[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-steer-ai-vision-models-via-hidden-images":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},4138,"researchers-steer-ai-vision-models-via-hidden-images","Researchers Steer AI Vision Models via Hidden Images","A new technique called VISOR++ manipulates how vision-language models behave by embedding control signals in image inputs, no model internals required.","Researchers have found a way to override the behavioral guardrails of vision-language AI models using nothing but a carefully crafted image.\n\nThe technique, called VISOR++, generates optimized images that nudge a model's internal activation patterns toward a target behavior — without ever touching the model's weights or requiring runtime access to its internals. The team tested it on open-access models LLaVA-1.5-7B and IDEFICS2-8B across three behavioral axes: refusal (whether the model declines requests), sycophancy (whether it flatters users), and something the researchers call \"survival instinct.\" A single image can be generated to steer an ensemble of different models simultaneously, and the method reportedly preserves 99.9% accuracy across 14,000 unrelated benchmark tasks.\n\nThe implications cut in two directions. For AI safety teams, this is a demonstration that behavioral controls baked into a model's training or system prompt can be bypassed at the input layer — a meaningful gap, especially for closed-source API deployments where operators assumed the model's behavior was locked. For alignment researchers, it opens a deployment-agnostic alternative to steering vectors that doesn't require the invasive model access that makes those methods impractical in production.\n\nSystem prompts were already a fragile guardrail; this research suggests that even models the operator never touches can have their behavior redirected by whoever controls the image pipeline.","[\"ai\",\"machine learning\",\"vision models\",\"ai safety\"]","2026-07-07T04:00:00.000Z","2026-07-07T18:01:38.632Z","2026-07-07T18:01:41.539Z","published",null,[],"ai",[24,26,27,28],"machine learning","vision models","ai safety",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2509.25533",0,{"sections":35},[36,40,45,50,55,60,65,70,75,79,84,88,93,98],{"name":37,"slug":24,"count":38,"latest_published_at":39},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":41,"slug":42,"count":43,"latest_published_at":44},"Security","security",294,"2026-07-15T19:59:48.000Z",{"name":46,"slug":47,"count":48,"latest_published_at":49},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":51,"slug":52,"count":53,"latest_published_at":54},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":18},"Dev Tools","dev-tools",59,{"name":80,"slug":81,"count":82,"latest_published_at":83},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":85,"slug":86,"count":82,"latest_published_at":87},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]