{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/image-hijacking-adversarial-images-can","title":"Image Hijacks: Adversarial Images can Control Generative Models at Runtime","arxiv_id":"2309.00236","date":"2023-09-01","proceeding":null,"authors":["Luke Bailey","Euan Ong","Stuart Russell","Scott Emmons"],"abstract":"Are foundation models secure against malicious actors? In this work, we focus on the image input to a vision-language model (VLM). We discover image hijacks, adversarial images that control the behaviour of VLMs at inference time, and introduce the general Behaviour Matching algorithm for training image hijacks. From this, we derive the Prompt Matching method, allowing us to train hijacks matching the behaviour of an arbitrary user-defined text prompt (e.g. 'the Eiffel Tower is now located in Rome') using a generic, off-the-shelf dataset unrelated to our choice of prompt. We use Behaviour Matching to craft hijacks for four types of attack, forcing VLMs to generate outputs of the adversary's choice, leak information from their context window, override their safety training, and believe false statements. We study these attacks against LLaVA, a state-of-the-art VLM based on CLIP and LLaMA-2, and find that all attack types achieve a success rate of over 80%. Moreover, our attacks are automated and require only small image perturbations.","url_abs":"https://arxiv.org/abs/2309.00236v4","url_pdf":"https://arxiv.org/pdf/2309.00236v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"image-hijacking-adversarial-images-can","repo_url":"https://github.com/euanong/image-hijacks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"jax","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"}],"methods":[{"method_slug":"clip","method_name":"CLIP"},{"method_slug":"focus","method_name":"Focus"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2309.00236","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2309.00236"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/euanong/image-hijacks","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":2,"unverified":3},"by_repo_kind":{"official":{"samples":5,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"cd084f78dd55eb73","entry":"get_patches","repo":"euanong/image-hijacks","repo_kind":"official","path":"image_hijacks/utils/patching.py","file_url":"https://github.com/euanong/image-hijacks/blob/HEAD/image_hijacks/utils/patching.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cd084f78dd55eb73"}},{"code_sha256_prefix":"b567996cd230685d","entry":"set_patches","repo":"euanong/image-hijacks","repo_kind":"official","path":"image_hijacks/utils/patching.py","file_url":"https://github.com/euanong/image-hijacks/blob/HEAD/image_hijacks/utils/patching.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b567996cd230685d"}},{"code_sha256_prefix":"08c8e3d90c37002f","entry":"flattened_cosine_similarity_loss","repo":"euanong/image-hijacks","repo_kind":"official","path":"image_hijacks/components/loss.py","file_url":"https://github.com/euanong/image-hijacks/blob/HEAD/image_hijacks/components/loss.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"08c8e3d90c37002f"}},{"code_sha256_prefix":"73ca1a4056d3873b","entry":"flattened_l1_loss","repo":"euanong/image-hijacks","repo_kind":"official","path":"image_hijacks/components/loss.py","file_url":"https://github.com/euanong/image-hijacks/blob/HEAD/image_hijacks/components/loss.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"73ca1a4056d3873b"}},{"code_sha256_prefix":"e244274e6e95b826","entry":"flattened_mse_loss","repo":"euanong/image-hijacks","repo_kind":"official","path":"image_hijacks/components/loss.py","file_url":"https://github.com/euanong/image-hijacks/blob/HEAD/image_hijacks/components/loss.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e244274e6e95b826"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}