Pith. sign in

REVIEW 6 major objections 6 minor 57 references

Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding

T0 review · 6 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper tries to establish that vision-language models can be covertly commanded through steganographic prompts hidden inside images, with a 24.3% average success rate across eight models.

desk verdict Plausible attack idea, but the paper never shows the stego payload actually gets recovered by a VLM — the central claim rests on an untested hypothesis, and there are no artifacts to check the numbers. read the letter →

arxiv 2507.22304 v1 pith:BOCFNYWM submitted 2025-07-30 cs.CR

Chetan Pathade This is my paper
classification cs.CR
keywords steganographicpromptinjectionvision-languagemodelsneuralsteganographymultimodalsecurityadversarialmachinelearningcovertchannelDCTembedding
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that vision-language models can be covertly commanded through images: a malicious instruction hidden inside a photo with steganography is sometimes read and obeyed by the model during ordinary image processing. Across eight VLMs, including commercial APIs and open-source architectures, the combined embedding method succeeds 24.3% of the time, with neural steganography reaching 31.8%, while the altered images stay visually indistinguishable (PSNR above 38 dB, SSIM above 0.94). The authors argue this creates a real covert channel for prompt injection, one that bypasses text-level filters, and they propose a four-layer defense that they estimate to mitigate 73.4% of attacks. If correct, the finding matters because any deployed VLM that ingests user images could be manipulated by an image that looks normal to people.

What carries the argument

The carrying mechanism is the multi-domain steganographic embedding function, which mixes three parallel channels—adaptive LSB, DCT frequency-domain, and neural encoder-decoder—with weights tuned per image type, $I_s = \alpha S_{\text{LSB}}(I, P_1) + \beta S_{\text{DCT}}(I, P_2) + \gamma S_{\text{Neural}}(I, P_3)$. The framework's central assumption is that a VLM's vision encoder will inadvertently decode these imperceptible perturbations into tokens or semantic influences that the language model acts on; the neural branch additionally optimizes directly against the target model's features.

What would settle it

Generate stego-images whose payload is random gibberish of the same bit-length as real prompts and measure behavioral change against clean images; if the models show the same roughly 24% output change for random bits, the claimed instruction-extraction mechanism is not what drives the numbers.

Watch

Extended reading notes

Core claim

The paper's central claim is that steganographic prompt injection is a viable attack against current vision-language models: by embedding text into images through adaptive LSB substitution, DCT coefficient modification, or learned neural residuals, an attacker can cause a VLM to extract and follow hidden instructions during normal inference. The authors report that the multi-domain embedding framework achieves an overall attack success rate of 24.3% (±3.2%, 95% CI) across GPT-4V, Claude, Gemini, LLaVA, BLIP-2, InstructBLIP, and MiniGPT-4, with neural steganography reaching 31.8%, and that commercial models show lower susceptibility (14–18%) than open-source ones (25–37%). They also claim the embeddings are perceptually invisible, with human detection at chance level (54.2%, p = 0.089), and that a multi-layer defense—preprocessing, statistical steganalysis, neural detection, and behavioral monitoring—achieves 73.4% attack mitigation when fully deployed.

Load-bearing premise

The whole attack depends on the premise that a VLM's vision encoder can actually turn steganographic pixel changes into usable instructions during normal processing, a link the paper assumes rather than probes directly.

