Once a model can see images, hear audio and read files, every picture, recording and scanned page it processes becomes a possible carrier for instructions the user never saw. Text filters and prompt review do not inspect pixels or waveforms, and the preprocessing that turns media into model input can itself reveal hidden content. This guide covers how instructions reach a model through non-text channels, why text-centric defences miss them, and the architectural, preprocessing and monitoring controls that limit the damage. It is for application security engineers, AI platform teams and security architects building or approving assistants and agents that accept uploads, screenshots, voice or documents. For the general problem, start with the Prompt Injection Guide.
Key takeaways
- Every modality is an input channel. OWASP LLM01:2025 lists multimodal injection as a scenario: a prompt embedded in an image that accompanies benign text can alter the model's behaviour and lead to unauthorised actions or disclosure.
- What the model sees is not what the user sees. Research has shown instructions hidden in image perturbations, in audio, and in images that only reveal text after the application downscales them.
- Detection will not close the gap. The UK NCSC describes prompt injection as a confusable deputy problem to be reduced, not eliminated. Plan for some injections getting through.
- Constrain what the model can do after it reads media. Deterministic limits on tools, data flows and approvals matter more than any media classifier.
- Treat derived text as untrusted. OCR output, transcripts, captions and file metadata carry the trust level of the file they came from, not the user who uploaded it.
How multimodal injection differs from text injection
In text prompt injection, the hostile instruction is at least present as characters somewhere in the input, even if hidden by formatting. In multimodal injection the instruction may exist only as a pattern the model interprets: rendered text in an image, a perturbation invisible to people, speech under music, or text that appears only after a resize. Three consequences follow.
- Text scanners see nothing: keyword filters and text-based injection classifiers inspect strings. Unless the application first extracts text from the media, they have nothing to scan, and adversarial perturbations may produce no extractable text at all.
- Human review is unreliable: a reviewer looking at the image or listening to the clip may perceive nothing unusual.
- The pipeline matters: resizing, compression, transcription and format conversion change what the model receives. A control placed before preprocessing may inspect a different object from the one the model reads.
MITRE ATLAS covers the underlying technique as AML.T0051 LLM Prompt Injection, with AML.T0051.001 Indirect for content from external sources, and groups hiding methods, including instructions in image pixels and file metadata, under AML.T0068 LLM Prompt Obfuscation. MITRE ATT&CK v20 includes T1698 Indirect Prompt Injection.
Carriers and where they enter
| Carrier | How the instruction is hidden (described, not demonstrated) | Typical entry point |
|---|---|---|
| Rendered text in images | Text that is small, low contrast, or placed where people do not look, read by the model's vision capability | Screenshots, product photos, slides, memes, web images fetched by an agent |
| Adversarial image perturbations | Pixel changes tuned so the model outputs attacker-chosen text, imperceptible to people (Bagdasaryan et al., 2023) | Any image the model analyses |
| Preprocessing artefacts | Images that look harmless at full size but reveal text after the application downscales them (Trail of Bits, August 2025) | Upload pipelines that resize before inference |
| Audio | Speech or perturbations blended into recordings that a model or transcription step interprets as instructions | Voice assistants, meeting transcription, call analytics, voicemail processing |
| Documents and scans | Hidden layers, white text, annotations, embedded images and scanned pages processed with OCR | Email attachments, CVs, invoices, contracts, support uploads |
| File metadata | Instructions in EXIF fields, document properties, comments or alt text | Pipelines that pass metadata into context |
| Video frames | Instructions in individual frames or on-screen text sampled by the model | Video summarisation and screen recording analysis |
The common thread is indirect injection: the person interacting with the assistant is often the victim, not the attacker. A job applicant's CV, a supplier's invoice or a web image fetched by a browsing agent can all carry instructions into a privileged workflow.
What a successful injection achieves
The outcomes are the same as for text injection, which is why the impact-limiting controls are shared.
- Data exfiltration through tools: the model is steered to send conversation content, files or secrets to an external destination using a tool it already has (ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation). Trail of Bits demonstrated data exfiltration through a command line AI agent where the user had no preview of the processed image.
