Multi-Modal AI Security: What Changes When Your AI Processes Images, Audio, and Video

Most current discussion of AI security focuses on text-based language models and the attack vectors specific to them: prompt injection, jailbreaking, training data extraction, and hallucination as a security vector. This focus reflects the prevalence of text-only systems in current enterprise deployments, but it is becoming an incomplete picture. AI systems that process images, audio, and video are increasingly common, and the security considerations for these multi-modal systems differ from those for text-only models in ways that matter for security assessments.

If your security team's current AI assessment methodology was developed against text-only models, it needs to be extended before it can be applied to a multi-modal deployment. Each modality introduces its own attack surface, its own privacy implications, and its own potential for adversarial manipulation. This is not an argument for treating multi-modal AI as fundamentally different from other software; it is an argument for extending the assessment methodology proportionately.

Adversarial inputs: how attacks differ by modality

In text-based AI systems, adversarial inputs are typically human-readable: a prompt injection attempt is a sentence or paragraph that a person could read and recognise as attempting to manipulate the system. In image-based systems, adversarial inputs can be imperceptible to the human eye. Adversarial examples in image classification are images that have been modified by adding pixel-level perturbations that cause the model to misclassify them, while appearing entirely normal to a person examining the same image.

This has practical implications for any system that uses an AI model to make security-relevant decisions based on image input. Document verification systems that use AI to validate identity documents, access control systems that use computer vision for physical security, and content moderation systems that classify images can all be targeted with adversarial examples. The attacker does not need to produce a convincing forgery in the traditional sense; they need to produce an image that the model misclassifies, which is a different and sometimes easier problem. Security testing of AI systems that process images needs to include adversarial example testing as a standard component.

Privacy risks specific to audio and video modalities

Audio and video inputs to AI systems carry significant privacy implications that text inputs typically do not. An AI system that processes audio may process voice recordings that contain identifying information, background conversations that were not intended to be included, or sensitive content that speakers assumed was private. A video processing system has equivalent exposure for visual content. The consent and data minimisation requirements that apply to audio and video processing are more stringent than those for text in most privacy frameworks, including the Australian Privacy Act.

Security assessment of a multi-modal system needs to address not only whether the data is encrypted in transit and at rest, but what retention policies apply to audio and video inputs, whether inputs are used to improve the model, and whether the system design allows inference of private information from inputs that were not provided for that purpose. A voice-enabled AI assistant that retains audio recordings of all interactions has a very different data risk profile from one that processes audio locally and discards it immediately. These choices need to be documented and assessed against the organisation's privacy obligations and risk appetite.

Cross-modal injection and evasion attacks

Multi-modal AI systems create the possibility of cross-modal attacks, where an adversarial payload delivered in one modality affects the model's behaviour in another. A text prompt embedded in an image, rendered in a font size too small to read on screen, can be processed by a vision-language model as an instruction. Audio instructions embedded in a video at a frequency imperceptible to human hearing but within the model's processing range represent a similar cross-modal vector. These attack types exploit the fact that multi-modal models are processing inputs across different channels simultaneously and may not cleanly separate policy instructions from user-supplied content in each channel.

Testing for cross-modal injection requires generating test cases that span modalities: images that contain embedded text instructions, audio tracks with inaudible content, and documents that combine benign visible content with adversarial embedded data. This is a specific extension to the prompt injection testing methodology used for text-only systems and requires tooling and expertise that standard penetration testing does not routinely include.

What a multi-modal AI security assessment involves

A security assessment of a multi-modal AI system needs to cover the full set of modalities the system processes and the interactions between them. In practical terms, this means:

• Adversarial example testing for each image or video classification function with security relevance
• Cross-modal injection testing for systems that process multiple input types simultaneously
• Privacy risk assessment covering data retention, consent, and the potential for private information inference across each modality
• Review of access controls and logging for audio, video, and image input streams
• Assessment of the attack surface introduced by the transcription, object detection, or other pre-processing components that feed into the language model
• Testing the system's behaviour when presented with synthetic media: deepfake audio, manipulated images, and synthetic video

We conduct security assessments of multi-modal AI deployments that extend our standard AI security methodology to cover the specific attack vectors and privacy risks that each modality introduces. If you are deploying a multi-modal AI system and want an independent security assessment, contact us at info@cyberlinx.com.au.