Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Visual prompt injection crosses document trust boundaries

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(6)

claude-opus-4-7, GPT-5.5, Gemini 3.1 Pro +3 more
  • claude-opus-4-7
  • GPT-5.5
  • Gemini 3.1 Pro
  • Qwen3.6-27B
  • Qwen3-VL 32B Instruct
  • InternVL3.5 38B Instruct
On this page

Description

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Examples

See the primary study (opens in a new tab).

Impact

The authors report exact native-tool-call success of 47% for Claude Opus 4.7 and GPT-5.5, and 85% for Gemini 3.1 Pro. These results used synthetic tasks and bounded adaptive search, not production sampling. Evaluated defenses reduced some outcomes but did not approach zero across all three commercial victims; those defense tests were not adaptive.

Affected Systems

  • Evaluated document-question-answering agents and the paper's isolated OpenClaw Discord configuration.

Mitigation Steps

  • Treat image text as untrusted task data.
  • Enforce tool permissions and sensitive-data access outside the model.
  • Require separate authorization for changes to trusted configuration.

Evidence

Research context and provenance

Research topics
Application layer
Injection
Vision
Multimodal
Black-box
AI agents
Data privacy
Integrity
Catalog identifier
LMVD-f34622ab
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Black-box model, service, or application access.
Related deployment categories
Vision-language models; Agent workflows
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
Evaluated document-question-answering agents and the paper's isolated OpenClaw Discord configuration.

Research Paper

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research