The Instruction Comes In Through the Camera

FigStep, published at AAAI 2025, does nothing more sophisticated than typeset a harmful instruction and hand over the picture. Across six open-source vision-language models and 500 harmful queries in ten categories, it averaged an 82.5% attack success rate. No perturbation, no optimisation, no gradient.

MM-SafetyBench found the same channel asymmetry a year earlier, with typographic images lifting attack success far above the text-only baseline on safety-aligned models. The size of that gap varies enough by model and by category that no single pair of numbers describes it, which is worth knowing because one pair gets quoted constantly.

The same request. The same model. A different door.

That asymmetry is the subject of this article, and it is not a bug in a particular product. Most of the controls in a production stack were built around the textual prompt, because in 2022 the input was text. A vision encoder converts an image into embeddings that join the text tokens in the same context, and from that point the model has no reliable way to tell an instruction you meant to show it from one someone painted onto the picture.

Here is the sentence to forward. Your input controls were built to read characters, the model reads pixels and waveforms too, and little in a standard stack inspects the gap between them.

What changed since this article was written

In August 2022 a multimodal attack meant something narrower. A model fused text, image, audio and sensor inputs to make a prediction, and the attack corrupted one or more of those channels to force a misclassification. Synchronised corruption of several channels at once was the worst case. That framing was correct for the systems of the time and it is still correct for them: sensor fusion in autonomous vehicles and robots fails the way this article originally described.

What arrived after was the vision-language model, and with it a payload change. The attacker stopped trying to make the model see the wrong thing and started making it read the wrong thing. Misclassification became instruction-following, so the failure now reaches whatever the model is wired to do instead of stopping at a wrong label.

The old mechanism did not go away. The new one is what the term now mostly points at.

Four ways an instruction gets in

Typography, which is barely an attack. Render the text you want the model to obey as an image and upload it. FigStep does this and reports 82.5% average success on open-source LVLMs. There is no perturbation, no optimisation and no gradient. The technique works because the safety training happened in the text channel and the request arrived through the vision channel. GHVPI, a 2024 preprint, does the same thing to a commercial model, drawing the instruction onto the image and reporting a 15.8% success rate on GPT-4V.

Adversarial perturbation of the vision encoder. CrossMPI, a May 2026 preprint from a team at Xidian University, uses nearly imperceptible image perturbations to change how a large vision-language model processes both its visual and its textual input, without modifying the text prompt at all. This family is genuine adversarial examples applied to a new target, and it is the branch that connects this article to the classical literature.

Steganographic payloads. Invisible Injections, a 2025 preprint, encodes a complete injection payload in an image using spatial, frequency and neural steganographic methods, at a peak signal-to-noise ratio above 38 dB and an SSIM above 0.94, which the author treats as reasonable visual imperceptibility. Across eight models and twelve datasets the overall attack success rate was 24.3%, with the neural steganographic methods peaking at 31.8%. The author’s own summary is moderate but meaningful vulnerabilities, which matches the 24.3% overall rate.

Symbols that are not text at all. NVIDIA’s AI red team found that models with early-fusion architectures, which blend text and vision tokens from the beginning rather than bolting a vision encoder onto a language model, will treat emoji sequences and rebus puzzles as functional instructions. Optical character recognition defences and keyword filters miss this completely, because an emoji sequence or a rebus carries no characters to extract. As native multimodality with early fusion becomes standard, this surface grows with it.

Audio follows the same logic. Models that convert speech to acoustic representations rather than to explicit text give an attacker a channel that no text filter has ever inspected. Published work on video-specific attacks is thinner. I have not found a named public incident for video prompt injection, though such a pipeline inherits both the visual and the audio surface.

Why this matters more than the numbers suggest

Two properties turn a moderate attack success rate into a serious exposure.

The first is that ingesting attacker-controlled images is not an edge case for the systems most likely to be attacked. A browsing agent takes screenshots. A document processor reads uploaded invoices and contracts. A support assistant reads whatever the customer attaches. For those systems the attack precondition is the normal operating condition, and there is no configuration in which they stop looking at content they did not author.

The second is that the defensive layer inspects the wrong stage of the pipeline. Text sanitisation, prompt injection classifiers and content filters inspect the text layer. When an image carries a payload, the vision encoder processes it first and produces something that enters the model’s context as ordinary content. Whatever the text classifier eventually sees, it sees after the decision has been influenced. The guardrail is a text classifier, and this is a second and more structural way around it than perturbing the words.

What the defences do

There is better news here than in most of this archive, and it comes with a limit that the researchers themselves report.

The defences that exist here target the perturbation family, and they work on its physics rather than on its meaning. SmoothVLM, built against patched visual prompt injectors, reports cutting attack success to between zero and 5% on two vision-language models. Defense through Partial-Perception Supervision, presented at ICML 2025, reports cutting average attack success by 76.3% across six datasets on three models. Neither eliminates the attack, and both were evaluated against adversarial patches rather than typography.

Each of them targets the perturbation family. Resizing, compression and smoothing degrade a perturbation, which survives only as a fragile signal in the high-frequency range. They do nothing about typography. If the attacker simply typesets the instruction and uploads a clean, legible image, compression preserves it perfectly, and so does every input transformation in that list.

That split is the practical takeaway. The adversarial-perturbation family has partial technical defences. The instruction-in-a-picture family has none that work on the image, because the image is not corrupted in any detectable way. It is a picture of some words.

What to do

Decide what your model is allowed to obey, per channel. The only durable answer to typographic injection is architectural: text extracted from an image is data, never instruction. That is a system design property rather than a filter. The vision output has to be labelled and handled differently from the user’s typed prompt, all the way through your prompt assembly.

Run OCR over incoming images and inspect what comes back. This does not stop the attack, because the model reads the image regardless, but it gives you a text artefact your existing detection stack can see and log. It is detection rather than prevention, and it is currently the cheapest thing on this list.

Apply input transformations where perturbation is the threat. JPEG re-encoding and resizing cost little and degrade the perturbation family. Do not report them as coverage against typographic or steganographic injection, because they are not.

Bound the agent, since you cannot clean the channel. If a browsing agent must ingest attacker-controlled screenshots, the security question is what a hijacked agent can reach. Least privilege on tools, human confirmation for irreversible actions, and no standing credentials in a loop that reads untrusted images.

Test with images, not prompts. Most red team exercises I have seen send text. If your product accepts uploads, the test corpus needs typographic renderings of your text attack set, and the difference between the two success rates is the number worth reporting.

Where the obligations sit

Prompt Injection is LLM01 in the OWASP Top 10 for LLM Applications 2026, published 3 August 2026, and the entry covers multimodal injection explicitly, describing instructions hidden in images, audio and video that bypass text-only filters. Anyone whose control framework maps prompt injection to a text input filter has mapped it to a control that does not cover the entry named in the standard.

Article 15(5) of the EU AI Act names adversarial examples and model evasion among the attack classes that technical solutions for high-risk systems must, where appropriate, prevent, detect, respond to, resolve and control for, applying from 2 December 2027 for standalone Annex III systems and 2 August 2028 for Annex I embedded systems. Checked 6 September 2026, with the timeline in data poisoning.

Related coverage: adversarial attacks, perturbation attacks for the text-classifier case, and AI security fundamentals.