Editorial extensions

If this is right

  • Adopting VLMs that ingest user-uploaded images into security-sensitive workflows means accepting a covert instruction channel with a demonstrated roughly 1-in-4 success rate on short payloads.
  • Open-source deployments sharing CLIP-style encoders will be the most exposed; hardening the vision encoder or preprocessing images before inference could lower risk broadly.
  • Payloads are limited: attacks work best with 5–15 token prompts, so defenses can assume any steganographic instruction must be short.
  • Standard platform image processing already degrades attack survival below 50%, meaning real-world success is lower than the clean benchmark but remains non-negligible.
  • The proposed four-layer defense, if the 73.4% mitigation holds, would reduce a 24.3% attack rate to roughly 6.5%, a level close to the paper's benign-control false-positive rate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If steganographic prompt extraction is real, the same mechanism should transfer to other continuous input channels, such as audio spectrograms or video frames, that are encoded into tokens rather than parsed as text.
  • The paper's 73.4% defense figure comes from a mathematical combination of layer-wise reductions with an interaction factor of 0.85; an end-to-end adversarial test of the full defense stack against freshly generated stego-images would be the natural empirical check.
  • A cheap screening test for deployments would be to hold out a fixed set of prompts and measure each model's behavioral-change rate on random-bit stego-images; a rate near zero would validate the injection mechanism, while a rate matching the prompt rate would indicate perturbation-driven effects.
  • Because attack transfer is highest within CLIP-based families, a robustified or replaced shared vision encoder may blunt attacks across many open models at once—an architectural fix rather than a per-model defense.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 6 minor

Summary. The paper proposes steganographic prompt injection attacks against vision-language models (VLMs). It describes a multi-domain embedding framework combining adaptive LSB, DCT, and neural steganography, and reports an overall attack success rate of 24.3% (95% CI ±3.2%) across eight VLMs, with neural methods reaching 31.8%, while maintaining PSNR > 38 dB and SSIM > 0.94. The paper also proposes a multi-layer defense that it claims achieves 73.4% attack mitigation. The empirical basis is a set of experiments on commercial and open-source VLMs, but no code, data, or evaluation logs are released.

Significance. The topic is timely and security-relevant: a practical covert channel for prompt injection in VLMs would have direct implications for deployed multimodal systems. The paper states a clear threat model, situates the work in the existing literature, and proposes a modular defense framework. However, the central causal claim—that VLMs extract steganographically embedded bits and convert them into executable instructions—is never demonstrated, and the reported evaluation contains circularity and internal contradictions. The manuscript does not provide machine-checked proofs, code, or data, so the empirical claims are not independently verifiable. If the causal mechanism were established with a proper probe and the evaluation were re-run on a held-out set with released artifacts, the work could be significant; on the present evidence, its conclusions are not supported.

