Quick answer: Multimodal prompt injection is an attack that tricks a multimodal AI model by embedding a hidden instruction into a non text input such as an image, audio or document. For example when text that is invisible to the eye but readable by the model is placed into a picture, the model mistakes that text for the user's instruction and changes its behavior. This attack is dangerous because security filters mostly inspect the written prompt and miss the instruction embedded in the image or document. DSET tests this flaw with its local AI engine KAOS and verifies every finding with a working proof.

AI models no longer work with text alone. We can give a model a photo of an invoice and ask it to extract the amount, interpret a screenshot or transcribe an audio recording. This multimodal capability brings great convenience, but it opens a new attack door: the dangerous instruction entering the model can now be not only in written text but also in the pixels of an image or the invisible layer of a document. This article explains what multimodal prompt injection is, which scenarios it causes and the DSET and KAOS approach.

What multimodal prompt injection is

Classic prompt injection is adding a malicious instruction to the written text sent to the model. Multimodal prompt injection is a step beyond this: the instruction is embedded into a non text input the model processes. Because an image model can read the text inside a picture, an attacker can place text into the picture that the human eye does not notice but the model perceives, for example faint text in nearly the same color as the background. The model sees this text and often processes it as an instruction. The same logic applies to hidden text embedded in documents the model loads and to commands mixed into audio recordings.

Which scenarios it causes

Where the instruction is embedded and how the model uses that input determines the result of the attack.

Embedding channel How it works Typical result
Hidden text in an image Invisible or faint text is added to the picture The model changes its instruction, leaks data
Directive embedded in a document A hidden command is placed in an uploaded document Indirect prompt injection
Through a screenshot A fake instruction is printed into the interface the agent sees The agent performs an unwanted action
Command mixed into audio Audio meaningless to a human is perceived as a command by the model Tricking of the voice assistant
Inside a QR or code An instruction is embedded in the scanned code Steering of the automated workflow

The essence of the table is this: in multimodal models every input channel is at the same time an instruction channel, and if the defense inspects only the written prompt the open channel stays open. This attack is especially dangerous when the attacker controls the content not directly but indirectly; this indirect attack logic is a natural extension of the topic of prompt injection and OWASP LLM Top 10.

Why classic filters fall short

Most AI security layers scan the text the user typed and try to catch malicious patterns. But in a multimodal attack the instruction is not in the written text, it is in the pixels of an image or in a layer of a document. If the filter does not inspect this channel, the attack passes beside it. For this reason a multimodal system's security firewall must parse and inspect every input type, including images and documents; for the design of this layer the topic of AI security firewall and guardrails is the reference point.

Its relation to agent systems

Multimodal prompt injection is far more dangerous in agent systems where a model not only produces an answer but sees the screen and performs actions. A fake instruction printed into a screenshot can steer a highly privileged agent into an unwanted action. This risk is directly connected to the topic of excessive agency and tool abuse in LLM agents, because the problem is not only that the model is tricked but how powerful an action it can take after being tricked. For mapping the attack techniques, the MITRE ATLAS AI threat matrix is also a useful framework in this area.

When it is tested

The correct practice is to test before every AI feature that processes images, documents or audio goes live. Flows where users can upload files or images and the model acts on these inputs are especially high risk. For drawing the scope clearly the penetration testing preparation and scoping guide is the reference point.

The KAOS and DSET approach

DSET tests multimodal prompt injection as part of the broader AI and LLM application penetration testing service, with its local AI engine KAOS. KAOS places controlled hidden instructions into the image and document inputs given to the model and checks whether the model processes these instructions. It reports every flaw it finds with a working proof, under the principle of proof based verification. The difference is this: it does not settle for saying an image is theoretically risky, it shows that the image actually steers the model into an unwanted behavior.

Frequently asked questions

Is a multimodal attack a real threat or a lab curiosity? It is a real threat. AI features that process images and documents are spreading fast, and these features act on content users upload. All an attacker has to do is embed a hidden instruction into a file that looks harmless. Every scenario where content is uploaded by the user is open to this risk.

If we cannot see the instruction embedded in an image, how do we defend against it? The defense is to parse the image not with the human eye but in the form the model perceives. The security layer must extract and inspect the text in the image as the model reads it and treat every input going to the model as untrusted. In addition the actions caused by the model's output must be separately limited with the principles of improper output handling.

Does this attack affect only image models? No. Image is the most visible example, but the same logic applies to documents, audio and every non text input the model processes. The general principle is this: whatever channel the model receives data from, that channel is at the same time an attack channel and must be tested separately.

Sources

To examine your multimodal AI features with a proof based test, contact DSET. We provide AI application penetration testing and consulting from our Ankara Hacettepe Teknokent laboratory.