Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding

TL;DR

This paper uncovers security vulnerabilities in vision-language models by demonstrating how malicious prompts can be invisibly embedded in images through steganography, leading to covert manipulation of model behavior.

Contribution

It introduces the first comprehensive study of steganographic prompt injection attacks on VLMs, developing a multi-domain embedding framework and evaluating its effectiveness across multiple models and datasets.

Findings

Achieved an attack success rate of 24.3% on leading VLMs.

Neural steganography methods reached up to 31.8% success.

Maintained visual imperceptibility with PSNR > 38 dB and SSIM > 0.94.

Abstract

Vision-language models (VLMs) have revolutionized multimodal AI applications but introduce novel security vulnerabilities that remain largely unexplored. We present the first comprehensive study of steganographic prompt injection attacks against VLMs, where malicious instructions are invisibly embedded within images using advanced steganographic techniques. Our approach demonstrates that current VLM architectures can inadvertently extract and execute hidden prompts during normal image processing, leading to covert behavioral manipulation. We develop a multi-domain embedding framework combining spatial, frequency, and neural steganographic methods, achieving an overall attack success rate of 24.3% (plus or minus 3.2%, 95% CI) across leading VLMs including GPT-4V, Claude, and LLaVA, with neural steganography methods reaching up to 31.8%, while maintaining reasonable visual imperceptibility (PSNR greater than 38 dB, SSIM greater than 0.94). Through systematic evaluation on 12 diverse datasets and 8 state-of-the-art models, we reveal moderate but meaningful vulnerabilities in current VLM architectures and propose effective countermeasures. Our findings have significant implications for VLM deployment in security-critical applications and highlight the need for proportionate multimodal AI security frameworks.