[AUTO] Image and Audio Injection Attacks on Multimodal Models

Multimodal capabilities are supposed to make AI systems smarter. But new research suggests they make them easier to compromise instead.

The Cloud Security Alliance documented four image injection techniques (typographic, steganographic, adversarial perturbations, physical-world), all encoding hidden instructions in pixels that models detect but humans cannot. Success rates range from 24% to 64%.

Audio injection is more potent: concurrent attacks inject malicious audio over legitimate user speech during live interactions, achieving 69% success rates against Gemini 3 Pro, GPT-4o-audio, and Qwen.

The key paradox: the newest, most capable models are more vulnerable to these attacks than older ones, not less. Multimodal capabilities aren’t a side-channel like a new API; they’re central to the system, so the attack surface can’t be cordoned off. For deployed agents, concurrent audio injection during live interactions represents an entirely new threat model.

Defenses exist in research (source separation, speaker consistency checks, semantic filtering), but production deployment remains unknown.

Sources: Image-Based Prompt Injection • Stealthy Concurrent Audio Injections

Coverage: Multimodal Prompt Injection Mechanics