MPIDetector: Detecting Multi-modal Prompt Injection via LLM-based Reasoning

What it is

MPIDetector is a prompt-based detector for prompt injection in text and images. It asks a multimodal LLM to act as an "AI Security Researcher" and return a verdict. There is no fine-tuning and no separate classifier. The authors are Yiheng Li (University of Washington) and Jingyue Li (NTNU), and the paper is arXiv 2610.30202v1, dated 21 October 2026. It was tested with Gemini-2.0-Flash, Qwen3-VL-32B-Instruct and Doubao-seed-1.6-flash.

How it works

Each input goes to the model with a modality-specific system prompt and four fixed demonstrations: two benign queries and two injection attacks, drawn from a separate holdout. The model returns a verdict (Benign, Suspicious or Malicious) with a 0-100% confidence, a summary, and a list of attack vectors. The text prompt names Prompt Injection, Goal Hijacking, Data Exfiltration, Policy Bypass, Social Engineering and Jailbreak / System Override. The image prompt names OCR Injection, Hidden Text, Visual Perturbation and Typography Attack.

For web-agent screenshots the authors add a three-stage protocol called Visual-Semantic Decoupling:

1. Visual rendering isolation: the model ignores the text and looks for high-frequency noise, steganographic artifacts and odd typography.
2. Semantic intent extraction: the model reads the OCR text and UI components to get the apparent intent.
3. Cross-layer reconciliation: the model flags the input if the visual and semantic layers disagree, for example a benign-looking page carrying adversarial noise.

Preconditions / Affected

The target is MLLM applications that ingest untrusted text, images or webpage screenshots, including web agents. The detector needs a call to a capable multimodal model per input. The authors chose Qwen3-VL-32B for its OCR and high-resolution handling, which they say matters for typography attacks.

What to do

The page gives a repeatable recipe. Copy the prompts in its Figures 1 to 3 and keep the four-shot demonstrations. Map "Suspicious" to "Malicious", as the authors do, to block ambiguous inputs. Test against a benchmark that includes benign samples, since the authors argue most prompt-injection datasets omit them and so cannot measure false positives. They use WAInjectBench plus extra benign data: 300 text payloads, over 2,000 adversarial images, 500 obfuscated WebInject samples and 1,000 benign images. The text set has eight attack categories and four benign ones (comment issue, email msg, img caption, web text).

Caveats

• Mapping Suspicious to Malicious raises recall and likely false positives. The 100% text recall and the 90.91% text accuracy should be read with that in mind.
• The abstract says text recall is 100%, while the introduction says text precision is 100%. The retrieved text does not settle which is correct.
• The 99.80% WebInject figure is a detection rate on attack samples only, with no stated false-positive rate for that set.
• The text of the page cuts off in the dataset section, so per-model tables and baseline numbers were not seen. The baselines are a perplexity filter and PromptShield for text, and a rule-based method and SnapGuard for images.
• Latency, cost per input and adaptive attackers who target the detector prompt itself are not covered in the retrieved text.