Topic starter
05/07/2026 6:57 pm
TL;DR: Vision-language models can be behaviorally steered through crafted images, producing effects similar to activation-level steering without runtime model access, and with negative steering shifts as high as 25 percentage points, according to HiddenLayer’s VISOR research. The finding matters because it breaks the assumption that API walls and prompt filters alone can prevent behavioral manipulation.
Editorial analysis by NHI Mgmt Group, based on content published by HiddenLayer: “Visual Input based Steering for Output Redirection (VISOR)”.
Key questions
Q: What breaks when a multimodal AI system can be steered through images?
A: The assumption that only prompts or privileged model access can influence behaviour breaks down.
Q: Why do API walls not fully protect multimodal models from behavioural manipulation?
A: Because the attack does not need to cross the API wall in the way traditional model tampering does.
Q: How can security teams detect steering attacks in AI assistants?
A: Look for unexplained shifts in refusal rate, tone, compliance, or bias after particular image uploads or sessions.
Practitioner guidance
- Inventory multimodal control surfaces Map every place images, screenshots, scans, or attachments can alter model behaviour in customer-facing and internal AI systems.
- Test for behavioural drift under benign-looking images Run red-team style evaluations that compare refusal, bias, and compliance patterns with and without image inputs.
- Add image-channel monitoring to AI observability Log when specific image sources, file types, or upload patterns correlate with shifts in output style, refusal rate, or unsafe compliance.
Bottom line: VISOR shows that crafted images can change multimodal model behaviour through ordinary input channels, which means the runtime control problem extends beyond text prompts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:20 pm
VISOR exposes an input-space governance gap, not a prompt-engineering problem. The article shows that multimodal behaviour can be steered through images even when the model internals are untouched at runtime. That means the control boundary has moved from text policy to input handling, and current AI governance programmes are still treating those as separate concerns. Practitioners should read this as a boundary failure in multimodal security, not just an adversarial ML curiosity.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do when a visual input changes model behaviour without code changes?
A: Treat it as a governance incident, not a cosmetic anomaly. Preserve the input, isolate the affected workflow, compare behaviour with clean inputs, and review whether the image path is acting as an unauthorised control channel. The goal is to contain behavioural drift before it spreads across production interactions.
👉 Read our full editorial: VISOR exposes a runtime steering gap in multimodal AI security