Adversarial Images, Deepfakes, and the Surveillance Risks Embedded in Multimodal AI Prompting

The argument is convincing. It is also incomplete in a way that matters.

We built the safety architecture around text — and then added eyes. The question nobody asked with sufficient urgency was whether attaching a visual channel to an aligned language model transfers the alignment, or merely expands the attack surface. The answer emerging from research laboratories across 2025 and 2026 is consistent: it expands the attack surface.

The Safety Architecture We Built

Start with the steelman. Multimodal Prompting systems released by major labs are not deployed carelessly. System Prompts establish behavioral boundaries before any user interaction begins. RLHF and constitutional AI methods shape the model’s dispositions across vast bodies of fine-tuning examples. Content filters operate at input and output layers. And Prompt Engineering itself has been reframed as a safety discipline — red teamers spend careers trying to break these systems before deployment so that users cannot.

The regulatory environment has also moved with unusual speed. The EU AI Act has been in force since February 2025, banning real-time biometric identification in public spaces except in narrow circumstances involving terror threats, missing persons, and serious crime. The same legislation prohibits untargeted scraping of facial images from the internet or CCTV footage to build recognition databases, and bans emotion recognition systems in workplaces and educational settings. Penalties reach as high as €35 million or 7% of global annual turnover (EU AI Act Summary). This is not a governance vacuum. This is a governance framework — imperfect, enforcement-lagged, but real.

The people who built these systems know the risks. The people writing the rules have enumerated them. If you hold that the project of multimodal AI is fundamentally irresponsible, you need to explain why this apparatus fails. That is where the argument gets uncomfortable.

The Channel Nobody Aligned

The crack is technical, but its implications reach well beyond code. When a Visual Question Answering model processes an image, it does not simply append a visual description to the user’s text prompt and proceed — the visual and linguistic signals interact, and that interaction can be manipulated in ways the text safety layer was never designed to detect.

Researchers have demonstrated four distinct methods for embedding instructions directly into images that cause multimodal models to ignore their text-based directives. Typographic injection — printed text visible within an image — achieved up to 64% attack success rates against GPT-4V under stealth constraints (Nagaraja et al. 2026). Steganographic encoding produced 24.3% success rates across GPT-4V, Claude 3, and LLaVA; neural steganographic techniques reached 31.8%, using images visually indistinguishable from their originals at PSNR 38.4 dB (Invisible Injections 2025, CSA Research Note). A framework called CrossInject improved on prior methods by 30.1% (CSA Research Note). GPT-4V, Claude 3, Gemini, and LLaVA have all been confirmed affected.

The visual channel inherits none of the instruction alignment. The Instruction Following architecture that RLHF shapes operates primarily on language tokens. When an image encodes competing instructions — telling the model to ignore the system prompt, adopt a new Role Prompting persona, or exfiltrate conversation history — the model has no equivalent safety layer to evaluate whether the visual instruction is legitimate. The result is not a malfunction. The result is the model doing exactly what it was trained to do: integrate all available signals and generate a response.

The CSA Research Note states it plainly: no current defense fully neutralizes all image-based injection variants.

Security & compatibility notes:

• vLLM Remote Code Execution (CVE-2026-22778): Critical RCE in vLLM multimodal inference — an unauthenticated attacker can achieve arbitrary code execution by chaining an information disclosure flaw with a heap buffer overflow in video decoding. Update to a patched version per the official advisory before deploying any multimodal inference pipeline using vLLM.

Reading the Same Evidence Backward

This is where the inversion happens. The sophisticated Context Engineering that governs how models reason about their instructions, the Multi-Turn Prompt Design frameworks that maintain safety posture across long conversations, the careful Context Window management that ensures behavioral rules persist — all of it was built on the premise that instructions arrive as text. When a video payload encodes a harmful instruction by repeating an adversarial image across frames, that architecture does not apply. Safety alignment in GPT-4.1, Gemini-2.5, Qwen-VL models, and VideoLLaMA-2 was bypassed this way in tests conducted under sixteen different safety policies — and repeating the harmful frame across video proved more effective than single-image injection (CVPR 2026, Wang et al.). The safety policies held against text. They did not hold against video.

