM-IPI-MECHANISMThe image-based prompt-injection pipeline hides adversarial instructions inside natural images using region selection, adaptive text scaling and background-aware rendering so the multimodal model can interpret the instruction.supported
Implications
For multimodal agents, an image is simultaneously content and a possible instruction carrier, so visual inputs need authority and provenance controls.
Controls and mitigations
- Treat image content as potentially executable instruction
- Apply OCR/vision-layer inspection and provenance controls
- Separate data from instruction authority in multimodal agents
- Require confirmation before consequential tool actions based on untrusted media
Unknowns and contradictions
- Success depends on model, image, prompt strategy and stealth definition; the result should not be generalized to all vision-language systems.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 25, 2026 · Published version · material revision · revision 39Public fields changed: assessment_profile
- Oct 8, 2026 · Published version · material revision · revision 100Public fields changed: ai_roles, claims, concepts, summary