Text Prompt Injection of Vision Language Models

2025-10-10

AI Summary

Vision-language models (VLMs) exhibit critical security vulnerabilities to text prompt injection attacks in open-ended interactive settings. Method: We propose a lightweight, efficient, and generalizable attack method that synergistically combines prompt engineering with adversarial input construction—requiring no model gradients or fine-tuning, and relying solely on carefully crafted textual instructions jointly perturbed with image context to mislead mainstream VLMs (e.g., LLaVA, Qwen-VL). Contribution/Results: Our approach achieves significantly higher attack success rates across multi-task benchmarks—averaging a 12.7% improvement over state-of-the-art baselines—while maintaining sub-0.8-second per-attack latency and reducing GPU memory consumption by over 60%. This work constitutes the first systematic empirical demonstration of VLMs’ susceptibility to pure-text prompt injection under realistic open-world interaction protocols, thereby establishing a foundational benchmark and technical reference for future robustness modeling and defensive mechanism design.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Prompt Engineering / Prompting

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Economics, Online Markets and Human Computation: Cost models of using LLMs in production systems

Abstract

The widespread application of large vision language models has significantly raised safety concerns. In this project, we investigate text prompt injection, a simple yet effective method to mislead these models. We developed an algorithm for this type of attack and demonstrated its effectiveness and efficiency through experiments. Compared to other attack methods, our approach is particularly effective for large models without high demand for computational resources.

Problem

• Investigating text prompt injection to mislead vision language models
• Developing efficient attack algorithms requiring minimal computational resources
• Demonstrating effectiveness against large models through experimental validation

Innovation

• Text prompt injection misleads vision language models
• Algorithm developed for efficient model attack
• Method requires minimal computational resources