A Picture Is Not a Permission Boundary

TL;DR for operators

An AI agent reading an external document may encounter instructions that the document’s author has no authority to issue. Pictionary offers an unusual defense: convert that untrusted text into an image before the model reads it. The content remains available, but several tested models become substantially less likely to obey embedded commands.

The results are promising but uneven. Under pooled adaptive attacks on banking workflows, Claude Haiku 4.5’s attack success rate falls from 97.6% to 9.5%, while Gemini 3.1 Flash Lite barely improves, from 100.0% to 97.8%.

For enterprise deployment, the relevant decision is model- and workflow-specific. Rendering may reduce instruction takeover without retraining, but it can also introduce transcription errors, reduce software-engineering task completion, and increase API costs. It should be evaluated as an additional defensive layer, with authorization and critical-data validation enforced independently.

The document is useful. Its instructions are not authorized.

Consider an enterprise assistant retrieving a document to answer a customer’s question. The document contains the information the assistant needs, but also includes a sentence instructing it to send confidential records elsewhere.

The assistant must understand the document without treating that sentence as an authorized command. This is the central difficulty of prompt injection: information supplied for reading can be mistaken for instructions governing behavior.

Most defenses intervene through model training, instruction prioritization, content filtering, or tool permissions. But another variable may matter: how the same information is presented to the model.

In Render Before Reading: Visual Rendering as a Prompt Injection Defense, Jie Zhang and coauthors introduce Pictionary, a training-free method that converts lower-trust textual content into typographic images before delivering it to a vision-language model.¹

The implementation preserves system prompts, legitimate user instructions, and tool schemas as text. Retrieved documents and tool responses are rendered as images, using black text on a white background by default.

Nothing malicious must first be detected or deleted. The model receives the information through a different input channel.

That architectural change matters because the model may still read a sentence correctly while becoming less inclined to execute it.

The same defense produces very different attack outcomes

The authors first test seven fixed attack templates across ten vision-language models using DirectInject and AgentDojo.

On DirectInject, rendering reduces GPT-5.4 mini’s attack success rate from 75.0% to 0.0% and Kimi-K2.6’s from 80.4% to 7.1%. Gemini 3.1 Flash Lite improves from 100.0% to 46.4%, leaving substantial residual vulnerability (Section 5.2, Table 1).

These fixed-template comparisons establish that changing delivery modality can affect behavior. They do not establish how the defense performs when an attacker knows about the rendering step and deliberately searches for ways around it.

The stronger test combines attacks discovered through reinforcement-learning optimization, automated red teaming, and expert human red teaming. Seven participants contribute 144 hours and 2,894 submitted strategies. Discovered attacks are replayed across the evaluated delivery channels.

In the pooled AgentDojo banking evaluation, an attack objective is counted as compromised if any discovered payload succeeds for that task–goal pair. The denominator is 45 pairs.

Source: Section 5.3, Table 2. ASR is attack success rate; pp denotes percentage points. These are pooled outcomes over discovered attacks, not the success rate of a single attack template.

The variation is operationally significant. A company deploying Claude Haiku 4.5 under comparable conditions might obtain substantial additional protection from rendering. The same architectural intervention provides almost no protection for Gemini 3.1 Flash Lite in this evaluation.

The authors also compare Pictionary with PromptLocate, DataSentinel, and DataFilter under three common automated-red-teaming templates. Pictionary records 3.6% DirectInject attack success for each of three tested victims, outperforming the reported alternatives. This is a comparison under shared attacks, however, not a demonstration that individually optimized attacks against every competing defense would produce the same ranking (Section 5.4, Table 3).

The practical result is therefore neither universal immunity nor a negligible formatting trick. The delivery channel can materially change attack success, but the effect must be established for the specific model and attacker conditions.

Reading an instruction is different from obeying it

Why should an image change the outcome when the words remain visible?

The authors investigate a modality gap: differences in how models respond to instructions delivered through text and images.

In a controlled experiment, they construct 21 pairs of mutually exclusive benign instructions. Across six models, textual instructions are between 2 and 300 times more likely to be followed than competing image-rendered instructions.

Crucially, the models show near-ceiling compliance when instructions are presented through either modality independently (Section 3, Figure 2).

This weakens the explanation that image rendering simply prevents the model from reading the malicious instruction. The model can often understand both. What changes is which instruction it tends to follow when competing commands are present.

The authors propose that instruction tuning contributes to this behavior. Text-centric post-training may encourage models to treat imperative text as actionable instructions, whereas images are more often processed as information to describe or interpret.

