VISOR exposes a runtime steering gap in multimodal AI security

At a glance

What this is: This is HiddenLayer’s analysis of VISOR, a visual-input steering method that can alter multimodal model behaviour without touching model internals at runtime.

Why it matters: It matters because IAM, security, and AI governance teams need to treat image inputs as a control surface, not just prompts, when they assess agent and model behaviour.

Context

Multimodal AI systems can be influenced through more than text prompts. When a model accepts images and text through shared processing paths, the image channel can become a behavioural control point rather than a passive input stream, which changes how teams should think about runtime governance.

HiddenLayer’s VISOR research argues that this creates a steering gap in current AI security assumptions. Controls built around API access, system prompts, and post-training alignment do not fully address input-space manipulation when a crafted image can shift model behaviour during inference.

For practitioners governing AI assistants, customer-facing multimodal tools, or internal copilots, the central issue is not whether the model can classify an image correctly. It is whether the organisation can bound what that image is allowed to do to the model’s behaviour once it is processed.

Key questions

Q: What breaks when a multimodal AI system can be steered through images?

A: The assumption that only prompts or privileged model access can influence behaviour breaks down. A crafted image can act like a hidden control signal, changing refusal, compliance, or bias patterns during normal inference. That means image handling, not just text filtering, becomes part of the security boundary for multimodal AI.

Q: Why do API walls not fully protect multimodal models from behavioural manipulation?

A: Because the attack does not need to cross the API wall in the way traditional model tampering does. If the model accepts untrusted visual inputs, an attacker can still influence internal activations and reshape output behaviour through standard inference channels. The risk is input-space control, not model-host compromise.

Q: How can security teams detect steering attacks in AI assistants?

A: Look for unexplained shifts in refusal rate, tone, compliance, or bias after particular image uploads or sessions. The strongest signal is repeated behavioural change tied to a specific visual pattern rather than a text prompt. Detection should combine red-team tests, session analytics, and image-source correlation.

Q: What should organisations do when a visual input changes model behaviour without code changes?

A: Treat it as a governance incident, not a cosmetic anomaly. Preserve the input, isolate the affected workflow, compare behaviour with clean inputs, and review whether the image path is acting as an unauthorised control channel. The goal is to contain behavioural drift before it spreads across production interactions.

Technical breakdown

How image inputs can steer multimodal model behaviour

VISOR works because some vision-language models fuse visual and textual information through shared neural pathways. That means an image can do more than influence perception or classification. It can shift internal activations in ways that bias the model’s downstream response style, refusal behaviour, or willingness to comply. This is different from ordinary prompt injection because the trigger is not text instruction content but the embedding of a visual pattern that alters model state. The key technical point is that the attacker does not need to control model weights or inject code. They only need a valid image input that survives preprocessing and reaches inference intact.

Practical implication: Treat image ingestion as a security boundary and inspect whether your multimodal stack can detect behavioural steering patterns, not just malicious content.

Why input-space steering bypasses runtime access assumptions

Traditional activation steering assumes white-box access to internal model states at runtime. VISOR removes that requirement by pushing the steering effect through the input layer, where any user who can upload or attach an image may be able to influence the model. That breaks the operational assumption that only the provider or an insider with privileged access can alter behaviour at runtime. It also means API gating is not a complete defence if the model still consumes untrusted visual content. In practice, the control failure is architectural: security teams have been protecting the model internals while the attack lands entirely through ordinary input handling.

Practical implication: Reassess any control model that equates no-weight-access with no-runtime-manipulation risk.

Why universal steering images matter for policy enforcement

The article’s most important claim is that a single optimised image can generalise across many prompts and preserve its steering effect during a session. That makes this more than a one-off adversarial example. It becomes a repeatable behavioural control mechanism that can be reused across interactions, which is especially relevant for bias, refusal, and safety policy enforcement. For governance teams, this is the difference between a local anomaly and a scalable manipulation channel. If one image can consistently change model temperament across tasks, then policy enforcement cannot rely only on prompt templates or static moderation filters.

Practical implication: Design monitoring and response around persistent behavioural drift within sessions, not just obvious prompt violations at the point of input.

Threat narrative

Attacker objective: To manipulate a multimodal model into producing predictable unsafe, biased, or policy-bending outputs through an ordinary image input.

