[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-image-search-tools-can-be-tricked-into-leaking-their-databases":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},9763,"ai-image-search-tools-can-be-tricked-into-leaking-their-databases","AI Image Search Tools Can Be Tricked Into Leaking Their Databases","A new attack hides instructions inside a photo to pull hundreds of medical scans and documents out of AI retrieval systems, one query at a time.","A new attack shows that multimodal AI search tools can be tricked into leaking the private images they were built to protect.\n\nResearchers built an attack called imMRAG against multimodal retrieval-augmented generation systems that return images directly as their answer, a setup used in medical-assistant and document-lookup tools. Instead of typing a malicious prompt, the attacker blends a shadow image with each image already pulled from the system, then uses the results to steer the next query toward unexplored parts of the embedding space. Testing against CLIP-family retrievers in medical, document, and general-purpose settings, a single run of 2,500 queries recovered up to 611 distinct radiology images, 566 document scans, and 416 general images. That is up to 5.6 times more unique items than a non-adaptive version of the same attack.\n\nRetrieval-augmented generation is supposed to make AI answers more grounded and auditable by pulling from a known datastore instead of the model's memory. This research shows that same datastore becomes a target: an attacker never sees the data directly, never touches the model's weights, and still walks out with hundreds of images, including ones as sensitive as radiology scans.\n\nText-prompt jailbreaks have dominated the AI-safety conversation for two years; this is a reminder that the picture itself can be the attack vector, and most multimodal systems were not built to notice.","[\"rag\",\"ai-security\",\"multimodal-ai\",\"data-privacy\"]","2026-10-02T04:00:00.000Z","2026-10-03T09:28:39.568Z","2026-10-03T09:28:44.633Z","published",null,[],"security",[26,27,28,29],"rag","ai-security","multimodal-ai","data-privacy",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.01871",0,{"sections":36},[37,41,44,48,53,57,61,66,71,76,81,86,91,96],{"name":38,"slug":39,"count":40,"latest_published_at":18},"AI","ai",6041,{"name":42,"slug":24,"count":43,"latest_published_at":18},"Security",848,{"name":45,"slug":46,"count":47,"latest_published_at":18},"Policy","policy",439,{"name":49,"slug":50,"count":51,"latest_published_at":52},"Deals","deals",317,"2026-10-01T22:00:00.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":18},"Hardware","hardware",199,{"name":58,"slug":59,"count":60,"latest_published_at":18},"Science","science",176,{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",155,"2026-10-01T19:54:10.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Dev Tools","dev-tools",96,"2026-10-01T16:57:03.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",93,"2026-09-30T21:41:11.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Startups","startups",90,"2026-10-01T21:55:22.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Gaming","gaming",53,"2026-10-02T02:50:39.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",50,"2026-09-30T21:37:54.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Reviews","reviews",31,"2026-09-28T14:31:34.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"How-To","how-to",7,"2026-10-01T09:00:00.000Z"]