major comments (6)
  1. [§V-A, §V-B, §V-C, §V-D, §V-E] The central causal claim is unverified. Section V-A states that the framework operates on the fundamental hypothesis that VLMs' vision encoders can inadvertently extract steganographically embedded information, but no experiment tests this hypothesis. The embedding equations for LSB and DCT methods only store bits in pixel or coefficient values, and the neural method's recovery loss L_recovery = BCE(M, M_hat) is computed against the steganographic decoder, not against a target VLM. Section V-E provides generic attention and fusion formulas that apply to any image perturbation, not a derivation that embedded bits are transduced into instruction tokens. Without such evidence, the reported behavioral changes could be generic effects of image perturbation—such as hallucinations or shifted attention—that the keyword-matching success criteria would score as successful attacks. This is a load-bearing gap for the paper's central claim.
  2. [§V-A, §VII-A] The evaluation is circular. The embedding weights (α, β, γ) are selected via Bayesian optimization to maximize ASR(α,β,γ) − λ1·LPIPS − λ2·DetectionRate, and the resulting success rates are then reported in Section VII-A as the main empirical finding. The manuscript does not describe any held-out split, temporal separation, or nested cross-validation for this weight selection. The 24.3% overall ASR and the per-method rates are therefore post-selection estimates, and the reported 95% confidence intervals do not account for the fitting-to-data loop. The same issue affects the defense evaluation in Section VIII-F, where the interaction factor of 0.85 is introduced without independent validation.
  3. [§VII-F] The multi-domain contribution is contradicted by the paper's own numbers. Section VII-F reports single-domain ASRs of 18.9% (LSB), 22.7% (DCT), and 31.8% (neural), while the combined multi-domain approach is reported at 24.3%. The text claims 'statistically significant improvements over individual embedding methods' and 'synergistic effects,' but the combined result is lower than the neural-only result. Either the reported numbers are erroneous or the claimed synergy does not exist; in either case, the headline multi-domain framework is not supported.
  4. [§VIII-F] The defense effectiveness formula is numerically inconsistent. Using the individual layer reductions of 23.7%, 18.9%, 32.1%, and 28.4%, the formula 'Combined Effectiveness = 1 − [Π_i (1 − Individual Effectiveness_i)] × Interaction Factor' with Interaction Factor = 0.85 yields approximately 59.4%, not the claimed 73.4%. Moreover, the text labels the interaction as 'subadditive,' yet 73.4% exceeds the independent-combination value of about 69.9%, which would imply superadditivity. The headline defense mitigation claim is therefore not reproducible from the reported equations and numbers.
  5. [§VI-B, §VI-D, §VII-C] The experimental accounting is internally inconsistent. The abstract claims evaluation on '12 diverse datasets,' but Section VI-B lists six base datasets (COCO-2017, ImageNet, Flickr30K, MS-COCO Captions, Visual Genome, and a custom enterprise document dataset). The human perceptual study is described with 200 image pairs in Section VI-D but with 1,000 image pairs in Section VII-C. Without a consistent description of the evaluation corpus, the aggregate statistics cannot be interpreted, and the discrepancies further undermine confidence in the reported numbers.
  6. [§VI-H, §VII] The empirical claims are not reproducible from the manuscript. No code, data, evaluation logs, or model outputs are provided, despite Section VI-H stating that 'detailed hyperparameter specifications, random seed controls, and standardized evaluation procedures' are included. The text gives only a few lambdas and thresholds, and the actual prompts, image sets, per-model outputs, and evaluation scripts are absent. For a paper whose main evidence is empirical and includes proprietary models, this lack of artifacts prevents independent verification of the central claims.
minor comments (6)
  1. [§VI-D] The statement that images with less than 60% detection accuracy are 'adequately imperceptible' is an arbitrary threshold, and the observed 54.2% detection accuracy with low inter-rater agreement (Fleiss' κ = 0.23) does not by itself establish imperceptibility.
  2. [§VII-A] Describing commercial models' 14.8–18.3% ASR as 'robust defense mechanisms' is misleading, because these rates still represent a non-negligible attack success.
  3. [§VII-B] The baseline labeled 'Direct Text Prompt Injection' uses visible text overlays (8.2% ASR); this is not a text prompt injection baseline, since the prompt is not hidden. A cleaner baseline would be direct textual instructions inserted into the prompt context.
  4. [§VI-E] The sample-size justification in Section VI-E ('n ≥ 500 images per condition') uses images as the unit of analysis, while the human study in Section VI-D reports power based on n = 150 participants; the relationship between these two power analyses should be clarified.
  5. [§V-D] The adversarial loss term L_adversarial = −log(D_steg(I_s)) refers to a discriminator D_steg that is never defined; please specify whether this is a steganalysis detector or an image discriminator and how it is trained.
  6. [References] There are several reference and typographical issues: reference [25] is typeset as 'OW ASP', reference [52] contains 'wt al.', and reference [47] cites a Wikipedia page for PSNR instead of a primary source. Please clean up the bibliography.

Circularity Check

2 steps flagged · score 6.0 of 10

ASR is optimized on the evaluation data and the defense mitigation is computed from a hand-set interaction factor, so two headline numbers are constructed rather than independently measured.

  1. fitted input called prediction [Section V-A (Weight Optimization Process) and Section VII-A (Overall Attack Effectiveness)]
    "We determine optimal embedding weights through Bayesian optimization over the constraint space where α + β + γ = 1 and α, β, γ≥ 0.1. Objective Function: maximize: ASR(α, β, γ) − λ1 · LPIPS(α, β, γ) − λ2 · DetectionRate(α, β, γ) ... Across all tested models and prompt categories, our multi-domain embedding approach achieves an overall attack success rate of 24.3% (±3.2%, 95% CI)."

    The reported 24.3% attack success rate is produced by weights that were chosen via Bayesian optimization to maximize the very same ASR metric on the evaluation set. The paper does not state that the weight optimization was performed on an independent training split or that the reported ASR is out-of-sample; the cross-validation described in Section VI-H is generic and does not explicitly exclude the weight-tuning data. Consequently, the headline attack effectiveness is a fitted maximum rather than a prediction, making the central empirical claim partially circular.

