Image Hijacks: Adversarial Images Control Generative Models at Runtime
Date: 2023-09
Affected: LLaVA, MiniGPT-4, BLIP-2, multimodal LLMs
Attack vector: adversarial-input
Category: research
Severity: High

Bailey et al. (Berkeley) craft Image Hijacks via Behaviour Matching that force VLMs to emit attacker-chosen output, leak context, bypass safety, or believe false statements. >80 percent success across four attack types. ICML 2024.


Mitigations:

Architectural layers (MAESTRO):