Hidden prompt injection through image downscaling
Originally posted on LinkedIn, October 7, 2025.
An ordinary image can make an AI model follow instructions the user never saw. Trail of Bits hid text commands inside images that looked harmless, but the commands became visible to the model after automatic image processing.
They tested the attack against systems including Google Gemini on the web, through the API, on mobile, and in Vertex AI Studio. It worked in most cases.
Almost every AI system that accepts images performs downscaling before sending them to the model to reduce resource use. Algorithms such as bicubic and bilinear can create a side effect: if the pixels in the original image are designed precisely, they remain invisible to the human eye but become clear after downscaling. The hidden text appears only in the version the model receives, not the version the user sees.
This is prompt injection disguised inside an image.
The attack has limits:
- It requires precise control over the pixels.
- The attacker needs to know which downscaling algorithm the system uses.
- If the user can preview what the model sees, they may notice the difference.
Even with those limits, this is a real attack that works against products already on the market. It shows how differently models can see the same image we do.
Read Trail of Bits’ full write-up.