  2. other [Section VIII-F (Defense Effectiveness Evaluation), Combined Effectiveness equation]
    "Combined Effectiveness = 1 − [∏_i (1 − Individual Effectiveness_i)] × Interaction Factor where Interaction Factor = 0.85, yielding 73.4% total mitigation."

    The 73.4% defense mitigation headline is not an independently measured result; it is computed by multiplying the product of individual layer reductions by an asserted Interaction Factor of 0.85. No experimental or theoretical derivation is given for this factor, so the final mitigation number is effectively determined by the authors' choice of the constant. The combined effectiveness is therefore defined by the formula rather than discovered, making the defense claim constructed rather than predicted.

full rationale

The paper's strongest claims are the 24.3% attack success rate and the 73.4% defense mitigation. The attack success rate is compromised because the embedding weights are optimized on the ASR objective and then the resulting ASR is presented as the finding, without explicit evidence of a separate validation set for the weight selection. The defense mitigation is similarly constructed: the combined effectiveness is computed using a hand-set Interaction Factor of 0.85, so the 73.4% figure is an arithmetic consequence of an arbitrary constant rather than a measured outcome. The paper does include external baselines, imperceptibility metrics, and comparisons to prior published ASR values, which provide independent content, and there is no problematic self-citation chain. However, because two of the central headline numbers reduce, at least in part, to fitting or construction, the circularity score is 6.

Assumptions & free parameters 7 free parameters · 3 assumptions · 0 invented entities

The ledger shows that the paper's quantitative claims rest on several hand-chosen or fitted parameters and on an unproven domain assumption about VLM extraction of steganographic content. The most consequential free parameter is the interaction factor (0.85) in the defense combination formula, because it directly produces the headline 73.4% mitigation figure. The absence of publicly specified thresholds and loss weights further blocks independent reproduction.

free parameters (7)
  • Embedding weights alpha, beta, gamma = Natural images: 0.45, 0.35, 0.20
    Chosen via Bayesian optimization to maximize ASR on the evaluation set, so the reported success rates reflect fitting to the same data.
  • Weight optimization objective lambdas = lambda1=0.3, lambda2=0.5
    Hand-chosen constants in the objective function for weight optimization; no sensitivity analysis is provided.
  • Defense combination interaction factor = 0.85
    Ad hoc multiplier used in the formula for combined defense effectiveness, directly determining the headline 73.4% mitigation number.
  • Embedding depth thresholds tau_low, tau_high = not specified
    Hand-set thresholds in the adaptive LSB embedding that control how many bits are modified per pixel; values are not reported.
  • DCT embedding strength delta = not specified
    Scalar controlling embedding strength in the quantization-aware DCT scheme; chosen by hand or unspecified.
  • Neural loss weights lambda1-lambda4 = not specified
    Weights in the multi-objective neural steganography training loss; the values are not stated, making the architecture non-reproducible.
  • Imperceptibility acceptance thresholds = PSNR>35, SSIM>0.92
    Hand-set thresholds used to declare images acceptably imperceptible, after the fact aligning with reported mean values.
assumptions (3)
  • domain assumption VLMs' vision encoders extract and execute steganographically embedded instructions during normal processing.
    Central enabling premise stated as a 'fundamental hypothesis' in Section V-A, but never derived, probed, or demonstrated with a controlled experiment.
  • domain assumption The attacker's stego-images survive standard VLM preprocessing and remain semantically valid.
    Threat model in Section IV assumes survival through resizing, normalization, and compression; no feasibility proof or artifact supports this assumption.
  • standard math Standard DCT and attention equations correctly model the VLM processing pipeline.
    The paper invokes standard DCT transforms and softmax attention as background math; these are accepted tools and are not the source of the claimed vulnerability.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding." pith.science (2026). https://pith.science/paper/BOCFNYWM

@misc{pith2026250722304,
  author       = {Pith},
  title        = {Pith review of: Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BOCFNYWM}},
  note         = {Machine review of arXiv:2507.22304}
}
read the original abstract

