Multimodal Evasion

Multimodal evasion uses images, files, encoded text, or other non-standard formats to bypass basic text filters. The attack works because the harmful payload is reconstructed later in the pipeline, after the first layer of review has already passed it through.

Expanded Definition

Multimodal evasion is an adversarial technique that hides malicious intent inside non-text inputs or mixed-format content so that simple keyword scanning, prompt inspection, or content moderation misses it. The payload may be embedded in an image, document, archive, or encoded fragment, then reconstructed later by OCR, parsing, decompression, or model preprocessing. That makes the attack especially relevant in AI-enabled workflows where safety checks are applied too early, before the full content is transformed into machine-readable form.

Definitions vary across vendors because some teams treat this as a prompt-injection variant, while others classify it as a broader content-bypass technique. NHI Management Group treats it as a security concern wherever an LLM, agent, or automated pipeline consumes mixed-media input and then performs tool use, retrieval, or decisioning. The closest governance mapping in the control literature is defensive content validation and sanitisation, as reflected in NIST SP 800-53 Rev 5 Security and Privacy Controls, but no single standard yet defines multimodal evasion as a standalone control category. The most common misapplication is assuming a text-only filter is sufficient, which occurs when organisations inspect only the visible prompt and ignore later-stage decoding, extraction, or model ingestion paths.

Examples and Use Cases

Implementing multimodal defences rigorously often introduces latency and false positives, requiring organisations to weigh stronger inspection against faster user experience and lower operational complexity.

• An attacker submits a benign-looking image containing instructions that are later read by OCR and forwarded to an assistant, bypassing a front-end text filter.
• A compressed attachment hides policy-evading text that is not surfaced until the file is unpacked in a downstream sandbox or processing service.
• An encoded string is passed through a preprocessing layer and only becomes harmful after decoding inside a retrieval or agent workflow.
• A document embeds malicious instructions in metadata or layered objects, slipping past scanners that only inspect visible body text.
• A model-connected workflow ingests a scan of a form and converts it to text before moderation, creating a gap between initial review and final interpretation.

For teams designing controls around defensive validation and sanitisation measures, the practical lesson is to inspect content after every transformation step, not just at the point of upload. This matters most in multi-stage systems that combine OCR, translation, document parsing, or agentic tool use.

Why It Matters for Security Teams

Multimodal evasion matters because it breaks the assumption that one content screen can reliably police the whole workflow. Security teams that rely on a single moderation layer can miss payloads that only become dangerous after parsing, rendering, or decoding. In AI systems, that failure can lead to unsafe retrieval, manipulated agent actions, policy bypass, or exposure of downstream tools to untrusted instructions. The risk is not limited to generative AI: any workflow that transforms files or images into executable, queryable, or decision-ready content can be affected.

From a governance perspective, the control challenge is to verify that inspection happens at the same trust boundary where content becomes operationally meaningful. That usually means adding layered checks, type-aware parsing, file normalisation, and explicit restrictions on how untrusted media is converted into text. Teams also need logging strong enough to reconstruct which transformation introduced the bypass. Organisations typically encounter the full impact only after an apparently harmless upload triggers an unsafe model response or agent action, at which point multimodal evasion becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do multimodal video platforms create new IAM and audit risks?
• Why do unauthenticated multimodal endpoints increase exploitation risk?
• Why do multimodal AI agents create more risk than text-only assistants?
• How do organisations reduce the impact of poisoned multimodal prompts?