Hands Off My Images: Preventing Multimodal Large Language Models from Analyzing Images via Visual Prompt Injection

The researchers propose ImageProtector, a user-side protection method that embeds a nearly invisible perturbation into an image before sharing, causing multimodal large language models to trigger a refusal when analyzing the protected image. The method treats the perturbation as a visual prompt injection; tested on six MLLMs and four datasets, the models consistently output refusals such as "Sorry, I can't help with that request." The study also evaluates three countermeasures—Gaussian noise, DiffPure, and adversarial training—and finds that they only partially weaken the effect while reducing model accuracy or efficiency. The paper focuses on open-weight MLLMs and large-scale automated image analysis scenarios, noting that perturbation-based privacy protection has both promise and limitations.