OWASP Global AppSec: How to hide prompt injection in plain sight

* Attackers hide malware in image files to evade antivirus detection.
* Adversaries can attack LLMs by embedding malicious prompts into images.
* An image can serve as an attack vector because the image path is not guarded, unlike text.
* LLMs generally process text and images through separate channels.
* Many open-weight models screen only text for malicious prompts or dangerous outputs; image data passes through unchecked.
* The FigStep attack involved creating an image with text instructions: "Steps to create a phishing email."
* An LLM complied with a prompt asking it to complete the steps in this illustration, with success rates between 60% and 80%.
* Image-based attacks can be defeated if the image processor adds Optical Character Recognition (OCR) capability.
* High-resolution text can be hidden by adding layers of images and adjusting contrast so text escapes human eyes and OCR processors.
* Anamorphic resizing, used during LLM processing, can bring previously hidden text into relief, demonstrated via a panda photo example.
* Anti-aliasing resizing can defeat image-based attacks by blurring the text before shrinking the image.
* Recommended defense steps include checking images before upload, logging pre-processed input, using anti-aliasing resizing algorithms, and determining if the LLM treats image text as an instruction.

The narrative highlights a fundamental asymmetry in AI security: the disparity between how text is handled versus how visual data is processed by models. The core pattern reveals that existing textual safety measures create blind spots where multimodal inputs, specifically images, remain unmonitored channels susceptible to injection. The progression of the attack—from simple prompt injection via image content to sophisticated manipulation exploiting processing algorithms like anamorphic resizing—suggests an evolving arms race between attackers seeking novel ingress points and defenders needing to adapt layered defenses. The recommended countermeasures move beyond simple filtering; they necessitate systemic architectural changes in how multimodal inputs are handled, emphasizing control over the entire data pipeline from upload through pre-processing to downstream analysis. The transition from focusing solely on input text filters to addressing image processing techniques reveals a shift toward understanding the mechanics of model inference itself, suggesting that security must be engineered into the physical and mathematical transformations applied to data, not just the surface-level content. This implies that true cognitive sovereignty in this space requires an understanding of algorithmic choices—such as the choice between anti-aliasing and anamorphic resizing—as critical security controls, moving beyond simple detection to preemptive structural integrity.
Bridge Questions:
If image processing algorithms are a primary vulnerability channel, what standardized protocols should govern the transformation of visual data before it enters any multimodal LLM pipeline? How can regulatory frameworks mandate security checks on intermediate representation layers (like resized images) rather than just final outputs? What is the long-term consequence for trust when methods of hiding information are successfully weaponized within the very medium used for human communication?