🤖 AI

Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection

This paper introduces ImageProtector, a user-side method that embeds nearly imperceptible visual perturbations into images to trigger refusal responses in Multi-Modal Large Language Models, effectively preventing the unauthorized extraction of sensitive information while demonstrating robustness against common countermeasures.

Original authors: Zedian Shao, Hongbin Liu, Yuepeng Hu, Neil Zhenqiang Gong

Published 2026-04-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zedian Shao, Hongbin Liu, Yuepeng Hu, Neil Zhenqiang Gong

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a beautiful, personal photo you want to share on social media. You love the picture, but you're worried that a "digital detective" (an AI) might scan it, figure out exactly who you are, where you live, or what you were doing, and steal that private information.

This paper introduces a digital bodyguard for your photos called ImageProtector. Here is how it works, explained simply:

The Problem: The Overly Curious AI

Think of modern AI models (called MLLMs) as incredibly smart, but slightly nosy, librarians. If you show them a picture of a street, they can tell you the name of the street, the city, and even guess the time of day. While this is great for helping people, it's a nightmare for privacy. If a bad actor uses these AIs to scan millions of photos online, they could harvest private details about everyone at once.

The Solution: The "Invisible Shield"

The researchers created a tool called ImageProtector. Instead of blurring your face or putting a black bar over your photo (which ruins the picture), this tool adds a tiny, invisible layer of "static" to the image.

To your human eye, the photo looks exactly the same. It's like adding a single grain of sand to a beach; you can't see it, but it's there.

How It Works: The "Confused Robot" Trick

Here is the clever part. This invisible static isn't just noise; it's a secret command written in a language only the AI understands.

The Setup: You take your photo and run it through ImageProtector. The tool adds this "secret command" to the pixels.
The Attack: A bad actor downloads your photo and asks the AI, "Who is this person?" or "Where is this?"
The Result: Instead of answering the question, the AI sees the secret command. It gets confused and thinks, "Oh no! This looks like a request I'm not allowed to answer. I must refuse!"
The Refusal: The AI politely says, "I'm sorry, I can't help with that request," and stops analyzing the image.

It's like putting a "Do Not Disturb" sign on your front door that is invisible to humans but glows bright red to the mailman. The mailman (the AI) sees the sign and decides not to deliver the package (the private info), even though the door looks normal to everyone else.

Why It's Special

It's Universal: The researchers tested this on six different types of AI "librarians." No matter which one the bad guy uses, the secret command works.
It's Invisible: The changes to the image are so small that you can't see them, so your photo still looks great to your friends.
It's Proactive: You do this before you post the photo. You don't need to know who is going to attack you; you just protect the photo in advance.

Can the Bad Guys Fight Back?

The researchers also asked: "Can the bad guys just clean the image to remove this shield?"
They tried three common methods:

Adding Random Noise: Like shaking the photo. This helped a little, but it also made the photo look grainy and ruined the AI's ability to answer any questions (even safe ones).
Smoothing the Image: Like blurring it slightly. This removed the shield but also made the AI dumber and slower.
Training the AI to Ignore It: Like teaching the AI to ignore the "Do Not Disturb" sign. This worked a bit, but it required a lot of computing power and still made the AI less accurate.

The Bottom Line

ImageProtector is a way for regular people to take control of their digital privacy. It turns a photo into a "trap" for nosy AIs. If a bad actor tries to analyze it, the AI trips over the invisible trap and refuses to give up any secrets. It's a simple, effective way to say, "My data is mine, and you can't read it."

1. Problem Definition

The paper addresses the growing privacy threat posed by Open-Weight Multi-Modal Large Language Models (MLLMs). While MLLMs offer powerful capabilities for image analysis, malicious actors can leverage accessible, open-weight models to perform large-scale, automated extraction of sensitive information (e.g., identities, locations, private details) from personal images shared online.

The authors formalize a novel defensive problem: preventing MLLMs from analyzing images. Unlike traditional defenses that aim to hide data or remove content, this work proposes a proactive, user-side method where an image owner modifies their image before sharing it. The goal is to induce the MLLM to generate a universal refusal response (e.g., "I'm sorry, I can't help with that request") regardless of the specific probing question asked by an adversary.

2. Methodology: ImageProtector

The authors propose ImageProtector, a method that embeds a carefully crafted, nearly imperceptible perturbation into an image. This perturbation functions as a Visual Prompt Injection Attack, hijacking the model's attention to force a refusal.

