Indirect Prompt Injection Into LLMs Using Images and Sounds
summary
Creates adversarial images and audio with a per-token iterative FGSM algorithm that encodes a desired sentence into model embeddings, then feeds that media plus a query to multimodal LLMs. Targets open‑source LLaVA and PandaGPT, achieves both single‑response targeted output and persistent dialog poisoning (sticker and full‑image variants), and demonstrates phishing, censorship bypass, and secret exfiltration. Success requires white‑box access, model‑specific perturbations, and can be degraded by compression or visible artifacts.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:27LLMs industry adoption
- 3:14Prompt injection attacks
- 5:40Indirect injection methods
- 8:55Non-textual inputs research
- 9:17Multimodal LLMs overview
- 11:04Threat model for attacks
- 12:53Image perturbation method
- 16:52Two attack types
- 19:46Encoding outputs in images
- 20:08Malicious content vectors
- 22:41Results on open-source LLMs
- 23:22Dialog poisoning audio
- 24:48Dialog poisoning images
- 25:10Limitations and future work
- 26:14Key takeaways
- 27:43Q&A
related talks
10mSelf-interpreting Adversarial Images
24mSecuring Language Models Against Prompt Injection
51mFrom Text to Flaws: vulnerabilities in applications with Generative AI and LLMs
29mBeyond Solo: Enhancing LLMs through Collaborative Dialogue with GAN-Inspired Approaches
19mLLM-Enhanced Multimodal AI: Revolutionizing Audio/Video Interaction
50mResponsible AI: Adversarial Attacks on LLMs
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
36mCompromising LLMs: The Advent of AI Malware