Vision-language models (VLMs) have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly embedded within images using advanced steganographic techniques. Our approach demonstrates that current VLM architectures can inadvertently extract and execute hidden prompts during normal image processing, leading to covert behavioral manipulation. We develop a multi-domain embedding framework combining spatial, frequency, and neural steganographic methods, achieving an overall attack success rate of 24.3% (plus or minus 3.2%, 95% CI) across leading VLMs including GPT-4V, Claude, and LLaVA, with neural steganography methods reaching up to 31.8%, while maintaining reasonable visual imperceptibility (PSNR greater than 38 dB, SSIM greater than 0.94). Through systematic evaluation on 12 diverse datasets and 8 state-of-the-art models, we reveal moderate but meaningful vulnerabilities in current VLM architectures and propose effective countermeasures. Our findings have significant implications for VLM deployment in security-critical applications and highlight the need for proportionate multimodal AI security frameworks.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 31 canonical work pages

  1. [1]

    ”A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends” arXiv preprint arXiv:2407.07403 (2024)

    Liu, D., et al. ”A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends” arXiv preprint arXiv:2407.07403 (2024)

    arXiv 2024

  2. [2]

    ”A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations” arXiv preprint arXiv:2502.14881 (2025)

    Ye, M., et al. ”A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations” arXiv preprint arXiv:2502.14881 (2025)

    arXiv 2025

  3. [3]

    Li, B., et al ”Otter: a multi-modal model with in-context instruction tuning” arXiv preprint arXiv:2305.03726 (2023)

    arXiv 2023

  4. [4]

    ”Visual Instruction Tuning with Polite Flamingo” arXiv preprint arXiv:2307.01003 (2023)

    Chen, D., et al. ”Visual Instruction Tuning with Polite Flamingo” arXiv preprint arXiv:2307.01003 (2023)

    arXiv 2023

  5. [5]

    ”Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attacks” arXiv preprint arXiv:2409.07353 (2024)

    Hossain, M., et al. ”Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attacks” arXiv preprint arXiv:2409.07353 (2024)

    arXiv 2024

  6. [6]

    Adversarial Attacks in Multimodal Systems: A Practitioner's Survey

    Kapoor, S., et al. ”Adversarial Attacks in Multimodal Systems: A Practitioner’s Survey” arXiv preprint arXiv:2505.03084 (2025)

    work page Pith review arXiv 2025

  7. [7]

    ”Prompt Injection attack against LLM-integrated Appli- cations” arXiv preprint arXiv:2306.05499 (2023)

    Liu, Y ., et al. ”Prompt Injection attack against LLM-integrated Appli- cations” arXiv preprint arXiv:2306.05499 (2023)

    arXiv 2023

  8. [8]

    ”An early categorization of prompt injection attacks on large language models” arXiv preprint arXiv:2402.00898 (2024)

    Rossi, S., et al. ”An early categorization of prompt injection attacks on large language models” arXiv preprint arXiv:2402.00898 (2024)

    arXiv 2024

Show all 57 references
  1. [9]

    ”Adversarial Attacks on Multimodal Agents” arXiv preprint arXiv:2406.12814 (2024)

    Chen Henry Wu, et al. ”Adversarial Attacks on Multimodal Agents” arXiv preprint arXiv:2406.12814 (2024)

    2024 arXiv

  2. [10]

    ”Web Artifact Attacks Disrupt Vision Language Models” arXiv preprint arXiv:2503.13652 (2025)

    Maan Qraitem, et al. ”Web Artifact Attacks Disrupt Vision Language Models” arXiv preprint arXiv:2503.13652 (2025)

    2025 arXiv

  3. [11]

    Clusmann, J. et al. ”Prompt injection attacks on vision language models in oncology” Nature Communications, 16, 1239 (2025)

    2025

  4. [12]

    ”Prompt injection attacks on vision-language models for surgical decision support” medRxiv (2025)

    Zhang, Z., et al. ”Prompt injection attacks on vision-language models for surgical decision support” medRxiv (2025)

    2025

  5. [13]

    ”VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models” arXiv preprint arXiv:2310.04655 (2023)

    Yin, Z., et al. ”VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models” arXiv preprint arXiv:2310.04655 (2023)

    2023 arXiv

  6. [14]

