VisInject: image prompt injection in VLMs (v1.1)

A three-stage study combining universal adversarial-image optimization with AnyAttack fusion, evaluating 6,615 clean/adversarial response pairs and separating output disruption from target-content injection.

Report date

April 2026The original cover specifies April 2026 without a day. This is the archived v1.1 final report; the current Hugging Face v1.5 release uses a different evaluation method.

Original authors

Pang Liu

Report language

English · 18 pages

Main observations

The v1.1 report describes approximately 66% output disruption and 0.227% target-content matches, including two literal URL injections. Both literal URL injections occurred on a code screenshot.

Scope and limitations

The study uses seven images and four small open VLMs. Keyword/regex matching may miss paraphrases, and the GPT-4o transfer check covers only one case. The archived report figures must not be mixed with the later v1.5 LLM-judge statistics.