Multi-Modal Injection

The core mechanism involves encoding adversarial instructions into a non-text modality. For example, an attacker might embed text instructions as steganographic data within an image's pixel values or as inaudible frequencies in an audio file. When the multi-modal model (e.g., a vision-language model) processes this input, it interprets the hidden instruction, which overrides the original system prompt. This exploits the model's inherent ability to fuse and interpret information from different channels as a unified context.

These attacks are uniquely effective against architectures that create a joint embedding space. Models like GPT-4V or LLaVA process images and text into a shared latent representation. An injected image is not treated as inert data; its semantic content is blended with the text context. This allows a malicious image to act as a privileged system-level instruction, as the model does not robustly segregate the authority of instructions coming from different modalities. The attack bypasses text-only sanitization filters.

Multi-modal injection often functions as a powerful form of indirect prompt injection. The poisoned content can be placed in a seemingly benign external resource—a product image on a website, a logo in a PDF, or background audio in a video. When a downstream AI application retrieves and processes this content, the injection triggers. This creates persistent attack surfaces across data pipelines, as the malicious payload lies dormant in non-executable files until parsed by a vulnerable model.

Traditional security measures focused on sanitizing text prompts are ineffective. Defenses like input filtering, keyword blocklists, or delimiter checking only analyze the text channel. An instruction hidden in an image's visual texture or a document's layout passes through untouched. This necessitates new defense-in-depth strategies, including:

• Multi-modal input validation (e.g., OCRing images to check for hidden text).
• Modality-aware guardrails that assess instruction consistency across channels.
• Strict trust partitioning between user-provided content and system instructions.

The risk is magnified in Retrieval-Augmented Generation (RAG) and agentic systems. If a knowledge base contains injected images or audio files, a RAG system will retrieve this content and feed it to the generator, leading to a RAG jailbreak. For autonomous agents that perceive the world via multi-modal sensors, a poisoned input could lead to goal hijacking at the perception stage, causing the agent to pursue adversarial objectives. It represents a direct attack on an agent's sensory input.

Mitigation is complex due to the semantic gap between raw pixels/audio and their interpreted meaning. Effective countermeasures are areas of active research and may include:

• Adversarial training with multi-modal injection examples.
• Runtime monitoring for dissonance between modalities (e.g., does the image context logically match the text task?).
• Causal mediation analysis to trace which modality most influenced the output.
• Secure prompting patterns that explicitly de-prioritize instructions from user-supplied non-text data. The arms race between attack and defense is central to securing multi-modal AI deployments.

The foundational adversarial attack where a user's input overrides a model's original system instructions. Multi-modal injection is a specialized form of this attack that uses non-text modalities as the injection vector.

• Direct Injection: Malicious instructions are placed directly in the user's text query.
• Contrast: While prompt injection is text-based, multi-modal injection embeds instructions in images, audio, or other data types.

An attack where malicious instructions are hidden within data retrieved from an external source (e.g., a database, website, or file). The model processes this poisoned data, subverting its function.

• External Vector: The attack payload comes from a retrieved context, not the direct user input.
• Relation to Multi-Modal: Both are indirect attacks; the malicious instruction is not in the primary text prompt but arrives via another channel (retrieved text vs. a processed image).

A crafted input designed to bypass a model's safety filters and content moderation policies. The goal is to elicit responses the model is trained to refuse.

• Objective: Safety filter bypass.
• Method Relation: Multi-modal injection can serve as a jailbreak technique. An image containing hidden text instructions might be more effective at evading text-based safety scanners than a plain text jailbreak.

An input crafted with small, often imperceptible perturbations to cause a model to make a high-confidence error. Originally from computer vision, the concept extends to NLP and multi-modal models.

• Core Principle: Exploiting model sensitivity to engineered input perturbations.
• Multi-Modal Context: A multi-modal injection attack (e.g., subtly altered pixels in an image) is a direct adversarial example for a vision-language model, designed to cause a specific behavioral error (complying with malicious instructions).

A specific attack on Retrieval-Augmented Generation systems where malicious content is inserted into the knowledge base. When retrieved, this content poisons the generation context.

• Attack Surface: The retrieval system's knowledge base.
• Comparison: Both target the context given to the model. A RAG jailbreak poisons a text-based retrieval system, while multi-modal injection poisons the model's direct perceptual input. They represent different points of context corruption.

The overarching objective of many adversarial prompting techniques, including multi-modal injection. It involves circumventing the layers of defense (input scanners, model refusals, output filters) designed to block harmful content.

• End Goal: To generate harmful content.
• Multi-Modal Advantage: Multi-modal inputs can exploit gaps in safety pipelines that are primarily designed to analyze and filter text, providing a potent vector for bypass.