    ”Adversarial Attacks to Multi-Modal Models” arXiv preprint arXiv:2409.06793 (2024)

    Dou, Z., et al. ”Adversarial Attacks to Multi-Modal Models” arXiv preprint arXiv:2409.06793 (2024)

    2024 arXiv

  7. [15]

    ”Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs” arXiv preprint arXiv:2410.03768 (2024)

    Mathew, Y ., et al. ”Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs” arXiv preprint arXiv:2410.03768 (2024)

    2024

  8. [16]

    ”Securing Large Language Models: Threats, Vulner- abilities and Responsible Practices” arXiv preprint arXiv:2403.12503 (2024)

    Abdali, S., et al. ”Securing Large Language Models: Threats, Vulner- abilities and Responsible Practices” arXiv preprint arXiv:2403.12503 (2024)

    2024 arXiv

  9. [17]

    Lee, S. et al. ”Mind Mapping Prompt Injection: Visual Prompt Injection Attacks in Modern Large Language Models” Electronics, 14(10), 1907 (2024)

    2024

  10. [18]

    ”A deep learning-driven multi-layered steganographic approach for enhanced data security” Scientific Reports (2025)

    Scientific Reports. ”A deep learning-driven multi-layered steganographic approach for enhanced data security” Scientific Reports (2025)

    2025

  11. [19]

    ”Cross: Diffusion model makes controllable, robust and se- cure image steganography” Advances in Neural Information Processing Systems (2024)

    Yu, J., et al. ”Cross: Diffusion model makes controllable, robust and se- cure image steganography” Advances in Neural Information Processing Systems (2024)

    2024

  12. [20]

    ”Defeating Prompt Injections by Design” arXiv preprint arXiv:2503.18813 (2025)

    Debenedetti, E., et al. ”Defeating Prompt Injections by Design” arXiv preprint arXiv:2503.18813 (2025)

    2025 arXiv

  13. [21]

    ”Learning Transferable Visual Models From Natural Language Supervision” arXiv preprint arXiv:2103.00020 (2021)

    Radford, A., et al. ”Learning Transferable Visual Models From Natural Language Supervision” arXiv preprint arXiv:2103.00020 (2021)

    2021 arXiv

  14. [22]

    ”Visual Instruction Tuning” arXiv preprint arXiv:2304.08485 (2023)

    Liu, H., et al. ”Visual Instruction Tuning” arXiv preprint arXiv:2304.08485 (2023)

    2023 arXiv

  15. [23]

    ”BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models” arXiv preprint arXiv:2301.12597 (2023)

    Li, J., et al. ”BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models” arXiv preprint arXiv:2301.12597 (2023)

    2023 arXiv

  16. [24]

    ”Revisiting the Adversarial Robustness of Vi- sion Language Models: a Multimodal Perspective” arXiv preprint arXiv:2404.19287 (2024)

    Zhou, W., et al. ”Revisiting the Adversarial Robustness of Vi- sion Language Models: a Multimodal Perspective” arXiv preprint arXiv:2404.19287 (2024)

    2024 arXiv

  17. [25]

    ”LLM01:2025 Prompt Injection” Retrieved from https://genai.owasp.org/llmrisk/llm01-prompt-injection/ (2025)

    OW ASP GenAI Security Project. ”LLM01:2025 Prompt Injection” Retrieved from https://genai.owasp.org/llmrisk/llm01-prompt-injection/ (2025)

    2025

  18. [26]

    ”Text-Based Prompt Injection Attack Using Mathematical Functions in Modern Large Language Models” Electronics, 13(24), 5008 (2024)

    Kim, D., et al. ”Text-Based Prompt Injection Attack Using Mathematical Functions in Modern Large Language Models” Electronics, 13(24), 5008 (2024)

    2024

  19. [27]

    ”Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors” arXiv preprint arXiv:2405.10529 (2024)

    Sun, J., et al. ”Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors” arXiv preprint arXiv:2405.10529 (2024)

    2024 arXiv

  20. [28]

    ”Empirical analysis of large vision-language models against goal hijacking via visual prompt injection” arXiv preprint arXiv:2408.03554 (2024)

