3.5 Multi-Modal Input Security

Description

Non-text inputs (images, audio, documents) MUST be scanned for embedded malicious content.

Rationale

Attackers can embed prompt injections in images and PDFs that are invisible to humans.

Audit Procedure

1. Identify multi-modal input types
2. Check for file type validation
3. Test with images containing embedded instructions

Remediation

1. Implement file type validation using magic bytes
2. Use image sanitization
3. Implement OCR scanning
4. Sandbox document processing

Framework Mappings