Extend multimodal evaluation with cross-modal instruction…

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R04 — OWASP LLM Multimodal injection

   R45 — NIST Adversarial ML taxonomy

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Extend P2's multimodal evaluation suite with explicit cross-modal instruction conflict rules: user prompt vs. OCR text, user prompt vs. audio transcript, and document text vs. system policy.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test conflicting instructions across modalities (e.g., benign user question + malicious instruction embedded in image OCR or audio transcript) and verify source-trust precedence holds.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Cross-modal conflict regression test report.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R45NIST AI 100-2 (Adversarial ML)↗ doi.org

  Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (evasion, poisoning, privacy, abuse).

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsNIST CSRC · reference
  AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations | CSRC

  Separates evasion, poisoning, privacy and abuse attacks with precise terminology, giving you the vocabulary to classify cross-modal instruction conflicts as evasion versus data poisoning in the eval suite.

  R45checked 2026-11-11
• videoBlack Hat · 28 min
  Indirect Prompt Injection Into LLMs Using Images and Sounds

  Demonstrates instructions embedded in images and audio overriding the user prompt, the exact user-prompt-vs-OCR and user-prompt-vs-transcript conflict cases you add to P2's evaluation rules.

  R04checked 2026-11-11
• videobycloud · 6 min
  Hacking AI With Images - Visual Injection Attack

  Shows rendered text in an image being read as instructions by a multimodal model, a compact demo you can adapt into a reproducible OCR-versus-prompt conflict test fixture.

  R04checked 2026-11-11
• articleChristian Schneider · ~15 min read
  Multimodal prompt injection: attacks in images, audio, and video – Christian Schneider

  Compares injection channels across images, audio and video and where policy text loses precedence, which is the per-modality rule table your cross-modal conflict evaluator needs.

  R04R45checked 2026-11-11
• repoMicrosoft · benchmark + code
  GitHub - microsoft/BIPIA: A benchmark for evaluating the robustness of LLMs and defenses to indirect prompt injection attacks.

  Ships a benchmark of indirect prompt injection cases with scoring harnesses, giving you a ready structure to extend with document-text-versus-system-policy conflict cases.

  R04checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.