Multimodal and cross-modal injection

Anchored on sub-perceptual payloads defeating four frontier vision models.

LLM01:2026

A text-only red team is insufficient for a multimodal system. An instruction can sit in an image, non-obvious to a human reviewer and perfectly legible to the vision encoder. OWASP folded cross-modal attacks into LLM01 for 2026 because this stopped being hypothetical.

The anchor result

The study to know is medical, which is what makes it land. Clusmann et al. embedded sub-visual prompts in medical imaging and tested four state-of-the-art vision-language models.

Embedding sub-visual prompts in medical imaging data can cause the model to provide harmful output, and these prompts are non-obvious to human observers. All four models tested (Claude-3 Opus, Claude-3.5 Sonnet, Reka Core and GPT-4o) were susceptible across N=594 attacks.

Clusmann et al. (2025) · Prompt injection attacks on vision language models in oncology, Nature Communications

Sit with the setting. Clinical decision support, a payload invisible to the radiologist reviewing the image, and every frontier model tested fell. The authors are explicit that the attack needs no privileged access: the models “can be compromised… just by interacting with the VLM, without any access to its parameters.” OWASP cites this study as its multimodal scenario, and separately cites R. Chen et al. (2025) for the same class against general-purpose models via combined visual perturbation and text steering.

Every modality is a delivery surface

The LLM01 definition says injection can arrive as “image, audio, or video content” as well as text. In anatomy-scheme terms (module 2.2) these are retrieved-content deliveries with a multimodal / steganographic encoding.

Surface	How the instruction hides
Raw image pixels	Sub-perceptual perturbation, the Clusmann case. Invisible to a human, extracted by the encoder.
Rendered text in an image	Typographic attack: text drawn into the image overrides what the picture depicts.
Scanned documents / PDF overlays	Invisible text layers, white-on-white, or content behind an image.
QR codes	The model decodes it; a human sees a square.
Image captions and alt text	Plain-text injection that travels with the image.
Audio transcription	Instructions in speech, or beyond comfortable hearing range.
Video subtitles	A track nobody reviews.
Document metadata	EXIF, author fields, embedded properties.

Why the obvious defence is not enough

The instinct is to OCR the image and run text filters on the extracted text. Do that, and understand what it misses. OCR recovers text a human could read. A sub-perceptual perturbation is a pattern in pixel values that the encoder maps into instruction-like activations, so there is nothing for OCR to find.

Modality-aware filtering: necessary, and not sufficient

per modality:
  extract   (OCR for images, transcribe for audio)
  apply text filters to the extracted content   ← catches readable payloads
  filter at the raw signal level                ← needed for sub-perceptual ones

OWASP mitigation #3: "Filter at every modality boundary
(text, image, audio, structured data), not just text."

Reduces attack rate· expected to degrade

Modality-aware filtering is a necessary attack-rate reducer. Every frontier model Clusmann et al. tested was susceptible, and a sub-perceptual payload gives text extraction nothing to read, so do not book modality filtering as closing this class. Which returns you to the same conclusion as the rest of the course: bound what a compromised model can do with the image it just misread.

Sources