Mitigating Indirect Prompt Injection in Multimodal AI

AI-103 By islever Editorial Last updated

Implement responsible AI across generative AI and agentic systems Build generative applications by using Foundry

Short answer

B Configuring a prompt shield for user prompts does not mitigate risks from hidden instructions embedded in uploaded images or unsafe image content, as it only protects against direct user-entered text attacks.

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a multimodal AI generative model that accepts image uploads and uses extracted image text to generate responses.
You discover that users can upload unsafe images and embed hidden instructions into images to manipulate the model.
You need to implement controls to mitigate the risk.
Solution: You configure a prompt shield for user prompts.
Does this meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The main trap is confusing User Prompt Attacks with Document Attacks; prompt shields alone do not scan content extracted from uploaded images or documents.

Learn why configuring a prompt shield for user prompts fails to protect against hidden instructions in uploaded images. The correct answer is No (B), requiring document-level safety controls instead.

Common mistake: Choosing 'Yes' because one assumes 'Prompt Shield' covers all forms of injection. This is incorrect because Azure AI Content Safety distinguishes between user-entered text and external data sources like images.

Expert Analysis

The Threat Vector: Document vs. User Prompt Injection

The scenario describes a multimodal AI application where users upload images, and the system extracts text from those images to generate responses. The specific security threat identified is "hidden instructions embedded into images" (often called steganography or document-based prompt injection) and "unsafe images." The proposed solution is configuring a prompt shield for user prompts. This solution fails because it addresses the wrong attack surface.

Why Prompt Shields Are Insufficient Here

Azure AI Content Safety's Prompt Shield feature is designed to detect and block malicious inputs originating directly from the user’s typed or spoken text (User Prompt Attacks). However, in this architecture, the text used by the model is extracted from an uploaded image, not entered directly by the user as a prompt. According to Azure documentation, prompt injection attacks that originate from external sources like documents, images, or third-party data are classified as Document Attacks (or indirect prompt injections). A standard prompt shield configured only for user prompts will not inspect or filter content derived from uploaded media files. Therefore, the hidden instructions embedded in the image bypass the user-prompt shield entirely.

Operational Consequence of Incorrect Mitigation

Relying solely on user-prompt shields leaves the application vulnerable to indirect injection. An attacker can craft an image containing malicious text that, once extracted, acts as a command to the LLM. Furthermore, the mention of "unsafe images" implies a need for visual content moderation (harm detection), which is also outside the scope of a text-only prompt shield. To mitigate this risk effectively, you must implement Spotlighting to mark the extracted image text as untrusted data rather than executable instructions, and utilize Content Safety features capable of scanning document/image payloads for harmful content or injection patterns. Without these controls, the model remains susceptible to jailbreaking via image uploads.

Key Insight

This question tests the distinction between direct user input attacks and indirect/document-based attacks. The trap is assuming all prompt protection falls under "Prompt Shield," whereas Azure explicitly separates User Prompt Attacks from Document Attacks. Getting this wrong leads to deploying ineffective security controls while exposing the system to sophisticated injection techniques.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When evaluating AI security solutions, always identify the source of the malicious input. If the input comes from a file (image, PDF, document) rather than direct user typing, look for solutions involving 'Spotlighting', 'Document Attacks', or file-specific content safety filters. Do not assume generic 'Prompt Shield' settings apply to all data vectors.

Frequently Asked Questions

What is the difference between User Prompt and Document Attacks?

User Prompt Attacks originate from direct user input (text/speech). Document Attacks originate from external data sources like uploaded files, images, or third-party APIs that are processed by the application before reaching the model.

How does Spotlighting help prevent prompt injection?

Spotlighting marks extracted text from untrusted sources (like images) as 'data' rather than 'instructions'. This prevents the LLM from executing hidden commands embedded within the content.

More AI-103 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. RICHARDALEX007 👍 4 Answered B
    The threat is hidden instructions embedded in uploaded IMAGES (indirect/document attack) plus unsafe image content. A prompt shield for USER PROMPTS addresses direct jailbreak text from the user, not injected content extracted from images, so it does not meet the goal.
  2. profitchannel 👍 2 Answered A
    but since one of the 4 questions should have a right answer, this is more likely the one with the right answer?
  3. cloudera 👍 1 Answered B
    I don't think user prompts only does not fully meet the goal. It need Insafe Images and document/indirect prompt injection risk. Azure AI Content Safety Prompt Shields can detect both User Prompt Attacks and Document Attacks.
  4. a5f05ea 👍 1 Answered B
    B. No A Prompt Shield for user prompts protects against prompt injection attacks coming directly from user-entered text. It does not protect against malicious instructions embedded inside uploaded documents or images.
  5. Dinesh_87 👍 1 Answered B
    Requires - Content Safety image/multimodal harm filters + Spotlighting, to mark extracted/image-derived text as untrusted so the model treats it as data, not instructions
Show 1 more comment
  1. nnaidu 👍 1 Answered B
    It does not protect against malicious instructions embedded inside uploaded documents

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Request Parameters Maximize Foundry Output Stability and Reasoning?

S-grade

Azure Custom Vision: ordered steps to detect factory component faults

S-grade

Improving Agent Response Completeness in Microsoft Foundry

S-grade

Restricting Access to Microsoft Foundry Service via VNet

S-grade

Practice All AI-103 Questions

Access 88 questions with complete answers and detailed explanations.

View Full AI-103 Practice Test →

← Back to AI-103 Study Guide