- Exfiltration through rendering: output that includes an attacker-controlled link or image reference which the client fetches automatically (AML.T0077 LLM Response Rendering).
- Unauthorised actions: sending email, changing records or running commands with the agent's credentials (AML.T0053 AI Agent Tool Invocation).
- Manipulated decisions: a scored CV, an approved invoice or a summarised contract that reflects the hidden instruction rather than the content.
Controls by layer
No single layer is reliable. Combine preprocessing hygiene, input screening on what the model actually receives, and hard limits on what happens afterwards.
| Layer | Control | What it does and does not do |
|---|---|---|
| Ingestion | Limit accepted formats, dimensions and duration; reject rather than resize oversized images where possible | Trail of Bits recommends limiting upload dimensions over downscaling. Reduces preprocessing surprises; does not stop text rendered in images |
| Ingestion | Strip metadata, annotations and hidden layers before inference unless the task needs them | Removes a cheap carrier; legitimate metadata needs an explicit allow decision |
| Preview | Show the user the processed input the model receives, including in CLI and API tools | Makes downscaling artefacts visible; relies on the user looking |
| Extraction | Run OCR or transcription in a separate, tool-less step and pass the text through the same injection screening as other untrusted text | Gives text classifiers something to inspect; misses perturbations that yield no readable text |
| Provenance | Label every content segment with its source and trust level, and keep the label through extraction | Lets policy decide what a segment may influence; requires the orchestration layer to enforce it |
| Isolation | Process untrusted media with a model that has no tools and returns only structured fields to the privileged agent | Strong pattern; reduces flexibility |
| Action control | Require explicit user approval for sensitive tool calls triggered after untrusted media is in context | Recommended by Trail of Bits and aligned with the NCSC's deterministic safeguards; approval fatigue is a risk |
| Egress | Block automatic fetching of model-generated URLs and images; allow-list outbound destinations for tools | Closes common exfiltration paths regardless of how the injection arrived |
The NCSC's principle is a useful default: an LLM's privileges should drop to those of whichever party supplied the content it is processing. An agent that has just read a stranger's image should not keep full access to the user's mailbox. Published agent design patterns, such as those by Beurer-Kellner et al. (2025), formalise this with structured separation between planning and untrusted data. For guardrail products and their limits, see the AI Guardrails and AI Firewalls Guide.
Choosing controls for your application
| Application pattern | Risk profile | Minimum controls (NHI Mgmt Group recommendation) |
|---|---|---|
| Chat assistant, user uploads own images, no tools | Low: the uploader is usually the only victim | Metadata stripping, no automatic URL or image fetching in output |
| Assistant processing third-party documents (CVs, invoices, claims) | Medium to high: decisions about other people can be manipulated | Tool-less extraction, structured outputs, human review of decisions, provenance labels |
| Agent with tools that reads web images, email attachments or screenshots | High: injection can drive actions with the agent's credentials | All of the above plus approval for sensitive actions, egress allow-lists, scoped short-lived credentials |
| Voice agent acting on spoken requests | High where it can transact | Confirm transactions through a separate channel, limit actions available by voice, log transcripts with audio references |
Small teams should start with the action and egress controls, which are deterministic and cheap. Large organisations with many AI applications should put extraction, screening and egress policy in a shared gateway so each team does not rebuild them.
Where identity fits
The damage from a multimodal injection is bounded by the identity the agent acts with. An agent holding a user's full delegated mailbox scope, or a long-lived API key with write access, turns a hidden instruction in an image into a real-world action. Give agents their own identities with task-scoped, short-lived credentials, keep secrets out of the model context entirely, and require step-up approval for actions that move data outside the organisation. See the Runtime Secrets Injection for AI Agents Without Prompt Exposure and the OWASP LLM Top 10 LLM06 Excessive Agency Guide.
Implementing defences in phases
- Inventory multimodal inputs: list every application and agent that accepts images, audio, video or files, and where that media comes from (user, third party, web).
- Map the pipeline: document each preprocessing step (resize, compress, OCR, transcription, metadata handling) and what the model finally receives.
- Apply action and egress limits first: approval gates for sensitive tools, blocked auto-fetch of URLs and images, outbound allow-lists. Test in a staging tenant with a pilot group.
