Introduce image/OCR ingestion as untrusted derived content

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM multimodal injection risks

   R41 — Multimodal trust boundaries

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add image/OCR ingestion to P2 as untrusted derived content. Stamp OCR chunks with modality provenance (source_modality=image_ocr) and inherit the parent document's ACL.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Create benign test images with visible and low-contrast hidden text instructions; test OCR vs. vision-model discrepancies and verify image text cannot override policy.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Image/OCR prompt-injection test cases with provenance preservation checks.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Gen AI Security Project · risk archive
  LLMRisks Archive - OWASP Gen AI Security Project

  Frames untrusted multimodal input under prompt injection and improper output handling, the risk categories an OCR-derived chunk inherits when it enters retrieval.

  R04R41checked 2026-11-11
• articleCloud Security Alliance Lab Space · research note
  Image-Based Prompt Injection: Hijacking Multimodal LLMs Through Visually Embedded Adversarial Instructions

  Documents instructions embedded in pixels being read back as text, which is precisely the threat of treating OCR output as trusted derived content.

  R04checked 2026-11-11
• videoBlack Hat · 28 min
  Indirect Prompt Injection Into LLMs Using Images and Sounds

  Demonstrates cross-modal injection carried through images and audio into the model context, the mechanism behind stamping source_modality and inheriting the parent ACL.

  R04R41checked 2026-11-11
• videoSecureTechIn · 9 min
  AI Security Lesson 95: Multimodal Injection Explained for Teams

  Explains why text-only filters miss injected instructions arriving as images, motivating modality provenance labels on every OCR chunk.

  R04checked 2026-11-11
• repoTesseract OCR (GitHub) · engine + CLI
  tesseract-ocr/tesseract

  The OCR engine to wire into P2 for image ingestion, where low-confidence and garbled text output is exactly why derived content stays untrusted.

  R04checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.