mlsanityData to 7 Oct 2026

Self-interpreting Adversarial Images

arXiv 2407.08970 ↗First posted 12 Jul 2024cs.CR cs.AI cs.LGcited by 7

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

We introduce a new type of indirect, cross-modal injection attacks against visual language models that enable creation of self-interpreting images. These images contain hidden "meta-instructions" that control how models answer users' questions about the image and steer models' outputs to express an adversary-chosen style, sentiment, or point of view. Self-interpreting images act as soft prompts, conditioning the model to satisfy the adversary's (meta-)objective while still producing answers based on the image's visual content. Meta-instructions are thus a stronger form of prompt injection. Adversarial images look natural and the model's answers are coherent and plausible, yet they also follow the adversary-chosen interpretation, e.g., political spin, or even objectives that are not achievable with explicit text instructions. We evaluate the efficacy of self-interpreting images for a variety of models, interpretations, and user prompts. We describe how these attacks could cause harm by enabling creation of self-interpreting content that carries spam, misinformation, or spin. Finally, we discuss defenses.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 41 of its 48 references that are in the map. First posted on arXiv 12 Jul 2024.

Builds on

41 of 48 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  2. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  3. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  4. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  5. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 36

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2023Visual Instruction Tuningcited by 7,792
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  8. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,769
  9. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  10. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  11. 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,447
  12. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
24 more
  1. 2023LLaVA-Med: Training a Large Language-and-Vision Assistant for Biomedicine in One Daycited by 1,287
  2. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  3. 2021Ethical and social risks of harm from Language Modelscited by 957
  4. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  5. 2017Adversarial Patchcited by 514
  6. 2022Diffusion Models for Adversarial Purificationcited by 469
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  8. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  9. 2020TweetEval: Unified Benchmark and Comparative Evaluation for Tweet Classificationcited by 414
  10. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  11. 2018Dear Sir or Madam, May I introduce the GYAFC Dataset: Corpus, Benchmarks and Metrics for Formality Style Transfercited by 209
  12. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
  13. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  14. 2023Co-Writing with Opinionated Language Models Affects Users' Viewscited by 145
  15. 2022TimeLMs: Diachronic Language Models from Twittercited by 129
  16. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  17. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 88
  18. 2020Reevaluating Adversarial Examples in Natural Languagecited by 83
  19. 2022TweetNLP: Cutting-Edge Natural Language Processing for Social Mediacited by 71
  20. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  21. 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 57
  22. 2023Adversarial Illusions in Multi-Modal Embeddingscited by 28
  23. 2023Don't lose the message while paraphrasing: A study on content preserving style transfercited by 25
  24. 2022Adversarial Contrastive Learning via Asymmetric InfoNCEcited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 4.

7 papers.

  1. 2025Multi-Agent Systems Execute Arbitrary Malicious Codecited by 52
  2. 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Modelscited by 27
  3. 2026MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attackscited by 18
  4. 2025Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Modelscited by 2
  5. 2026DE-FIVE: Detecting Malicious Image Prompts via Fourier Features and Image Vector Embeddingscited by 0
  6. 2026Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agentscited by 0
  7. 2026Repeat-After-Me: Black-Box Adaptive Visual Prompt Injectioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Render Before Reading: Visual Rendering as a Prompt Injection Defense
  2. 2026Visual Memory Injection Attacks for Multi-Turn Conversations
  3. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks
  4. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  5. 2026Laundering AI Authority with Adversarial Examples
  6. 2026Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection
  7. 2025Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities
  8. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models