- Harden ingestion: dimension limits, metadata stripping, and a preview of processed input. Roll out behind a feature flag so you can revert if legitimate uploads break.
- Add extraction and screening: tool-less OCR and transcription with provenance labels, and text screening on the output. Run classifiers in monitor-only mode first to measure false positives.
- Red team the media paths: include image, audio and document carriers in authorised testing, using benign canary instructions rather than harmful payloads.
- Review after each model change: vision and audio capability changes between model versions, so re-run the media test set on every upgrade.
Detection and measurement
Log enough to reconstruct which media item was in context when a tool call happened.
- Media-linked tool calls: share of sensitive tool calls made while third-party media was in context, and how many were approved by a person.
- Blocked egress: count of model-initiated requests to non-allow-listed destinations.
- Screening hits on extracted text: rate and false positive rate on OCR and transcription output.
- Media test pass rate: share of canary-based multimodal test cases that fail to trigger the hidden instruction, per model version.
- Coverage: share of multimodal applications with action limits, metadata stripping and provenance labelling in place.
The NCSC also recommends logging inputs, outputs and tool calls and watching for failed tool calls, which can show an attack in progress. Store a hash and reference for each media item rather than copying sensitive images into logs.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| OWASP Top 10 for LLM Applications 2025 | LLM01:2025 Prompt Injection (Scenario 7, multimodal injection) | Names the risk and the scenario |
| MITRE ATLAS | AML.T0051.001 Indirect; AML.T0068 LLM Prompt Obfuscation; AML.T0086 Exfiltration via AI Agent Tool Invocation | Technique vocabulary for threat models and tests |
| MITRE ATT&CK v20 | T1698 Indirect Prompt Injection | Enterprise detection mapping |
| NIST SP 800-53 Rev. 5 | SI-10 Information Input Validation; AC-4 Information Flow Enforcement; AC-6 Least Privilege; SC-7 Boundary Protection | Input handling, data flow and egress controls (editorial mapping) |
| NIST AI 100-2 E2025 | Adversarial machine learning taxonomy | Terminology for evasion and injection attacks |
Common failure patterns
- Screening the upload, not the model input: checks run on the original file while the model receives a resized or converted version.
- Trusting OCR output: extracted text is passed to the agent as if the user had typed it.
- Relying on the resampling algorithm: Trail of Bits warns that picking a "less vulnerable" algorithm is not a robust defence.
- Metadata in context by default: document properties and image fields flow into prompts without anyone deciding they should.
- Full privileges after reading strangers' media: an agent keeps mailbox or file write access while summarising an external attachment.
- Text-only red teaming: test suites cover typed prompts but never images, audio or scanned documents.
Practitioner checklist
- List every AI application that accepts images, audio, video or files, and the source of that media.
- Document the preprocessing pipeline and show users what the model actually receives.
- Limit upload dimensions instead of silently downscaling where possible.
- Strip metadata, annotations and hidden layers unless the task needs them.
- Extract text in a tool-less step and screen it as untrusted content with a provenance label.
- Require approval for sensitive tool calls when third-party media is in context.
- Block automatic fetching of model-generated URLs and images; allow-list tool egress.
- Give agents scoped, short-lived credentials and keep secrets out of context.
- Include image, audio and document carriers in authorised red team tests on every model upgrade.
Standards and references
- OWASP: LLM01:2025 Prompt Injection
- MITRE ATLAS: LLM Prompt Injection
- MITRE ATLAS: LLM Prompt Obfuscation
- MITRE ATT&CK: Indirect Prompt Injection
- NCSC: Prompt injection is not SQL injection (it may be worse)
- NIST: AI 100-2 E2025, Adversarial Machine Learning
- Bagdasaryan et al.: Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs
- Trail of Bits: Weaponizing image scaling against production AI systems
- Beurer-Kellner et al.: Design Patterns for Securing LLM Agents against Prompt Injections
Related NHI Mgmt Group resources: Prompt Injection Incident Response Playbook, OWASP LLM Top 10 LLM01 Prompt Injection Guide, Human-in-the-Loop for AI Agents Guide, AI Red Teaming Guide.