Render Before Reading: Visual Rendering as a Prompt Injection Defense

arXiv:2609.36121 · cs.CR, cs.AI · Submitted 2026-09-28 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-28

Updated: 2026-09-28

Code: https://github.com/zj-jayzhang/Pictionary

Terminology

• Benchmark — 25× in this paper · explained in 2 episodes
• Fine-Tuning — 11× in this paper · explained in 5 episodes
• Trace — 10× in this paper · explained in 2 episodes
• Ablation — 9× in this paper · explained in 1 episode
• Accuracy — 9× in this paper · explained in 1 episode
• Instruction Tuning — 9× in this paper · explained in 2 episodes
• Modality Gap — 7× in this paper · explained in 4 episodes
• AGENTIC AUTO RED TEAMING — 6× in this paper
• Fidelity — 5× in this paper · explained in 2 episodes
• Reinforcement Learning — 3× in this paper · explained in 4 episodes
• Verifier — 3× in this paper · explained in 2 episodes
• Agent Harness — 2× in this paper · explained in 2 episodes
• Aggregation — 2× in this paper · explained in 1 episode
• Alignment — 2× in this paper · explained in 1 episode
• GRPO — 2× in this paper · explained in 6 episodes
• IEEE Symposium on Security and Privacy — 2× in this paper
• Model-Agnostic — 2× in this paper · explained in 2 episodes
• Vision-language models — 2× in this paper · explained in 2 episodes
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Benchmarking — 1× in this paper · explained in 4 episodes
• Cross-Model Transfer — 1× in this paper · explained in 2 episodes
• Provenance — 1× in this paper · explained in 4 episodes
• Reward Function — 1× in this paper · explained in 2 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Thinking mode — 1× in this paper · explained in 2 episodes

Sources

• $\tau^2$-Bench: Evaluating Conversational Agents in a Dual-Control Environment
• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents
• Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents
• Learning to Inject: Automated Prompt Injection via Reinforcement Learning
• Qwen-Audio: Advancing Universal Audio Understanding via Unified Large-Scale Audio-Language Models
• Defeating Prompt Injections by Design
• Defending Against Indirect Prompt Injection Attacks With Spotlighting
• Tulu 3: Pushing Frontiers in Open Language Model Post-Training
• AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents
• Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Ignore Previous Prompt: Attack Techniques For Language Models
• DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions
• AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection
• PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
• Defending Against Prompt Injection with DataFilter
• DeepSeek-OCR: Contexts Optical Compression
• RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection
• Prompt Injection as Role Confusion

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs