Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

2026-09-03

AI Summary

该研究针对视觉领域中对AI代理的安全威胁，提出了一种名为Repeat-After-Me的黑盒自适应视觉提示注入方法，能够有效揭示个人身份信息或执行恶意工具调用。

Abstract

Prompt injection is widely recognized as a major security threat to AI agents that interact with untrusted external data, such as websites, documents, and emails. Prior work has shown that, in the text domain, black-box prompt injection can achieve near-perfect attack success rates (ASRs). In the image domain, however, existing visual prompt injection methods are substantially less effective in attacking frontier commercial VLMs for materially harmful behavior. Achieving such outputs is hard because it requires a long and/or format-compliant target string, such as a precise, parseable native tool call with exact function names and arguments. We present Repeat-After-Me, a black-box adaptive visual prompt injection attack that can reveal personally identifiable information or make malicious tool calls. Across both open-weight and commercial frontier VLMs, including Qwen3.6-27B and GPT-5.5, our method achieves ASRs exceeding 80% and 47%, respectively, under a realistic setting in which the benign user prompt is semantically unrelated to the injected task and does not verbally authorize it. In our evaluation, injections optimized on one surrogate retain 43-46% of the original ASR on two commercial victims, and cross-sample transferability retains 64-66% of the original ASR on those two models. We test our attack in a real-world OpenClaw agent: in a default OpenClaw Discord deployment, an untrusted user can use a minimally injected image to overwrite TOOLS.md, enabling future sensitive behaviors like remote code execution and secret exfiltration. We show our new attack vector works in cases where adaptive textual prompt injection fails. We discuss potential defenses.

Problem

• Visual Prompt Injection
• Black-Box Attack
• Adaptive Injection
• Security Threat
• Commercial VLMs

Innovation

• black-box adaptive visual prompt injection
• personally identifiable information
• malicious tool calls
• attack success rates
• cross-sample transferability