Multi-modal large language models (MLLMs) have emerged as powerful tools for analyzing Internet-scale image data, offering significant benefits but also raising critical safety and societal concerns. In particular, open-weight MLLMs may be misused to extract sensitive information from personal images at scale, such as identities, locations, or other private details. In this work, we propose ImageProtector, a user-side method that proactively protects images before sharing by embedding a carefully crafted, nearly imperceptible perturbation that acts as a visual prompt injection attack on MLLMs. As a result, when an adversary analyzes a protected image with an MLLM, the MLLM is consistently induced to generate a refusal response such as "I'm sorry, I can't help with that request." We empirically demonstrate the effectiveness of ImageProtector across six MLLMs and four datasets. Additionally, we evaluate three potential countermeasures, Gaussian noise, DiffPure, and adversarial training, and show that while they partially mitigate the impact of ImageProtector, they simultaneously degrade model accuracy and/or efficiency. Our study focuses on the practically important setting of open-weight MLLMs and large-scale automated image analysis, and highlights both the promise and the limitations of perturbation-based privacy protection.
ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction
College of Computing and Data Science, Nanyang Technological University, Singapore（计算与数据科学学院，南洋理工大学，新加坡）；Alibaba（阿里巴巴）；School of Computer Science, Peking University, China（计算机科学学院，北京大学，中国）
Echo-LoRA: Parameter-Efficient Fine-Tuning via Cross-Layer Representation Injection
School of Computer Science and Software Engineering, Southwest Petroleum University（西南石油大学计算机科学与软件工程学院）；School of Electronic Information and Artificial Intelligence, Leshan Normal University（乐山师范学院电子信息与人工智能学院）
The Surface You Test Is Not the Surface That Breaks
Department of Robotics and Mechatronics Engineering, University of Dhaka（达卡大学机器人与机电工程系）；Department of Computer Science and Engineering, University of Dhaka（达卡大学计算机科学与工程系）
本文发现工具增强的LLM代理对提示注入的脆弱性依赖于攻击表面（工具输出 vs 工具描述），提出自适应攻击率并强调评估需报告每个表面的脆弱性。
Role-Aware Language Models for Secure and Contextualized Access Control in Organizations
Mohamed bin Zayed University of Artificial Intelligence（莫扎德·本·扎耶德人工智能大学）；Nazarbayev University（纳扎尔拜耶夫大学）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；New York University Abu Dhabi（纽约大学阿布扎克分校）
Think Proprioceptively: State-Grounded Visual Token Selection for VLA Policies
The Hong Kong Polytechnic University（香港理工大学）；Eastern Institute of Technology（东区技术研究所）；Great Bay University（大湾大学）；Northeast Forestry University（东北林业大学）；National University of Singapore（新加坡国立大学）
PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoors
Institute of Information Engineering, Chinese Academy of Sciences（信息工程研究所，中国科学院）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；BraneMatrix AI；School of Cyber Science and Technology, Shenzhen Campus, Sun Yat-sen University（中山大学深圳校区计算机科学与技术学院）
