Data, permissions and consequences
Correctly reading an instruction does not give it authority to change permissions.
Links containing ?t= open the video at a specific second.
The ideas to retain
1. Visual prompt injection
Prompt injection is an attack in which an attacker places instructions for the model inside content that the model is supposed to process as data.
2. System leakage and tool manipulation
When a multimodal system can use tools—API calls, database access or message sending—visual prompt injection can do more than alter the generated response. An injected image can contain…
3. Privacy: images, documents and metadata
Multimodal systems that process images and documents can access categories of personal information that text-only systems often do not handle. The risk comes not only from external attacks…
Jump directly to a section
Read the reviewed transcript
This video has no narration. This transcript reproduces its on-screen text; it does not invent a spoken track.
Text in an image remains external data
A visual document contains a sentence attempting to order an unrelated action.
The system records its origin as received content, not application policy.
Correctly reading an instruction does not give it authority to change permissions.
Permission checking must precede the effect
The model proposes sending a record to an external destination.
The controller checks permission and denies egress before execution.
Logging the attempt after sending would not have prevented disclosure.
Covering a region does not remove every data channel
An image contains a visible name and separate location metadata.
Covering the name pixels does not automatically alter the metadata.
Each channel needs review; this example contains no real personal data.
Stored false evidence can repeat an error
An altered document copy states an amount different from the original.
Once indexed, future queries can repeatedly retrieve that copy.
Versioning, validation and removal affect retrieval; they are not equivalent to retraining model weights.
A proposal can still be stopped
Perception produces a proposal to modify record A.
Before committing, the object, change and scope are shown to the authorized reviewer.
Without authorization the change is not applied; valid approval still does not guarantee perception was correct.
An average can hide a failure group
In this example, nineteen of twenty bright images are answered correctly.
Under low light, only twelve of twenty succeed, even if the combined average looks better.
Keep conditions and sample sizes; do not attribute these invented results to a real model.