1. Entry occurs when an attacker supplies a crafted image through a normal multimodal input channel such as an upload, attachment, or supported document image.
2. The image induces hidden activation offsets that steer model behaviour without any need for model access or code execution at runtime.
3. The altered session output persists across subsequent prompts, allowing repeated behavioural manipulation within the same interaction.
4. Impact follows when the model produces systematically biased, unsafe, or policy-violating responses that affect customer, safety, or brand outcomes.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

VISOR exposes an input-space governance gap, not a prompt-engineering problem. The article shows that multimodal behaviour can be steered through images even when the model internals are untouched at runtime. That means the control boundary has moved from text policy to input handling, and current AI governance programmes are still treating those as separate concerns. Practitioners should read this as a boundary failure in multimodal security, not just an adversarial ML curiosity.

The assumption that API walls stop behavioural manipulation has collapsed. That assumption was designed for models whose runtime behaviour was only modifiable by privileged internal access. It fails when the model can be nudged through user-controlled visual inputs that survive the normal inference path. The implication is that organisations need to rethink where behavioural trust is established, because access control alone does not govern the model’s response shape.

Behavioural safety for multimodal AI now needs the same seriousness as identity trust in other control planes. A model that can be redirected by an image is not simply misclassifying content, it is accepting an untrusted control signal. That shifts the practitioner question from “can the model read this input?” to “what authority does this input have over the output?” The field should treat multimodal steering as a first-class governance issue for AI deployment.

VISOR is a named example of runtime steering exposure in multimodal AI. It gives the category a useful concept: a runtime steering gap where ordinary inputs can act like hidden behavioural controls. That matters because it bridges safety, security, and deployment design in one problem statement. Practitioners should use the concept when they assess whether multimodal systems can be influenced after the model is already in production.

Defensive use does not erase the governance problem. The article suggests the same mechanism could be used to improve fairness or safety, but that does not make the control surface benign. Any control that can both harden and hijack behaviour deserves stronger lifecycle governance, provenance checks, and monitoring. The key issue is not whether steering is useful, but who is allowed to introduce it and under what assurance model.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Runtime steering gap: Multimodal AI systems now need governance over what inputs are allowed to influence behaviour, not just what outputs are allowed to say. If image channels can reshape refusal and compliance patterns, then AI observability must move from content review to behavioural drift detection.

The practical consequence for security teams is that multimodal controls need to sit closer to ingestion and session monitoring than traditional prompt filters do. This is where AI agent and assistant governance starts to resemble broader identity security: the question is not only who can access the system, but what authority each input has once inside the session.

For practitioners

• Inventory multimodal control surfaces Map every place images, screenshots, scans, or attachments can alter model behaviour in customer-facing and internal AI systems. Treat those paths as behavioural inputs, not only content inputs.
• Test for behavioural drift under benign-looking images Run red-team style evaluations that compare refusal, bias, and compliance patterns with and without image inputs. Focus on whether a single visual input changes the model’s temperament across many prompts.
• Add image-channel monitoring to AI observability Log when specific image sources, file types, or upload patterns correlate with shifts in output style, refusal rate, or unsafe compliance. Build alerting around unexplained session-to-session behavioural change.
• Separate content moderation from control-surface governance Do not assume that blocked imagery or NSFW filters address steering risk. Review whether your guardrails can detect inputs that are visually ordinary but behaviourally manipulative.

Key takeaways

• VISOR shows that crafted images can change multimodal model behaviour through ordinary input channels, which means the runtime control problem extends beyond text prompts.
• The article’s evidence points to a real governance gap because steering can occur without model access and persist across a session.
• Practitioners should treat image inputs as potential control surfaces and build monitoring for behavioural drift, not just unsafe content.

Key terms

• Multimodal Steering: Multimodal steering is the use of one input modality, such as an image, to alter how an AI model behaves on subsequent outputs. In practice, it turns a normal user input into a behavioural control signal that can influence refusal, tone, bias, or compliance.
• Runtime Steering Gap: A runtime steering gap is the difference between the controls an organisation assumes govern a model at inference time and the controls that actually exist. For multimodal systems, it appears when image inputs can modify behaviour without any direct access to model weights or code.
• Behavioural Drift: Behavioural drift is the gradual change in what an identity does compared with what it was originally approved to do. For AI agents, drift can come from prompt changes, model updates, expanded integrations, or altered workflows, which makes access review alone an incomplete control.
• Input-Space Attack: An input-space attack uses a normal supported input channel to cause an unwanted model effect. For multimodal AI, this means the attacker does not need internal access if the payload is embedded in text, images, or other accepted content types.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.