Researchers have found a way to override the behavioral guardrails of vision-language AI models using nothing but a carefully crafted image.
The technique, called VISOR++, generates optimized images that nudge a model's internal activation patterns toward a target behavior — without ever touching the model's weights or requiring runtime access to its internals. The team tested it on open-access models LLaVA-1.5-7B and IDEFICS2-8B across three behavioral axes: refusal (whether the model declines requests), sycophancy (whether it flatters users), and something the researchers call "survival instinct." A single image can be generated to steer an ensemble of different models simultaneously, and the method reportedly preserves 99.9% accuracy across 14,000 unrelated benchmark tasks.
The implications cut in two directions. For AI safety teams, this is a demonstration that behavioral controls baked into a model's training or system prompt can be bypassed at the input layer — a meaningful gap, especially for closed-source API deployments where operators assumed the model's behavior was locked. For alignment researchers, it opens a deployment-agnostic alternative to steering vectors that doesn't require the invasive model access that makes those methods impractical in production.
System prompts were already a fragile guardrail; this research suggests that even models the operator never touches can have their behavior redirected by whoever controls the image pipeline.