Input Validation · Content & Policy Screening
Detect attacks that mix input types
Verify that coordinated attacks spanning multiple input types (e.g., steganographic payloads in images combined with prompt injection in text) are detected and blocked.
OWASP AISVS v1.01, requirement 2.2.4
In plain English
Some attacks are split across input types. Part of an instruction sits in an image and the rest in the text, and each half looks harmless when checked alone. Screen the combined input as the model will see it. This is a Level 3 control for multimodal systems facing determined attackers.
What good looks like
- After extraction from each media type, the pieces are assembled and screened together as one input.
- Test cases include attacks split across image and text, audio and text, and across several files in one request.
- Detected attempts are blocked and logged with all the parts kept for analysis.
How teams usually do it
- Extract text from every input, build the prompt in the order the model will receive it, and run the injection and content classifiers over the assembled result.
- Use a multimodal safety classifier that takes image and text together (for example a vision-capable Llama Guard model).
- Red-team exercises that deliberately spread payloads across media types and turns.
Suggested evidence
- The pipeline design, showing where the combined check happens.
- Results from cross-modal attack tests.
Common mistakes
- A separate filter per input type with no check on the combination.
- Checking one request at a time when an attacker can spread the pieces across turns of a conversation.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.