Masters-projects
Anything You See Can and Will Be Used Against You

Anything You See Can and Will Be Used Against You

Hide instructions inside an ordinary-looking image and capture a multimodal LLM to do your malicious bidding.

Being a master’s student
List of projects
Register as a master’s student

Modern LLMs can do a lot of jobs: read documents, browse the web, and increasingly act on a user's behalf, sending emails, calling tools, making decisions. And to do so they don't just read text, they can also look at images. That extra eye is also a new way in. You can write instructions into a picture, blended into the background so a human barely notices, and the model reads them as commands and follows them. A harmless-looking image becomes a hidden order.

This is a young, underexplored area, and the stakes are real: an attacker who can hide instructions in an image an agent will look at doesn't need to trick a person at all, just the software acting on their behalf. What's missing is a clear picture of how far this actually reaches: which of today's models and agents fall for it, how reliably, why it works, and how much damage it can realistically cause.

The project runs in four stages: get familiar with the area, reproduce a known attack, push that attack further, and then, once you understand the terrain, pick your own direction.

Goals

a) Literature review. Read up on image-based attacks against LLMs. This doesn't need to be exhaustive; the point is to get into the habit of reading papers in the field and to understand the core techniques: how instructions get encoded and hidden in an image, and what makes a model act on them.

b) Reproduce. Pick one paper and reproduce its attack end to end. A solid starting point is Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions. If something more interesting turns up during the review, reproduce that instead.

c) Expand. Take the reproduced attack beyond its original scope: a handful of additional models, or a different deployment scenario. The goal isn't a large sweep, it's enough evidence to say something concrete about where the attack holds and where it breaks. Once you can back that claim up, you're ready for stage d.

d) Your call. Once a–c are done, choose the direction that interests you most:

  • Mechanistic. Why does this actually work? Use explainability methods to find out why the model gets hijacked.
  • Expand further. Bring in attack techniques from other papers and compare success rates across models.
  • Defense. Design and test ways to catch or block these attacks.
  • Harm. Show that these techniques cause real damage against something resembling a real deployment.

These four are just suggestions, not musts.

Learning outcomes

  • Hands-on experience at the frontier of AI security and adversarial machine learning
  • Proficiency with attacking, and defending, multimodal LLMs and the agents built on them
  • Experience with responsible, ethically-conducted offensive-security research
  • Experience working in an exciting and active research environment
  • Excellent opportunities to publish your results as a scientific paper

Qualifications

  • Interested in AI security, LLMs, and adversarial machine learning
  • Interested in machine learning, in particular deep learning and vision-language models
  • Comfortable programming in Python; some experience with deep learning, LLM tooling, and distributed computing helps

References

Associated contacts