AI threat cataloguePrompt Attacks and Guardrail EvasionProduction
Multimodal Attacks
Attacks exploit an AI system's combined image, audio, and text capabilities, for example instructions hidden in images, manipulated audio files, or a prompt injection that crosses from one input type into another.
Description
Many AI systems today process several input types at once, namely text, images, and sound. Attackers hide instructions where people barely notice them: as faint text on a pictured sign, in a single video frame, or concealed inside an audio file (audio steganography, the practice of hiding messages in media files). The system reads this hidden instruction as a command, which is called cross-modal prompt injection. Such attacks can also be spread across several input types and only take effect in combination. In addition, images can be altered so the system misreads them, even though the change stays invisible to the human eye.
Possible impact
Because the manipulation sits in seemingly harmless images or sounds, it is hard to detect and slips past classic text filters. The consequences mirror those of prompt injection: distorted output, data leakage, unwanted actions, and wrong decisions in safety-critical applications.
Example
A caseworker uploads a submitted application image to the AI system. In faint lettering, the image carries a hidden instruction to ignore all prior rules and approve the application automatically. The system complies.
Recommended mitigations (6)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Per-modality input validationTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Per-modality input validation” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Cross-modal consistency checksTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Cross-modal consistency checks” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Adversarial training on multimodal inputsTechnical
- Effect
- Preventive
- Implementation level
- Data, Model & training
- Reason for the classification
- “Adversarial training on multimodal inputs” is primarily technical: A model, training, or data-processing method directly changes system behavior or robustness.
Image and audio content scanningTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Image and audio content scanning” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Steganography detectionTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Steganography detection” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Robust vision-language alignmentTechnical
- Effect
- Preventive
- Implementation level
- Model & training
- Reason for the classification
- “Robust vision-language alignment” is primarily technical: A model, training, or data-processing method directly changes system behavior or robustness.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (11)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM01:2025 Prompt InjectionLLM01:2025 Prompt Injection, official category page OWASP FoundationOriginal
- NIST AI RMF MEASURE 2.7 MEASURE 2.7MEASURE 2.7, p. 30 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.022 EvasionTaxonomy Index, p. x; Section 2.2, pp. 11–18 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.025 Black-box EvasionTaxonomy Index, p. x; Section 2.2.2, p. 15 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0015 Evade AI ModelATLAS.yaml technique object with id AML.T0015 (pinned release v5.6.0) MITREOriginal
- MITRE ATLAS AML.T0043 Craft Adversarial DataATLAS.yaml technique object with id AML.T0043 (pinned release v5.6.0) MITREOriginal
- MITRE ATLAS AML.T0051 LLM Prompt InjectionATLAS.yaml technique object with id AML.T0051 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 55(1)(a) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(a) European Union (EUR-Lex)Original
- EU AI Act Article 55(1)(d) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(d) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BIML BIML-LLM model:9 ModalityPDF p. 18, [model:9:modality] Berryville Institute of Machine Learning (BIML)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- Prompt Injection Manipulated input or planted content redirects a language model.
Related threats
More entries from the topic group Prompt Attacks and Guardrail Evasion.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Multimodal Attacks”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/multimodal-attacks/