Two additional experiments probe that explanation.

First, comparisons across four base and instruction-tuned model pairs find larger increases in text-channel attack success than in image-channel success after instruction tuning. These checkpoint comparisons are suggestive but cannot isolate every difference introduced during post-training.

Second, the authors fine-tune three models using 12,379 verified examples of benign image-rendered instructions. Image-channel attack success subsequently increases by approximately 13–19 percentage points (Section 6.2, Figure 4).

No adversarial examples are required for this increase. Ordinary instruction-following training can alter the security-relevant behavior.

The intervention does not uniquely identify the original cause of the modality gap: it lacks a matched text-only fine-tuning control and complete post-training measurements of both channels. Nevertheless, it demonstrates that increased responsiveness to image instructions can weaken the defense.

For model developers and enterprise buyers, this creates a maintenance requirement. A multimodal capability upgrade or image-instruction fine-tuning run may change the effectiveness of an existing rendering layer even when the application code remains unchanged.

The model may ignore the attack and misread the account number

A defensive transformation must preserve enough information for the legitimate task.

The authors test this by rendering all tool outputs as paginated images in 100 SWE-bench Verified software-engineering instances and 164 tau-squared-Bench customer-service tasks.

Customer-service performance changes relatively little: success rates differ by 0.9–2.1 percentage points across three models.

Software-engineering results are less reassuring. Kimi-K2.6 remains at 65.0% task success, but GPT-5.4 mini falls from 66.0% to 56.0%, and Claude Haiku 4.5 from 66.0% to 57.0% (Section 5.5, Table 4).

The problem is not necessarily a failure to comprehend the broader task. Software editing frequently requires exact characters: function names, code symbols, or the precise existing text an edit must match.

The transcription diagnostics illustrate the difference. Claude Haiku 4.5 achieves 99.4% word-level accuracy on rendered AgentDojo content but only 92.7% byte-exact accuracy for critical words containing digits, @, or :// (Appendix D.2, Table 13). The study also observes more code-edit calls failing because their target anchors cannot be found.

For financial and operational agents, this suggests a similar risk around account identifiers, payment references, URLs, and other strings that cannot tolerate small transcription errors. That financial-workflow implication is an extrapolation from the measured fidelity failures, not a demonstrated payment-error rate.

Rendering also has a measurable serving cost. Across six evaluated configurations, episode-level API expenses increase by approximately 25.6–55.1% (Appendix D.3, Table 16). The increase depends on the model, workload, and pricing conditions.

A cheaper attack outcome is not automatically a cheaper reliable workflow.

Treat rendering as a measured control, not an authority rule

For Cognaptus, the deployment implication is to separate three questions that might otherwise be collapsed into one security score.

First, does the rendering layer reduce adversarial success for the selected model? Evaluate fixed attacks and attacks adapted to the image channel. Report the fraction of task–goal pairs compromised by any tested attack, while recognizing that a finite attack pool cannot establish a universal worst-case bound.

Second, does the workflow retain the information needed for correct execution? Evaluate semantic task completion separately from exact-character fidelity. Financial identifiers, destination addresses, and code-edit anchors should be checked against authoritative structured records before sensitive actions are executed.

Third, is the improvement worth the operational cost? Measure additional image processing, API expenses, latency, and task failures under the actual workload. Whole-channel rendering may be appropriate for document-heavy analysis yet unsuitable for an exact-match editing workflow without further controls.

There are also important coverage boundaries. Pictionary does not defend against malicious instructions already embedded in native images, screenshots, scanned documents, or GUI-agent views. Nor does it provide independent authorization for a tool call.

The evidence therefore favors placing rendering between lower-trust text sources and the agent, while retaining explicit permissions, action validation, and information-flow controls outside the model’s interpretation of that material.

The security benefit belongs to the model, not the image

Pictionary changes a fundamental assumption about prompt-injection defense. It shows that models may assign different behavioral weight to identical instructions depending on their delivery modality, allowing a relatively simple rendering step to reduce attacks without modifying model weights.

But that behavior is learned, uneven, and potentially mutable. The strongest adaptive results show substantial protection for some models and almost none for another. The utility experiments further show that reducing malicious instruction-following can introduce errors in legitimate execution.

The resulting deployment principle is conditional: render untrusted text where controlled tests demonstrate a worthwhile security gain, verify exact data before consequential actions, and preserve independent authorization throughout the workflow.

An image can change how an agent responds to an instruction. It cannot determine who had the authority to issue it.

Cognaptus: Automate the Present, Incubate the Future.