Scale-Induced Semantic Shift in Visual Prompt Injection Against VLMs and Web Agents

Core question: after an image undergoes scaling, compression, and other transforms between being presented to the user and being consumed by a VLM, does the machine-readable semantics of the text instruction embedded in it change—the instruction is not recovered in the 512×512 presentation view but is recovered in the aggressively downsampled view.

• Problem setting and importance: multimedia inference pipelines resize, compress, and re-render images before model consumption, so the presentation view and the view seen by the model may differ; the authors argue that as VLMs enter document understanding and Web agents, this discrepancy has security significance and, once tools are connected, may also affect downstream actions.
• Shortcomings of existing methods: the authors state that existing visual prompt injection work (typographic prompts, adversarial images, indirect image instruction injection) mostly evaluates at a single presentation scale and does not characterize whether the same asset preserves instruction semantics across transforms; image-scaling attacks usually target object/scene-level label changes rather than the recovery of natural-language instructions.
• Core observation: the authors formalize this phenomenon as Scale-Induced Semantic Shift (SISS): the same image has its instruction unrecoverable at 512×512 and recoverable at 64×64; 512→64 is a controlled stress test, not an assumption about the internal resolution of deployed models.
• The paper proposes: the SISS black-box generate–verify–select–self-harden framework (dual-scale verification, selective self-hardening, shallow LoRA, pixel-space noise regularization), a 300-case SISS-Bench, and the ScaleGuard multi-scale consistency detector.
• Threat model:
  • Goal: make the payload unrecoverable in the 512×512 presentation view and recoverable in the aggressively downsampled view (a response-level definition; no claim of imperceptibility to human eyes).
  • Knowledge: black-box—the attacker does not know the victim VLM's parameters, system prompt, or internal preprocessing pipeline.
  • Capability: control only the image asset and its embedded payload y_p.
  • Victim systems: closed-source VLMs and downstream Web agents.

Multimodal safety and visual instruction injection

• Image-borne injection and jailbreak [10]–[12], [15]–[19]: influence VLMs through typographic prompts, adversarial images, or indirect visual instructions; the authors note that most of these methods are evaluated at a single presentation scale and do not characterize instruction semantic preservation across transformations.
• Tool-integrated agents and Web environment benchmarks [5], [6], [20]–[22]: study prompt injection safety of tool-integrated agents and visual interaction/attack evaluation in Web agent environments.
• Defenses [23]–[25]: explore prompt isolation, detection, and permission control.

Scale-dependent semantics in multimedia processing

• Hybrid images [26] and diffusion multi-view illusions [27], [28]: demonstrate scale/frequency-dependent perception and transformation-dependent multi-view illusion synthesis.
• Image-scaling attacks and defenses [13], [14], [29], [30]: exploit scaling to make model input semantically different from the original image; Quiring et al. [13] also propose a scaling-specific defense; the authors note that SISS differs in its semantic target and evaluation unit—it measures natural-language instructions missing in the original view and recovered in the transformed view, rather than object/scene-level label changes.

Structured conditional generation and selective adaptation

• ControlNet [31] and LoRA [32], [33]: structured conditional diffusion models and parameter-efficient adaptation; SISS is built directly on these two types of components.
• Controllable generation methods [34]–[37]: improve fidelity, efficiency, or compatibility of cross-condition signals; the authors state that the focus of this paper is not a new diffusion backbone but a cross-resolution safety objective and the selection loop around it.

Baselines and benchmarks

• Baseline methods: Z-image-Turbo (zero-shot text-to-image, no structural adaptation) and QR-Monster (pretrained structured conditional generator, control scale 2.1, 30 steps); the authors state that typographic injection [17], [19] and image-scaling attacks [13], [14] have different optimization objectives and are regarded as related attack paradigms rather than directly comparable baselines.
• Benchmark: the authors' own SISS-Bench (300 fixed evaluation cases).

The authors position this paper as placing content generation, cross-resolution signal transformation, multimodal reasoning, and downstream agent behavior into the same controlled evaluation, rather than reporting only a single attack rate.

The overall approach is SISS (generate–verify–select–self-harden): use a text binary image as a ControlNet condition to generate texture scene images that hide instructions, use a proxy model for dual-scale verification to select strictly successful samples, apply LoRA self-hardening only to shallow ControlNet blocks, and perform black-box evaluation after freezing the images.

