A Large Multimodal Model is an AI model that can understand and generate content from more than one data type, such as text, images, audio, or video. In security and identity contexts, an LMM may process sensitive inputs and trigger actions through agents or tools, creating governance, access control, and audit needs.
What a Large Multimodal Model Is
A large multimodal model is not limited to one input type. It can fuse text, images, audio, or video into a single inference workflow, which makes it more flexible than a text-only model and more complex to govern.
That broader input surface matters because security controls that work for plain prompt text may not cover embedded image content, spoken instructions, or video-derived cues. In practice, the model’s behaviour depends on how these modalities are normalized, aligned, and handed off to downstream systems.
Why Large Multimodal Models Change the Security Posture
LMMs expand the attack surface by accepting richer inputs and producing outputs that can be consumed by agents, tools, or other applications. An attacker may hide instructions in an image, embed malicious intent in audio, or exploit ambiguity between modalities to influence the model’s response.
They also increase the blast radius of data exposure. A single request can combine confidential text with screenshots, documents, recordings, or meeting content, so the model may ingest more sensitive material than a traditional chat interface would ever see.
For practical hardening guidance, the LLM Security Guide covers the adjacent risks that also apply to multimodal systems, including prompt injection, leakage, output handling, and endpoint limits.
Common Failure Modes in Multimodal Systems
The main failure modes are cross-modal misinterpretation, prompt injection through non-text channels, data leakage from sensitive attachments, and unsafe output handling when the model is allowed to trigger actions. In a business workflow, these failures can turn a model into a conduit for policy bypass rather than a passive analytical tool.
Multimodal systems also struggle when one modality contradicts another. A user may provide safe text but unsafe image content, or a benign image with malicious overlay text, and the model may treat the combined signal as trustworthy when it should not.
When the model is connected to assistants or automations, the risk is not just incorrect content, but incorrect action. A weak boundary between interpretation and execution can let an untrusted input shape a real downstream operation.
Governance and Control Expectations
LMM governance should treat each modality as a distinct ingestion path with its own classification, logging, retention, and approval requirements. Sensitive images, recordings, and documents should not be assumed to be lower risk just because they are not plain text.
Access control also matters at the orchestration layer. If an LMM can call tools, query internal systems, or forward content to another workflow, the permissions around those actions must be scoped to the minimum necessary use case and reviewed as part of the model’s operating design.
Good governance also means retaining enough audit detail to reconstruct what the model saw and what it did with that content. Without that trail, it becomes difficult to explain data handling, detect abuse, or review a questionable decision after the fact.
Risk and Threat Considerations
LMMs create a broader and less visible attack surface than text-only models because the model can be influenced through multiple channels at once. That raises the likelihood of hidden prompt injection, sensitive data exposure, and unsafe downstream actions when the model is embedded in agentic workflows.
Failure mechanism: An attacker abuses one modality, such as an image, audio clip, or document, to shape the model’s interpretation, then uses that manipulated interpretation to exfiltrate data, override policy intent, or trigger an unsafe tool call.
Impact: The result can be confidentiality loss, unauthorized action, corrupted decisions, and difficult-to-reconstruct compromise paths across the model, its tools, and the systems it touches.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | LMMs can drive tools from model outputs, creating misuse risk. |
| Recommendation — Constrain tool permissions and review every model-to-tool action path. | ||
| MITRE ATLAS | T? — Adversarial AI Techniques | Multimodal attacks often rely on AI-specific prompt and input manipulation. |
| Recommendation — Model multimodal abuse patterns in adversarial AI testing and monitoring. | ||
| NIST AI RMF | GOVERN — Govern | LMMs require documented accountability and risk oversight for multimodal use. |
| Recommendation — Assign AI governance ownership for multimodal ingestion, output use, and escalation. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Auditability is essential when multimodal systems process sensitive inputs and trigger actions. |
| Recommendation — Log multimodal inputs, outputs, and tool actions for later review. | ||
Practitioner Guidance
Why practitioners should care: LMM risk is rarely confined to the model itself. The real governance question is whether the organization can control what content enters the system, what the model is allowed to infer from it, and what actions it is allowed to trigger afterward.
Common misunderstanding: Teams often assume that adding more modalities only improves accuracy. In reality, each new modality introduces a separate trust boundary, separate abuse path, and separate review burden.
Practitioner takeaway: Treat multimodal input, model interpretation, and downstream execution as three different security problems, not one.
Related resources from NHI Mgmt Group
- How do you know if a large authorization model is still manageable?
- Should organisations treat multimodal AI as part of their identity and access model?
- How can organisations reduce the impact of unsafe multimodal model output?
- How do security teams decide whether to use a large model or a smaller model for browser automation?