Malicious prompts remain invisible until image downscaling reveals hidden instructionsThe attack works by exploiting how AI resamples uploaded imagesBicubic interpolation can expose black text from specially crafted images<\/p>\n
As AI tools<\/a> become more integrated into daily work, the security risks attached to them are also evolving in new directions.<\/p>\n Researchers at Trail of Bits<\/a> have demonstrated a method where malicious prompts are hidden inside images and then revealed during processing by large language models.<\/p>\n <\/p>\n The technique takes advantage of how AI platforms downscale images for efficiency, exposing patterns that are invisible in their original form but legible to the algorithm once resized.<\/p>\n Hidden instructions in downscaled images<\/p>\n The idea builds on a 2020 paper from TU Braunschweig in Germany, which suggested that image scaling could be used as an attack surface for machine learning.<\/p>\n Trail of Bits showed how crafted images could manipulate systems, including Gemini CLI, Vertex AI Studio, Google Assistant on Android, and Gemini\u2019s web interface.<\/p>\n In one case, Google Calendar data was siphoned to an external email address without user approval, highlighting the real-world potential of the threat.<\/p>\n The attack leverages interpolation methods like nearest neighbor, bilinear, or bicubic resampling.<\/p>\n You may like<\/p>\n When an image is intentionally prepared, downscaling introduces aliasing artifacts that reveal concealed text.<\/p>\n In a demonstration, dark areas shifted during bicubic resampling to display hidden black text, which the LLM<\/a> then interpreted as user input.<\/p>\n From the user\u2019s perspective, nothing unusual appears to happen. Yet behind the scenes, the model follows the embedded instructions along with legitimate prompts.<\/p>\n To illustrate the risk, Trail of Bits created \u201cAnamorpher,\u201d an open-source tool that generates such images for different scaling methods.<\/p>\n This shows that while the approach is specialized, it could be repeated by others if defenses are lacking.<\/p>\n The attack raises questions about trust in multimodal AI systems because many platforms now rely on them for routine work, and a simple image upload could potentially trigger unintended data access.<\/p>\n The danger of identity theft<\/a> arises if private or sensitive information is exfiltrated in this way.<\/p>\n Because these models often link with calendars, communications platforms, or workflow tools, the risk extends into broader contexts.<\/p>\n To mitigate this, users need to restrict input dimensions, preview downscaled results, and require explicit confirmation for sensitive tool calls.<\/p>\n Traditional defenses like firewalls<\/a> are not built to identify this form of manipulation, leaving a gap that attackers may eventually exploit.<\/p>\n The researchers stress that only layered security suites<\/a> and stronger design patterns can reliably limit such risks.<\/p>\n \u201cThe strongest defense, however, is to implement secure design patterns and systematic defenses that mitigate impactful prompt injection beyond multimodal prompt injection,\u201d the researchers said.<\/p>\n