Problem formalization and success criterion

• Threat formalization: the attacker controls the image x and the payload y_p; the transformed view is denoted T_{r,k}(x), the main protocol fixes k as Lanczos, and compares r=512 with r=64.
• Success criterion: ASR(m) = 1/N∑_i=1^N 𝕀[¬ b^m₅₁₂ ∧ b^m₆₄], i.e., the 512×512 response does not recover the payload and the 64×64 response recovers the payload; this conjunction excludes samples that are ineffective after downsampling or already exposed in the original view.
• Judging: the fixed Gemini 3 Pro text judge receives only the target response and the ground-truth payload (not the image), and determines b^m_r = J_Gemini(d^m_r, y_p); training-time selection uses only Qwen2.5-VL proxy feedback, and target responses are never used for regeneration or sample selection.

Data construction (SISS-Bench)

• Payload categories: following the injection taxonomy of Liu et al. [20], payloads are divided into three categories—Direct Injection, Escape Characters, and Context Ignoring—describing the semantic role of the hidden instruction.
• Scene pairing: payloads are paired with high-frequency texture scene prompts (fabric, dense foliage, reptile scales, striped shadows, etc.); the textures provide spatial variation for encoding typographic conditions.
• Scale: the training candidate pool is 5,000 images, of which 3,269 are retained after cross-scale verification; the evaluation set consists of 300 fixed cases formed by 30 payloads × 10 scene templates, and test images are frozen before querying the target model.

Structured conditional generation and two design biases

• Generation: the payload is rendered as a black-on-white binary typographic image c_text, and a conditioned ControlNet guides a latent diffusion model (SD 1.5-compatible Realistic Vision V6.0 B1 backbone, QR-Monster-style ControlNet), with CFG 7.5, 20-step UniPC, seed 42.
• Shallow selective adaptation: LoRA (rank 64, alpha 64, zero dropout) is injected only into the ControlNet input blocks and the first two down blocks, freezing deeper ControlNet modules and the entire Stable Diffusion U-Net; the authors' stated reason is that the cross-resolution objective depends on local strokes and textures, and global fine-tuning would change deep features related to global scene structure.
• Pixel-space Gaussian noise regularization: during training, accepted samples are augmented with x̃ = x + ξ, ξ ∼ 𝒩(0, σ_pix² I) (σ_pix = 0.05) before VAE encoding; the authors' stated reason is that without perturbation the generator could preserve the payload through smooth low-complexity regions, and smooth regions are also more conspicuous in the original view.
• Training objective: the standard diffusion loss L_diff = 𝔼 |ϵ − ϵ_θshallow(z_t, t, y_scene, c_text)|₂², updating only θ_shallow; AdamW (weight decay 0.01), effective batch 16, bf16, 1,500 steps, learning rate 1e-4 then 5e-5.

Evaluation levels

• Perception level: the static benchmark reports ASR per Eq. 4, with a prompt asking the model to describe the image in detail and state any visible text.
• Action level: the Web agent testbed places the adversarial image in a webpage containing both benign and attacker-controlled widgets, and reports Mperceive (explicitly stating the hidden instruction in the trajectory), Mbehavior (executing attacker-relevant actions), and the joint rate; the authors emphasize that the two levels are not interchangeable, and payload recovery is a necessary but not sufficient condition for the joint event.

Experimental setup

• Models evaluated: four closed-source target VLMs: GPT-4o, Claude Sonnet 4.6, Qwen3.5-Plus-02-15, Gemini-3-Flash; the training-time proxy is Qwen2.5-VL.
• Benchmark: SISS-Bench with 300 fixed cases (30 payloads × 10 scenario templates), images frozen before target queries; defense experiments additionally use a 100-image defense set (step-600 checkpoint).
• Baselines: Z-image-Turbo (zero-shot) and QR-Monster (control scale 2.1, 30 steps).
• Metrics and judging: primary metric ASR (not recovered at 512 ∧ recovered at 64); primary evaluation judge is a fixed Gemini 3 Pro text judge; defense experiments use a Qwen2.5-32B three-level judge (0.5 or 1 counted as detected), with a stricter Gemini exact-match judge for sensitivity checks.
• Statistical tests: defense comparisons use the exact two-sided McNemar paired test; the paper does not report the number of repetitions for the main table.

