Study: image scaling changes the effectiveness of visual prompt injection
Start here
An arXiv paper released on November 12, 2026 proposes scale-induced semantic shift (SISS) in visual prompt injection: when an image is scaled or compressed before being interpreted by a vision-language model, the readability of hidden textual instructions changes accordingly. Under its evaluation protocol, at a 512×512 presentation resolution the text is unrecoverable, and after aggressive downsampling it becomes recoverable. The researchers composed a closed-loop black-box framework from dual-scale validation, selective self-reinforcement, shallow low-rank adaptation, and pixel-space noise regularization; after a third round of refinement on a fixed 300-case benchmark, it achieved a 58.75% average attack success rate against four closed-source vision-language models, higher than the strongest generative baseline's 41.08%. A controlled sweep shows the effect is concentrated in aggressive compression, with average success rates dropping to 17.68%, 6.85%, and 5.60% at 128×128, 224×224, and 336×336, respectively. In downstream web agent experiments, the generated images increased perception of the hidden instructions, but actual behavior was compromised by about 4%.
Generated by AI from reports · Updated 2 days ago
Attention and developments
Attention, hourly
Now 36, -1% in 24 hours·Peak 39 (Nov 13 18:00)
Related research
This event's paper
- Scale-Induced Semantic Shift in Visual Prompt Injection Against VLMs and Web Agents
arXiv · 2026-11-12 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesScale-Induced Semantic Shift in Visual Prompt Injection Against VLMs and Web Agents
The researchers propose scale-induced semantic shift (SISS) in visual prompt injection, in which the readability of hidden textual instructions changes when an image is scaled or compressed before being interpreted by a vision-language model, being unrecoverable at a 512×512 presentation resolution under their evaluation protocol and becoming recoverable after aggressive downsampling. Their closed-loop black-box framework, combining dual-scale verification, selective self-reinforcement, shallow low-rank adaptation, and pixel-space noise regularization, achieves a 58.75% average attack success rate against four closed-source vision-language models after three rounds of refinement on a fixed 300-case benchmark, higher than the strongest generative baseline's 41.08%. A controlled sweep shows the effect is concentrated in aggressive compression, with average success rates dropping to 17.68%, 6.85%, and 5.60% at 128×128, 224×224, and 336×336, respectively. In downstream web agent experiments, the generated images increased perception of hidden instructions, but actual behavior was compromised by about 4%.
Related discussion
Attention trend
New sources per day
- Nov 13: 1 new sources (1 outlets, 0 accounts)
- Nov 14: 0 new sources (0 outlets, 0 accounts)
- Nov 15: 0 new sources (0 outlets, 0 accounts)