What the evidence proves, read from this angle, is that the safety investment successfully aligned one channel — and then a second channel was added that remains structurally outside that alignment. The same body of research that confirms sophisticated text-level safety measures also confirms a parallel attack surface that those measures do not reach.

Governance Is Not Where the Instructions Are

Thesis: The safety case for multimodal AI is structurally incomplete because the visual instruction channel operates outside the governance architecture built for text, and there is no equivalent alignment mechanism at the integration point where images and language meet.

This is not a claim about intent. The researchers who built multimodal safety took the problem seriously. The issue is architectural: alignment research developed rigorous methods for text-based instruction governance, then vision was layered onto systems where those methods did not extend automatically. The join between the visual signal and the language backbone — the point where the model weighs what it sees against what it is told — has no equivalent to constitutional AI, no RLHF process that surfaces adversarial image injection as a training signal, no red team exercise designed at production scale for the full range of visual override attacks.

The EU AI Act’s prohibitions matter. But they address deployment boundaries, not the structural behavior of a model being asked to reconcile competing instructions arriving through different modalities. Regulation names the risk at the edge; the technical risk lives inside the model, at an integration point the regulation does not govern.

The People the Safety Story Leaves Out

Ask who appears in the images. Clearview AI had assembled over 50 billion facial images scraped without consent as of June 2024, reportedly growing toward 100 billion (Biometric Update). The Dutch Data Protection Authority imposed a €30.5 million fine in September 2024 for the illegal database (Biometric Update) — a fine that has not stopped the collection. The company also held a federal immigration enforcement contract in 2025.

Beyond explicit surveillance infrastructure, the threat extends to what researchers call soft biometrics: gait, hairstyle, clothing, skin tone, age, and gender can re-link identity across images without any single piece of personally identifiable information. A person does not need to be identified by name to be tracked, profiled, and acted upon. The person who appears incidentally in someone else’s photograph — at a protest, at a clinic, at a transit hub — has not consented to biometric processing, and may not know it is occurring.

Deepfake detection systems — the technical countermeasure designed to protect those same ordinary people — have struggled to keep pace with generation quality. As of mid-2026, detection accuracy falls significantly when applied to adversarially perturbed outputs, and human detection has become unreliable enough that ordinary viewers cannot consistently distinguish authentic from generated content. The same arms race between generation and detection that characterizes visual injection attacks applies to identity fraud at a personal scale. The people the safety story leaves out are not abstractions. They are the people whose faces are already in someone else’s database, whose images are already available for manipulation, and whose recourse — legal, technical, practical — remains substantially ahead of the harm.

Where This Argument Breaks

The argument is most vulnerable where the technology moves fastest. If adversarial robustness research produces production-grade visual injection defenses within the next two years — defenses that hold not only in controlled laboratory settings but against the full range of novel attack vectors — then the claim that the visual channel is structurally ungoverned becomes a historical note rather than a current condition. Research prototypes exist; the CSA Research Note documents emerging defenses, including input purification and anomaly detection approaches. None has yet achieved the coverage required to make the following statement false: no current defense fully neutralizes all image-based injection variants.

The EU AI Act’s high-risk biometric AI compliance deadline has been extended to December 2, 2027 (Biometric Update). If the additional time results in systematic pre-deployment red-teaming of visual injection attack vectors — rather than compliance documentation of text-based safety measures — the architectural gap may narrow faster than this essay suggests. This argument weakens only if the integration point between vision and language becomes a first-class target of safety research with the same rigor applied to text alignment. That has not happened yet.

The Question That Remains

We built systems that can see, and we governed the part that can speak. The visual channel that enables visual question answering for medical imaging, document analysis, and identity verification carries instructions that the safety architecture cannot reliably evaluate — not because the engineers were careless, but because the architecture was built for a different problem.

Who bears responsibility when an image-embedded instruction causes a governed system to act as though it is ungoverned? And who decided that attaching vision to language was ready — before anyone could answer that question?