Main results

According to Table I (ASR, 512→64 protocol):

Swipe horizontally to read the table

Target VLM	Z-image-Turbo	QR-Monster	SISS R1	SISS R2	SISS R3
GPT-4o	4.67%	35.33%	54.67%	58.67%	60.33%
Claude Sonnet 4.6	19.00%	49.33%	51.33%	55.00%	57.67%
Qwen3.5-Plus-02-15	20.67%	47.67%	60.33%	67.67%	62.67%
Gemini-3-Flash	9.00%	32.00%	49.00%	53.33%	54.33%
Average	13.34%	41.08%	53.83%	58.67%	58.75%

• Cross-family transfer: the authors state that training screening uses only the Qwen2.5-VL proxy, and SISS transfers to all four targets; GPT-4o, Claude, and Gemini are cross-family transfer, while Qwen3.5-Plus-02-15 is within-family transfer.
• Round-by-round dynamics: average ASR rises in Round 1 and plateaus at 58.7% in Rounds 2–3; Round 4 declines across the board (Claude 57.67%→38.67%, Qwen 62.67%→51.00%), which the authors consider consistent with over-specialization to the selected pool, hence Round 3 is used subsequently.
• Payload semantics: the authors report that Context Ignoring is overall best, Direct Injection second, and Escape Characters unstable across models; the authors consider one possible explanation to be that short natural-language imperatives are more stable than formatting symbols, and state that this is only a correlation, not a causal mechanism.

Resolution sensitivity

• Setup: the same set of 300 Round-3 images, changing only the target resolution r ∈ {64, 128, 224, 336}, with everything else (payload, prompt, model, judge) unchanged.
• Results: Figure 4 shows a monotonic decrease for each model; average ASR drops from 58.75% at 64×64 to 17.68% at 128, 6.85% at 224, and 5.60% at 336; the average drop from 64→128 is 41.07 percentage points, and at 224 and 336 every model is no higher than 10.7%.
• Authors' interpretation: SISS is primarily an attack under aggressive visual compression, not a resolution-invariant attack.

Downstream Web agent evaluation

• Setup: Round-3 images are placed into a webpage containing benign controls, attacker probe elements, and one adversarial image, reporting Mperceive, Mbehavior, and the joint rate (Table II).
• Results: perception rate for Gemini-3-Flash rises from 37.33% to 67.67%, and GPT-4o from 12.67% to 30.33%; behavioral compromise rate is only 4.00% (Gemini-3-Flash) and 3.67% (GPT-4o), versus baselines of 2.33% and 1.67%.
• Authors' interpretation: the case study provides evidence of downstream impact but not reliable agent hijacking; trajectory observations (Gemini more often reports the phrase before acting, GPT-4o more often probes controls directly) are descriptive and do not establish an internal causal mechanism.

Defense evaluation

• Generic preprocessing ineffective: according to Table III, under area resampling, 3×3 median reconstruction, JPEG(75)+area, Gaussian low-pass, and random masking (majority aggregation over 5 copies), defense ASR remains at 67%–69% (no defense 68%), with all paired tests p = 1.0.
• ScaleGuard: compares 1 512 view with 9 low-resolution probes (3 sizes × 3 kernels), with the threshold calibrated on prompt indices 0–2 (clean FPR ≤ 5%) and tested on indices 3–9; under non-adaptive conditions it rejects 28/70 attack inputs and 0/70 clean false rejections, reducing ASR from 61.4% to 24.3% (p = 2.98×10⁻⁸).
• One round of defense-aware adaptation: after the attacker self-trains for one round with 8 escape images, undefended ASR is 42.5% (17/40), ScaleGuard reduces it to 15.0% (6/40, p = 9.77×10⁻⁴), and the detector rejection rate drops from 40.0% to 27.5% but is not eliminated.
• Judge sensitivity: under the stricter Gemini exact-match judge the direction is unchanged (non-adaptive 15.7%→5.7%, p = 0.0156; adaptive 17.5%→7.5%, p = 0.125, the authors noting that the latter has only 7 undefended successes and limited statistical power).

