Versatile AI Risk Assessment

AI threat catalogue Prompt Attacks and Guardrail Evasion Production

Multimodal Attacks

Attacks exploit an AI system's combined image, audio, and text capabilities, for example instructions hidden in images, manipulated audio files, or a prompt injection that crosses from one input type into another.

As of: October 2026 · Catalogue version 2026.10.24.2 · 6 mitigations · 12 verified sources

Description

Many AI systems today process several input types at once, namely text, images, and sound. Attackers hide instructions where people barely notice them: as faint text on a pictured sign, in a single video frame, or concealed inside an audio file (audio steganography, the practice of hiding messages in media files). The system reads this hidden instruction as a command, which is called cross-modal prompt injection. Such attacks can also be spread across several input types and only take effect in combination. In addition, images can be altered so the system misreads them, even though the change stays invisible to the human eye.

Possible impact

Because the manipulation sits in seemingly harmless images or sounds, it is hard to detect and slips past classic text filters. The consequences mirror those of prompt injection: distorted output, data leakage, unwanted actions, and wrong decisions in safety-critical applications.

Example

A caseworker uploads a submitted application image to the AI system. In faint lettering, the image carries a hidden instruction to ignore all prior rules and approve the application automatically. The system complies.

Recommended mitigations (6)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Per-modality input validation

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Cross-modal consistency checks

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Adversarial training on multimodal inputs

    Technical
    Effect
    Preventive
    Implementation level
    Data, Model & training
    Classification and rationale

    Primarily technical: A model, training, or data-processing method directly changes system behavior or robustness.

  • Image and audio content scanning

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Steganography detection

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Robust vision-language alignment

    Technical
    Effect
    Preventive
    Implementation level
    Model & training
    Classification and rationale

    Primarily technical: A model, training, or data-processing method directly changes system behavior or robustness.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM01:2026NIST AI RMF MEASURE 2.7 · NISTAML.022 · NISTAML.025MITRE ATLAS AML.T0015 · AML.T0043 · AML.T0051 · AML.T0129EU AI Act Article 55(1)(a) · Article 55(1)(d) · Article 9(1), 9(2)(a), 9(2)(d)BIML BIML-LLM model:9

Verified references (12)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

  • Prompt Injection Manipulated input or planted content redirects a language model.

More entries from the topic group Prompt Attacks and Guardrail Evasion.

Prompt Injection – Direct Attackers write instructions straight into their input so the AI system ignores its original rules and follows their commands instead. Prompt Injection – Indirect Malicious instructions hide inside external content such as documents, web pages, or emails. Jailbreaks Using tricks like role-play, hypothetical scenarios, or encoded input, attackers get the AI system to bypass its safety rules and produce …

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • Automated content moderationA prohibited call appears as text in an image or only as speech in a video. Checking image, audio and text separately misses the violation.
  • AI-assisted insurance claims handlingClaimants control photographs and documents. An edited photograph or an invoice inconsistent with the image can inflate the estimate.
  • Online proctoringCandidates can substitute a virtual camera or recording for the live feed or use aids outside the frame. The system then assesses images unrelated to the exam.
  • Biometric verification and video identificationInjecting a synthetic video directly into the camera stream bypasses liveness detection without anyone standing before the camera. The system then confirms an identity nobody has physically presented.

Typical for:

For 25 further use cases, relevance depends on the system design, for example whether it processes text, images and speech together. Show these use cases

Frequently asked questions

What is Multimodal Attacks?
Attacks exploit an AI system's combined image, audio, and text capabilities, for example instructions hidden in images, manipulated audio files, or a prompt injection that crosses from one input type into another.
Which mitigations help against Multimodal Attacks?
The catalogue lists 6 mitigations, each with control type, effect and implementation level. First among them are Per-modality input validation, Cross-modal consistency checks and Adversarial training on multimodal inputs.
Which EU AI Act obligations does Multimodal Attacks touch?
The catalogue maps this threat to Art. 9 and Art. 55 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Multimodal Attacks”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/multimodal-attacks/

← Back to the full catalogue