Image Scaling Attacks: A New Frontier in Multimodal Prompt Injection

You've probably heard about prompt injection attacks in large language models, where cleverly crafted inputs can manipulate a model's behavior. But what happens when you combine text prompts with images? Researchers have discovered a fascinating new attack vector that exploits something we all take for granted: image scaling.

When you upload an image to an AI system, it's almost always resized before processing. This routine operation turns out to be a potential security vulnerability that attackers can exploit to hide malicious prompts within images themselves.

What It Does

Anamorpher is a proof-of-concept tool that demonstrates how to embed hidden text prompts into images using scaling transformations. The core insight is simple but powerful: when an image gets resized, the scaling algorithm has to decide which pixels to keep, modify, or discard. By carefully manipulating high-frequency patterns in an image, attackers can encode text that only becomes readable after the image is scaled down.

The tool works by analyzing how different scaling algorithms (like Lanczos, bilinear, or nearest-neighbor) process images, then reverse-engineering the patterns needed to make specific text appear clearly in the resized version. It's essentially steganography, but specifically optimized to exploit AI image preprocessing pipelines.

Why It's Cool

What makes this attack particularly clever is that it bypasses many traditional detection methods. The malicious prompt isn't visible in the original high-resolution image—it only emerges after scaling, which happens automatically in most AI systems that process images. This means content moderation systems scanning the original image won't detect anything suspicious.

The implementation is also technically sophisticated. The researchers had to deeply understand how different scaling algorithms work and develop mathematical transformations that reliably produce the desired text in the output. It's a great example of thinking like an attacker—finding vulnerability in a process that everyone assumes is safe and routine.

For developers building AI applications, this serves as an important reminder that even "safe" operations like image resizing need security consideration when they're part of a larger AI pipeline.

How to Try It

If you want to experiment with this yourself, the Anamorpher repository has everything you need:

git clone https://github.com/trailofbits/anamorpher
cd anamorpher
# Follow the setup instructions in the README

The project includes Python scripts for generating attack images and testing them against different scaling algorithms. You can start with their example images to see how text magically appears when you scale them down, then try creating your own encoded images.

Final Thoughts

While this is currently a research project, it highlights a real security consideration for anyone building multimodal AI systems. As we integrate more AI capabilities into our applications, we need to think about the entire data processing pipeline—not just the final model inference.

For now, this might be more of a curiosity than an immediate threat, but it's exactly the kind of forward-thinking security research that helps the community prepare for future vulnerabilities. It's worth checking out both to understand the attack vector and to appreciate the clever engineering behind it.

@githubprojects