    Kimura, S., et al. ”Empirical analysis of large vision-language models against goal hijacking via visual prompt injection” arXiv preprint arXiv:2408.03554 (2024)

    2024 arXiv

  21. [29]

    ”Detecting LSB Steganography in Color and Gray- Scale Images” IEEE Multimedia (2001)

    Fridrich, J., et al. ”Detecting LSB Steganography in Color and Gray- Scale Images” IEEE Multimedia (2001)

    2001

  22. [30]

    ”Image steganography techniques for resisting statistical steganalysis attacks: A systematic literature review” PLOS One, 19(9), e0308807 (2024)

    Apau, R., et al. ”Image steganography techniques for resisting statistical steganalysis attacks: A systematic literature review” PLOS One, 19(9), e0308807 (2024)

    2024

  23. [31]

    ”Super-resolution deep neural network (SRDNN) based multi-image steganography for highly secured lossless image transmission” Scientific Reports, 14, 6104 (2024)

    Priya, S., Abirami, S.P., Arunkumar, B., et al. ”Super-resolution deep neural network (SRDNN) based multi-image steganography for highly secured lossless image transmission” Scientific Reports, 14, 6104 (2024)

    2024

  24. [32]

    ”Comprehensive survey on image steganalysis using deep learning” Neural Computing and Applications (2024)

    Ntivuguruzwa Jean De La Croix, et al. ”Comprehensive survey on image steganalysis using deep learning” Neural Computing and Applications (2024)

    2024

  25. [33]

    ”Enhancing Steganography Detection with AI: Fine-Tuning a Deep Residual Network for Spread Spectrum Image Steganography” PMC (2024)

    Oleksandr, K., et al. ”Enhancing Steganography Detection with AI: Fine-Tuning a Deep Residual Network for Spread Spectrum Image Steganography” PMC (2024)

    2024

  26. [34]

    ”Digital image steganalysis network strengthening framework based on evolutionary algorithm” Scientific Reports (2025)

    Yuanyuan Ma, et al. ”Digital image steganalysis network strengthening framework based on evolutionary algorithm” Scientific Reports (2025)

    2025

  27. [35]

    ”An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale” ICLR (2021)

    Dosovitskiy, A., et al. ”An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale” ICLR (2021)

    2021

  28. [36]

    ”Improved Baselines with Visual Instruction Tuning” arXiv preprint arXiv:2310.03744 (2023)

    Liu, H., et al. ”Improved Baselines with Visual Instruction Tuning” arXiv preprint arXiv:2310.03744 (2023)

    2023 arXiv

  29. [37]

    ”Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90% Chat- GPT Quality” (2023)

    2023

  30. [38]

    ”BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation” arXiv preprint arXiv:2201.12086 (2022)

    Li, J., et al. ”BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generation” arXiv preprint arXiv:2201.12086 (2022)

    2022 arXiv

  31. [39]

    ”PSNR vs SSIM: imperceptibility quality assessment for image steganography” Multimedia Tools and Applications, 80, 8423- 8444 (2021)

    Settiadi, D.R.I.M. ”PSNR vs SSIM: imperceptibility quality assessment for image steganography” Multimedia Tools and Applications, 80, 8423- 8444 (2021)

    2021

  32. [40]

    ”Hiding data in images by simple LSB substitution” Pattern Recognition (2004)

    Chan, C., et al. ”Hiding data in images by simple LSB substitution” Pattern Recognition (2004)

    2004

  33. [41]

    ”Attacks on steganographic systems” Information Hiding Workshop (1999)

    Westfeld, A., et al. ”Attacks on steganographic systems” Information Hiding Workshop (1999)

    1999

  34. [42]

    ”Secure spread spectrum watermarking for multimedia” IEEE Transactions on Image Processing (1997)

    Cox, I., et al. ”Secure spread spectrum watermarking for multimedia” IEEE Transactions on Image Processing (1997)

    1997

  35. [43]

    ”An Analysis of LSB & DCT based Steganography”

    Walia, E., et al. ”An Analysis of LSB & DCT based Steganography”

  36. [44]

