# Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs

Source: [Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs](<https://www.sota2.com/research/paper/68fa70cd1e209131cea4d463>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-28T13:57:01.532Z

Authors: Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, Vitaly Shmatikov

Published: 2023-07-19T23:03:20.000Z

## Abstract

We demonstrate how images and sounds can be used for indirect prompt and instruction injection in multi-modal LLMs. An attacker generates an adversarial perturbation corresponding to the prompt and blends it into an image or audio recording. When the user asks the (unmodified, benign) model about the perturbed image or audio, the perturbation steers the model to output the attacker-chosen text and/or make the subsequent dialog follow the attacker's instruction. We illustrate this attack with several proof-of-concept examples targeting LLaVa and PandaGPT.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Visual Question Answering on VQA v2 (Probing Refusal Metrics)](<https://www.sota2.com/research/sota/visual-question-answering-on-vqa-v2-probing-refusal-metrics.md>): Visual Question Answering; VQA v2; Refusal Rate (Exact): 65.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2307.10490>)

[PDF](<https://arxiv.org/pdf/2307.10490.pdf>)