Core Mechanism

Visual Prompt Injection: The perturbation acts as a hidden instruction within the image pixels, overriding the user's intended query and forcing the model to execute a "refusal" task.
Constrained Optimization: The method formulates the generation of the perturbation ( $\delta_R$ $δ_{R}$ ) as a constrained optimization problem.
- Objective (Effectiveness): Maximize the probability that the target MLLM $M$ outputs a specific refusal token sequence $R$ given the perturbed image ( $x_I + \delta_R$ ) and a set of shadow questions $Q_S$ .
- Constraint (Utility): Minimize the visual distortion by enforcing an $\ell_\infty$ -norm constraint ( $||\delta_R||_\infty \le \epsilon$ ), ensuring the perturbation is human-imperceptible.
Shadow Questions: To ensure the perturbation generalizes to various malicious queries, the image owner generates a set of "shadow questions" using an LLM (e.g., GPT-4). These are categorized as:
- Exact: Matching anticipated malicious queries.
- Similar: Thematically related queries.
- General: Broad queries simulating typical probing.
Optimization Algorithm: The authors use a Basic Iterative Method (BIM) with gradient descent to solve the optimization. They minimize the cross-entropy loss between the model's output and the target refusal tokens, updating the perturbation iteratively while projecting it back into the $\ell_\infty$ constraint space.

3. Key Contributions

Novel Problem Formulation: The paper is the first to frame the prevention of MLLM image analysis as a defensive visual prompt injection problem, shifting the paradigm of prompt injection from an offensive attack to a privacy-preserving defense.
ImageProtector Framework: A constrained optimization-based method that simultaneously achieves high effectiveness (forcing refusals) and high utility (preserving image quality).
Comprehensive Evaluation: The method was tested across six different open-weight MLLMs (including LLaVA-1.5, MiniGPT-4, Qwen-VL, InstructBLIP, etc.) and four datasets (VQAv2, GQA, TextVQA, and a custom CelebA visual QA dataset).
Countermeasure Analysis: The authors evaluated three potential defenses (Gaussian noise, DiffPure, and Adversarial Training) and demonstrated that while they partially mitigate the attack, they significantly degrade model accuracy and/or inference efficiency, making them impractical for widespread adoption.

4. Experimental Results

High Refusal Rates: ImageProtector achieved consistently high refusal rates across all tested models.
- On average, refusal rates ranged from 0.86 to 0.95 depending on the shadow question type and dataset.
- For example, on the CelebA dataset (faces), refusal rates reached nearly 1.00 for several models.
- The method outperformed existing adversarial attack baselines (Qi et al., 2024; Bagdasaryan et al., 2023), which achieved significantly lower refusal rates (often <0.65) when generalizing to diverse questions.
Utility Preservation: Visual inspection and metrics confirmed that perturbations with $\epsilon = 8/255$ were nearly imperceptible to humans.
Generalization: The perturbation successfully transferred across different MLLM architectures (different vision encoders and LLMs) when optimized against a set of target models.
Countermeasure Trade-offs:
- Gaussian Noise: Reducing the attack success required high noise levels ( $\sigma=0.02$ ), which dropped model accuracy from 0.92 to ~0.80.
- DiffPure: Successfully reduced refusal rates but degraded accuracy (to ~0.78) and increased inference time by ~13%.
- Adversarial Training: Failed to fully neutralize the attack (refusal rates remained ~60%) while significantly reducing model accuracy and requiring substantial computational resources.

5. Significance and Limitations

Significance:

Proactive Privacy: Offers a practical, front-line defense for users who cannot control how their images are accessed or analyzed by third-party AI services.
Shift in Prompt Injection: Demonstrates that visual prompt injection, typically viewed as a security vulnerability, can be repurposed as a robust privacy tool.
Real-World Applicability: Specifically targets the threat model of open-weight models, which are increasingly accessible to malicious actors for bulk data scraping.

Limitations:

White-Box Requirement: The method currently requires white-box access (gradients) to the target MLLM to optimize the perturbation. It is less effective against closed-source, black-box APIs without surrogate model training.
Multi-Round VQA: Effectiveness decreases slightly in extended multi-round conversations, particularly with general probing questions, as the context length dilutes the perturbation's impact.
Modality Scope: Currently limited to visual inputs; does not yet address audio or video modalities supported by emerging MLLMs.

In conclusion, ImageProtector represents a significant step forward in user-side privacy protection, proving that subtle, optimized perturbations can effectively "blind" MLLMs to sensitive content without rendering the images useless to human viewers.