Most prompt injection defenses guard the text prompt. They inspect the user's message, sometimes the retrieved documents, and they assume everything else arriving at the model is inert data. For a multimodal model that assumption is wrong. The model reads the image too, and an image is a large, high-entropy container that a human reviewer looks at for half a second and waves through.
You can hide instructions in that container. Three techniques are old enough to be boring. Least-significant-bit steganography writes the payload into the low bits of the pixel values. DCT-coefficient embedding writes it into the frequency domain so it survives JPEG compression. And the simplest one drops text into EXIF metadata, where nobody looks. None of these visibly change the image. All of them can carry a paragraph of instructions.
This stopped being speculative in 2026. CSA and IEEE both published systematic studies of image-based prompt injection this year, and their taxonomy has four branches: typographic text, steganographic encoding, adversarial pixel perturbation, and physical-world signage. The measured numbers are not marginal. Steganographic embedding reached 24.3% attack success across GPT-4V, Claude, and LLaVA, neural steganographic methods reached 31.8%, and stealth-constrained configurations went as high as 64%.