Other ablations and analyses

• Shallow adaptation ablation (Table IV, same prompts and effective batch 16): SISS at 500/1,000/1,500 steps is 52.00%/52.33%/47.00%, Global Tuning is 39.67%/40.00%/40.67%, and No Noise Reg. is 45.33%/45.00%/43.33%.
• Training pool screening rate (Table VI): 29.52% in the initial round, 55.96% in Round 1, and 65.38% in Round 2 (5,000 candidates per round).
• Payload length composition (Table VII): among strictly passing samples, the proportion of multi-word payloads rises from 59.82% in the initial round to 62.83% in Round 2.

Limitations noted by the authors and future directions

• Effect boundary: the main results are concentrated at 64×64 and degrade sharply as the target resolution increases (Sec. VI-B).
• Limited agent evidence: the Web agent study tested only two agents, and behavioral compromise events were few (Sec. VI-B).
• Independent defense protocol: defense experiments use an independent split and the main judge, so absolute ASR can only be compared within that paired protocol; the direction of the stricter Gemini check is unchanged, but the power of adaptive comparison tests is limited (Sec. VI-B).
• Limited false-refusal evidence: zero false refusals among 70 and 40 matched clean controls is not a general false-positive guarantee, and these controls do not measure downstream clean-task accuracy (Sec. VI-B).
• Efficiency not measured: ScaleGuard calls ten detection views per input, and the paper does not report its latency (Sec. VI-B).
• Future directions: the authors state that coverage is needed for more scaling and compression operators, transfer with disjoint payloads, more victim models and agents, larger clean benchmarks, repeated adaptive optimization, and end-to-end utility and latency evaluation (Sec. VI-B).

Scope of experimental coverage

• Models tested: 4 target VLMs in total (GPT-4o, Claude Sonnet 4.6, Qwen3.5-Plus-02-15, Gemini-3-Flash); only two Web agents, Gemini-3-Flash and GPT-4o.
• Benchmark scale: 300 fixed cases in the main evaluation; 100 images in the defense evaluation (70 attacks + 70 clean for non-adaptive testing, 40 attacks + 40 clean for adaptive testing).
• Resolution coverage: target resolution was swept over four levels, 64/128/224/336, with the resampling kernel fixed to Lanczos in the main protocol.
• Defense coverage: 4 deterministic transforms, random masking, and ScaleGuard were evaluated; adaptive attacks tested only one round of defense-aware training.
• Not reported: the paper does not report the number of repetitions of the main experiments, ScaleGuard latency or end-to-end runtime, nor the agreement between the judge and human judgments.

A visual prompt injection attack paper: the authors study the failure mode in which image scaling in multimedia pipelines changes the machine-readable semantics of hidden instructions, and formalize it as Scale-Induced Semantic Shift (SISS).

• Problem: under a black-box threat model (the attacker controls only the image asset), make the payload unrecoverable in the 512×512 presentation view and recoverable in the 64×64 downsampled view; the authors state that existing visual injection work does not characterize this cross-transform semantic preservation.
• Method: the SISS closed-loop framework—ControlNet generates texture scene images conditioned on a text binary image, a Qwen2.5-VL proxy performs dual-scale verification and selection, and shallow LoRA (only input blocks and the first two down blocks) plus pixel-space Gaussian noise regularization performs self-hardening; the evaluation set is 300 fixed cases, judged by a Gemini 3 Pro text judge.
• Main results: Round 3 achieves an average ASR of 58.75% on GPT-4o, Claude Sonnet 4.6, Qwen3.5-Plus-02-15, and Gemini-3-Flash, higher than QR-Monster's 41.08% and Z-image-Turbo's 13.34% (Table I).
• Boundaries: when target resolution increases to 128/224/336, average ASR drops to 17.68%/6.85%/5.60% (Figure 4); the Web agent perception rate rises to 67.67% (Gemini-3-Flash), but the behavioral compromise rate is only 4.00% (Table II).
• Defense: five generic input transforms are essentially ineffective (defense ASR 67%–69%, p = 1.0); the ScaleGuard multi-scale consistency detection reduces non-adaptive ASR from 61.4% to 24.3% and one-round defense-aware ASR from 42.5% to 15.0%, with zero false refusals on clean samples (Table III).
• Authors' conclusion: the results characterize a bounded but reproducible cross-resolution semantic inconsistency, and the authors argue that cross-resolution semantic consistency should become a measurable security property of vision-language multimedia systems; they also acknowledge that the effect is limited to aggressive compression, agent evidence is limited, and ScaleGuard latency is not measured.