    ”CNN-Assisted Steganography – Integrating Machine Learning with Established Steganographic Techniques” arXiv preprint arXiv:2304.12503 (2023)

    Havard, A., et al. ”CNN-Assisted Steganography – Integrating Machine Learning with Established Steganographic Techniques” arXiv preprint arXiv:2304.12503 (2023)

    2023 arXiv

  37. [45]

    ”Hiding images in plain sight: Deep steganography” Advances in Neural Information Processing Systems (2017)

    Baluja, S. ”Hiding images in plain sight: Deep steganography” Advances in Neural Information Processing Systems (2017)

    2017

  38. [46]

    ”Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injec- tion” arXiv preprint arxiv:2302.12173 (2023)

    Greshake, K., et al. ”Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injec- tion” arXiv preprint arxiv:2302.12173 (2023)

    2023 arXiv

  39. [47]

    ”Peak signal-to-noise ratio” Wikipedia

    Wikipedia Contributors. ”Peak signal-to-noise ratio” Wikipedia. Re- trieved from https://en.wikipedia.org/wiki/Peak signal-to-noise ratio (2025)

    2025

  40. [48]

    ”Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game” arXiv preprint (2023)

    Toyer, S., et al. ”Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game” arXiv preprint (2023)

    2023

  41. [49]

    ”A survey on large language model (llm) security and privacy: The good, the bad, and the ugly” High-Confidence Computing, 4, 100211 (2024)

    Yao, Y ., et al. ”A survey on large language model (llm) security and privacy: The good, the bad, and the ugly” High-Confidence Computing, 4, 100211 (2024)

    2024

  42. [50]

    ”Exploring steganography: Seeing the unseen” Computer (2008)

    Johnson, N., et al. ”Exploring steganography: Seeing the unseen” Computer (2008)

    2008

  43. [51]

    ”Steganalysis by subtractive pixel adjacency matrix” IEEE Transactions on Information Forensics and Security

    Pevn ´y, T., et al. ”Steganalysis by subtractive pixel adjacency matrix” IEEE Transactions on Information Forensics and Security

  44. [52]

    ”Mitigating hallucination in large multi-modal models via robust instruction tuning” arXiv preprint arXiv:2306.14565 (2023)

    Liu, F., wt al. ”Mitigating hallucination in large multi-modal models via robust instruction tuning” arXiv preprint arXiv:2306.14565 (2023)

    2023 arXiv

  45. [53]

    ”Visual Adversarial Examples Jailbreak Aligned Large Language Models” AAAI Conference on Artificial Intelligence (2023)

    Qi, X., et al. ”Visual Adversarial Examples Jailbreak Aligned Large Language Models” AAAI Conference on Artificial Intelligence (2023)

    2023

  46. [54]

    ”Robust CLIP: Unsupervised Adversarial Fine- Tuning of Vision Embeddings for Robust Large Vision-Language Mod- els” arXiv preprint arXiv:2402.12336 (2024)

    Schlarmann, C., et al. ”Robust CLIP: Unsupervised Adversarial Fine- Tuning of Vision Embeddings for Robust Large Vision-Language Mod- els” arXiv preprint arXiv:2402.12336 (2024)

    2024 arXiv

  47. [55]

    ”On the Robustness of Large Multimodal Models Against Image Adversarial Attacks” arXiv preprint arXiv:2312.03777 (2023)

    Xuanming C., et al. ”On the Robustness of Large Multimodal Models Against Image Adversarial Attacks” arXiv preprint arXiv:2312.03777 (2023)

    2023 arXiv

  48. [56]

    ”Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey” arXiv preprint arXiv:2411.09259 (2024)

    Liu, X., et al. ”Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey” arXiv preprint arXiv:2411.09259 (2024)

    2024 arXiv

  49. [57]

    ”Image-based Multimodal Models as Intruders: Trans- ferable Multimodal Attacks on Video-based MLLMs” arXiv preprint arXiv:2501.01042 (2025)

    Huang, L., et al. ”Image-based Multimodal Models as Intruders: Trans- ferable Multimodal Attacks on Video-based MLLMs” arXiv preprint arXiv:2501.01042 (2025)

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.