How attackers hide malicious instructions in images, PDFs, audio, video, and enterprise knowledge bases — and why traditional security controls miss it entirely. Covers 4 generations of injection, 6 attack surface types, image/PDF/audio/RAG-based injection techniques, 5 defence layers, and testing checklist.
Every text-based prompt injection defense an organization has built — input filtering, output validation, prompt injection classifiers, safety alignment tuned on text — shares one architectural assumption: that the attack arrives as text. Multimodal prompt injection breaks that assumption entirely. Attackers embed instructions in images, PDFs, audio, and video that are invisible or meaningless to a human glancing at them, but fully legible to a vision-language model processing the same content. The defense isn't weakened against this category of attack — it's simply not looking in the right place at all.
Vision-language models process images holistically through encoders that translate pixel data into internal representations, rather than through any kind of rule-based text parsing that could distinguish "content the user wants summarized" from "instructions hidden inside that content." The entire image becomes a single source of contextual information to the model, and once an instruction is embedded inside it, that instruction enters the same instruction-following pathway as a legitimate system prompt would. The model has no architectural mechanism for treating embedded text differently based on where it came from — a sentence rendered as pixels inside an uploaded screenshot looks, to the model's internal representation, structurally similar to an instruction typed directly into the chat box.
Typographic injection is the most straightforward technique — rendering malicious instructions as actual text within the image itself, using tricks like white text on a white background, tiny font sizes, rotated text, or text blended into a visually busy background that a human reviewer would skim past without reading carefully. It's technically visible under close inspection, but in practice it's frequently missed precisely because nobody examines every uploaded image at pixel-level scrutiny.
Steganographic encoding hides instructions invisibly within the pixel data itself, using techniques like least-significant-bit encoding or frequency-domain transforms that produce an image visually indistinguishable from the unmodified original — there's no rendered text to spot at all, because the payload exists below the level of human visual perception entirely.
Adversarial perturbations take a different approach again — rather than encoding readable text, optimized noise patterns shift the vision encoder's internal representation toward a malicious target output without ever encoding anything a human or a basic text-extraction tool would recognize as an instruction.
Physical-world signage extends the same idea into the real world — instructions embedded on physical objects like signs, packaging, clothing, or screen displays, sitting within the field of view of any camera-equipped AI agent. These typically remain visible to a human, but read as ordinary graffiti, wear, or design rather than as something that should be flagged.
The delivery channel is whatever the system already processes routinely — a customer support ticket with an attached "screenshot" containing hidden instructions, a webpage with an adversarial image that a browsing-enabled agent encounters during normal operation, a PDF with embedded images carrying a steganographic payload, an email attachment disguised as an ordinary receipt, or a physical sign or label captured by a camera-equipped agent operating in the real world. None of these channels look unusual on their own — they're exactly the kind of content the system was built to process.
Text sanitizers operate on character-level input and simply have nothing to inspect when the payload is encoded in pixels rather than characters. Prompt injection classifiers built to analyze natural language don't process visual embeddings at all. Safety alignment training has historically been developed primarily on text, leaving visual and audio inputs with comparatively weaker guardrails by default. And OCR-based detectors built specifically to catch typographic injection can be defeated by splitting the harmful text across multiple sub-images, where each individual fragment looks innocuous in isolation and the meaning only reconstructs once the model processes all the tiles together as a whole.
It bypasses an organization's entire existing text security stack by design — every defense built for text-based injection is architecturally incapable of seeing an attack that enters through the vision encoder rather than the text tokenizer. It's frequently imperceptible to direct human review, since steganographic and adversarial-perturbation techniques specifically aim to produce images that look completely benign under ordinary inspection. Techniques crafted against one vision-language model often transfer to others, meaning an attacker doesn't need precise knowledge of the exact target model's architecture to have a reasonable chance of success. And unlike purely digital text injection, visual injection can exist in the physical world — a printed sign or label can attack a camera-equipped agent without any digital delivery step at all.
Academic research into prompt injection against vision-language models used in medical contexts has demonstrated that hidden instructions embedded in medical images can cause AI systems to produce harmful diagnostic output, with the prompts invisible to a human observer but fully legible to the model — and notably, the vulnerability wasn't confined to one model family, with multiple major vision-language models tested showing the same susceptibility. Separately, research on image-based typographic injection has demonstrated that under realistic stealth constraints designed to evade casual human inspection, this category of attack achieves a meaningfully high success rate across several major commercial and open-source vision-language models. Research on steganographic embedding has similarly shown that images can carry hidden instructions while remaining visually almost indistinguishable from their unmodified originals, passing standard visual inspection entirely. And researchers studying physical-world attacks have validated that adversarial instructions placed on real signs can influence camera-equipped autonomous systems including vehicles and drones — moving this category of risk out of the purely digital realm and into physical safety territory.
For images: JPEG compression tends to destroy high-frequency adversarial noise as a side effect of normal lossy compression; spatial smoothing reduces the impact of small, localized perturbations; bit-depth reduction eliminates least-significant-bit steganography specifically; random cropping and resizing disrupts payloads that were carefully positioned at exact pixel coordinates; and running OCR followed by text filtering on any text found inside an image, before that image reaches the vision-language model, catches a meaningful share of typographic injection attempts. For audio: bandpass filtering removes ultrasonic commands outside the range of normal human speech, noise reduction and spectral gating clean up embedded signal-level payloads, and resampling can disrupt adversarial frequency patterns that depend on a specific sample rate.
Watch for unusual output patterns specifically correlated with image-bearing inputs rather than text-only ones. Track confidence and response characteristics separately for image versus text-only inputs, since a meaningful divergence between the two is itself a signal worth investigating. Flag any response that contains instructions or actions that weren't present anywhere in the accompanying text prompt — if the model is acting on something, and that something didn't come from the text, it likely came from the image.
A dual-model pattern creates a genuine sanitization boundary: a vision model describes the image in plain natural language first, and a separate text-only model handles the actual instruction-following and reasoning based on that description plus the user's query. Any visual instruction has to survive translation into a purely descriptive sentence before it can influence behavior — which meaningfully raises the bar compared to letting the vision-language model reason directly over raw pixels and instructions together in the same pass.
For genuinely critical decisions — medical diagnosis, financial transactions, security alerts — never rely on a vision-language model's output alone. Flag low-confidence or statistically anomalous visual processing results for human review rather than auto-approving them. Require explicit human confirmation before any action triggered by an image input actually executes. And sample VLM outputs for periodic audit even when nothing about a given interaction looked unusual at the time, since the entire point of this attack category is that it's designed not to look unusual.
Before trusting a multimodal pipeline in production: test typographic injection with hidden text rendered in low-contrast or tiny fonts against your actual ingestion pipeline. Test steganographic payloads to confirm your preprocessing actually disrupts them rather than passing them through untouched. Test whether splitting a malicious instruction across multiple sub-images bypasses any OCR-based filtering specifically. Confirm preprocessing steps like compression, smoothing, and bit-depth reduction are actually applied before images reach the model, not just configured and forgotten. And if your system processes camera input from the physical world, test against printed signage specifically, since this is the one variant of the attack that traditional digital-only red teaming will never surface.
A text-based prompt injection filter provides zero protection against an instruction embedded in an image. If your system processes any visual, audio, or video input, your text-only defenses have a hard architectural blind spot, not a partial gap.