mlsanityData to 7 Oct 2026

Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection

arXiv 2604.09024 ↗First posted 10 Apr 2026cs.CV cs.AI cs.CRcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Multi-modal large language models (MLLMs) have emerged as powerful tools for analyzing Internet-scale image data, offering significant benefits but also raising critical safety and societal concerns. In particular, open-weight MLLMs may be misused to extract sensitive information from personal images at scale, such as identities, locations, or other private details. In this work, we propose ImageProtector, a user-side method that proactively protects images before sharing by embedding a carefully crafted, nearly imperceptible perturbation that acts as a visual prompt injection attack on MLLMs. As a result, when an adversary analyzes a protected image with an MLLM, the MLLM is consistently induced to generate a refusal response such as "I'm sorry, I can't help with that request." We empirically demonstrate the effectiveness of ImageProtector across six MLLMs and four datasets. Additionally, we evaluate three potential countermeasures, Gaussian noise, DiffPure, and adversarial training, and show that while they partially mitigate the impact of ImageProtector, they simultaneously degrade model accuracy and/or efficiency. Our study focuses on the practically important setting of open-weight MLLMs and large-scale automated image analysis, and highlights both the promise and the limitations of perturbation-based privacy protection.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 30 of its 40 references that are in the map. First posted on arXiv 10 Apr 2026.

Builds on

30 of 40 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  2. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul

Other references · 28

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  10. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  11. 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,048
  12. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
16 more
  1. 2015VQA: Visual Question Answeringcited by 2,489
  2. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,179
  3. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,037
  4. 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,793
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2019Towards VQA Models That Can Readcited by 1,696
  7. 2014Deep Visual-Semantic Alignments for Generating Image Descriptionscited by 966
  8. 2018Generating Natural Language Adversarial Examplescited by 422
  9. 2023Automatically Auditing Large Language Models via Discrete Optimizationcited by 187
  10. 2019MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examplescited by 183
  11. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  12. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  13. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 92
  14. 2018AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learningcited by 58
  15. 2017Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classificationcited by 56
  16. 2022Pre-trained Encoders in Self-Supervised Learning Improve Secure and Privacy-preserving Supervised Learningcited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance
  2. 2026Covert Visual Prompt Injection against Commercial Multimodal Large Language Models
  3. 2026Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks ↗
  4. 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Models
  5. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security
  6. 2026Visual Memory Injection Attacks for Multi-Turn Conversations
  7. 2026To See is Not to Learn: Protecting Multimodal Data from Unauthorized Fine-Tuning of Large Vision-Language Model
  8. 2026A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation