Prompt injection in criminal justice and forensic AI

Four adversarial injection surfaces in criminal justice and forensic AI

1. Forensic evidence photograph AI injection (Veritone AI, Palantir Gotham AI, forensic laboratory AI)

Forensic evidence photograph AI processes images of crime scene physical evidence including fingerprint lift photographs, latent impression comparison images, tool mark evidence photographs, trace evidence macro-photography, bloodstain pattern analysis photographs, and digital forensic exhibit screenshots submitted through AI-assisted forensic evidence management, classification, and investigative workflow tools that extract physical evidence type classifications, condition quality grades, comparison match confidence scores, and chain-of-custody flag values from forensic evidence photograph inputs, generating forensic examination priority assignments, evidence classification records, and comparison result documentation that forms the documentary evidentiary foundation of criminal prosecution case preparation. Veritone AI processes crime scene evidence video and photographic files through AI-assisted media analysis, evidence tagging, and investigative workflow management tools at law enforcement agencies and district attorney offices. Palantir Gotham AI processes forensic investigation data and associated photographic evidence through AI-assisted investigative link analysis and case management tools at federal law enforcement agencies including FBI field offices, US Attorney offices, and Department of Homeland Security investigative units. Digital forensic AI tools — including Cellebrite AI, Magnet Forensics AI, and Axiom AI — process mobile device screen capture screenshots and digital exhibit image files through AI-assisted digital forensic examination and evidence extraction tools at law enforcement digital forensic laboratories.

The adversarial injection surface is the forensic evidence photograph, latent fingerprint comparison image, and digital exhibit screenshot submission pathway: forensic evidence photographs and comparison images submitted through Veritone AI, Palantir Gotham AI, or digital forensic AI tools for AI physical evidence type classification, comparison match quality assessment, and forensic examination priority assignment. An adversarially crafted forensic evidence photograph — in which pixel perturbations applied to a latent fingerprint ridge detail region, tool mark striation pattern, or trace evidence macro-photograph cause the AI to misclassify the evidence type, downgrade the comparison quality score, or suppress a physical evidence match flag that would otherwise link crime scene evidence to a suspect — can alter the AI-generated forensic evidence classification record in the law enforcement case management system, potentially causing the AI-assisted investigative workflow to deprioritise a forensic examination that the adversarially manipulated evidence classification incorrectly categorises as lower-priority or comparison-insufficient. Alternatively, an adversarially crafted forensic evidence photograph can cause the AI to generate a false positive match flag, directing investigative attention toward an incorrect suspect on the basis of AI-generated forensic comparison metadata that was produced by adversarial manipulation rather than genuine forensic evidence comparison.

The constitutional and statutory consequences of adversarially manipulated forensic evidence AI span Brady v. Maryland disclosure obligations, Federal Rules of Evidence expert witness admissibility, and criminal evidence tampering law dimensions. Brady v. Maryland (373 US 83, 1963) and its progeny — Giglio v. United States (405 US 150, 1972), Strickler v. Greene (527 US 263, 1999) — impose constitutional due process obligations on prosecutors to disclose all material exculpatory evidence to criminal defendants; adversarially manipulated forensic AI classification records that suppress a forensic comparison match or misclassify physical evidence in ways material to the defence constitute Brady material whose non-disclosure (whether through prosecutorial knowledge or not) creates constitutional due process violation with dismissal or reversal consequence. FRE 702 (Expert Testimony) and Daubert v. Merrell Dow Pharmaceuticals (509 US 579, 1993) require that expert forensic testimony based on AI-assisted examination results satisfy reliability and methodology standards; adversarial manipulation of forensic AI inputs that compromises the reliability of AI-generated forensic examination outputs creates FRE 702 Daubert admissibility challenges affecting the evidentiary foundation of expert witness testimony. 18 USC § 1519 (Destruction, alteration, or falsification of records in Federal investigations) imposes criminal liability for knowingly altering or falsifying any record used in a federal investigation; adversarial manipulation of forensic AI inputs that alters AI-generated forensic examination records used in federal criminal investigations may constitute a § 1519 felony with up to 20 years imprisonment. Threshold: 60 for forensic evidence photograph AI, reflecting constitutional due process and evidentiary integrity dimensions.

2. Facial recognition probe image AI injection (NEC NeoFace AI, Clearview AI, Cognitec AI)

Facial recognition probe image AI processes facial photographs extracted from crime scene surveillance camera frames, social media profile images, arrest booking photographs, and investigative surveillance images submitted through AI-assisted facial recognition identification search interfaces that match probe facial photographs against facial image databases containing booking photographs, driver licence images, passport images, and publicly scraped social media profile photographs, generating candidate identification lists ranked by AI facial similarity score that investigators use to identify criminal suspects from crime scene surveillance imagery. NEC NeoFace AI processes facial probe photographs through AI-assisted one-to-many facial recognition search tools deployed at law enforcement agencies across more than 70 countries, including the FBI Next Generation Identification system and state police criminal justice information system deployments at law enforcement agencies across the US, UK, and EU. Clearview AI processes facial probe images submitted by law enforcement investigators through AI-assisted facial recognition search tools that query its database of more than 50 billion publicly sourced facial images, generating candidate identification lists used by approximately 3,000 law enforcement agencies across the US, Canada, and UK. Cognitec AI processes facial probe images through one-to-one facial verification and one-to-many facial identification search tools deployed at border control agencies, national police forces, and law enforcement agencies across Europe.

The adversarial injection surface is the facial recognition probe photograph submission pathway: crime scene surveillance image crops, social media facial image extractions, and investigative facial photographs submitted through NEC NeoFace AI, Clearview AI, or Cognitec AI facial recognition search interfaces for AI one-to-many facial similarity search and candidate identification list generation. An adversarially crafted facial recognition probe image — in which pixel perturbations imperceptible to human examiners applied to facial feature regions cause the facial recognition AI to match the probe image against an incorrect facial database entry, generating a false candidate identification for an individual who does not match the actual crime scene subject — can cause the AI-generated candidate identification list to surface an incorrect suspect as the top-ranked facial similarity match, directing law enforcement investigative resources and potential arrest activity toward an innocent individual on the basis of a false AI-generated facial identification. Conversely, adversarial perturbations can suppress the genuine match score for the actual crime scene subject, causing the actual perpetrator’s facial database entry to fall below the threshold at which investigators would pursue the candidate identification.

The constitutional and privacy law consequences of adversarially manipulated facial recognition AI span Fourth Amendment search and seizure, 42 USC § 1983 civil rights, and state biometric privacy law dimensions. Fourth Amendment unreasonable seizure doctrine requires that arrests be supported by probable cause; a warrantless arrest based on an adversarially generated false AI facial recognition candidate identification — without independent corroborating evidence beyond the AI-generated facial match — creates Fourth Amendment unreasonable seizure liability under 42 USC § 1983 with the wrongfully arrested individual entitled to compensatory and potentially punitive damages against the arresting officer and municipal government. Multiple federal civil rights settlements for wrongful arrests based on facial recognition misidentification — including Robert Williams (Detroit, 2023), Nijeer Parks (New Jersey, 2023), and Michael Oliver (Michigan, 2023) — have established significant municipal civil rights liability exposure; adversarial manipulation of facial recognition AI that generates additional wrongful identification events creates additional 42 USC § 1983 civil rights liability exposure for municipalities. Illinois Biometric Information Privacy Act (BIPA) 740 ILCS 14 prohibits the collection and use of biometric identifiers including facial geometry without informed written consent from Illinois residents; adversarial manipulation of Clearview AI facial recognition probe searches involving Illinois residents’ facial data creates BIPA private right of action exposure with $1,000–5,000 per violation statutory damages. GDPR Article 9 categorises biometric data used for unique identification as a special category subject to heightened processing restrictions; adversarial manipulation of facial recognition AI processing involving EU data subjects’ facial biometric data creates GDPR Article 9 violation exposure. Threshold: 60 for facial recognition probe image AI.

3. Gunshot detection camera AI injection (ShotSpotter AI, Motorola CommandCentral AI)

Gunshot detection camera AI processes images from acoustic-optical sensor fusion systems — combining acoustic gunshot sensor event detection with associated fixed-position surveillance camera image captures of the suspected gunshot location — submitted through AI-assisted gunshot incident confirmation and emergency dispatch alert tools that extract confirmed-gunshot classification values, shooter location probability maps, and incident severity assessments from acoustic event and camera image inputs, generating emergency dispatch alerts and patrol officer response priority assignments that determine whether patrol officers are immediately dispatched to the detected gunshot location and in what tactical configuration. ShotSpotter AI (SoundThinking) processes acoustic gunshot sensor event signals and paired surveillance camera image frames through AI-assisted gunshot incident confirmation tools at law enforcement agencies in more than 150 US cities, with AI-confirmed gunshot incidents generating immediate PSAP dispatch alerts that send patrol officers to active shooter locations without requiring a civilian 911 call. Motorola Solutions CommandCentral AI integrates gunshot detection data from acoustic sensor networks with paired surveillance camera image processing through AI-assisted emergency communications and incident confirmation tools at law enforcement agencies using integrated public safety communications platforms.

The adversarial injection surface is the surveillance camera image frame submission pathway: fixed-position surveillance camera images paired with acoustic gunshot sensor event detections submitted through ShotSpotter AI or Motorola CommandCentral AI gunshot incident confirmation interfaces for AI scene classification, shooter location probability assessment, and confirmed-gunshot determination. An adversarially crafted surveillance camera image — in which pixel perturbations applied to the muzzle flash indicator region, human figure presence detection area, or environmental scene features on a fixed-position surveillance camera frame cause the AI to classify an acoustic gunshot sensor event as a non-gunshot noise (firework, vehicle backfire, or industrial sound) when the paired camera frame documents an active shooting incident — can suppress the AI-confirmed gunshot alert that would otherwise generate immediate PSAP emergency dispatch of armed patrol officers, delaying first responder arrival to an active shooting incident during the period between adversarial camera image submission and the next acoustic sensor event that triggers a new AI confirmation cycle. In urban environments where ShotSpotter AI provides the primary detection mechanism for gunshot incidents in areas with historically low civilian 911 reporting rates for gunfire, adversarial suppression of a gunshot confirmation alert can extend the interval before first responder arrival from the sub-minute ShotSpotter alert response window to the multiple-minute civilian 911 call response window.

The regulatory and liability consequences of adversarially suppressed gunshot detection AI span law enforcement officer safety duties and public safety negligence liability dimensions. Law enforcement agency duty-of-care obligations to the public for emergency response — arising under state public safety statutes and common law negligence doctrine, within the limitations established by DeShaney v. Winnebago County (489 US 189, 1989) and its progeny — create potential governmental liability exposure for gunshot detection system failures that delay first responder arrival to active shooting incidents where harm results from the delayed response. OSHA General Industry Standards 29 CFR Part 1910.38 (Emergency Action Plans) and law enforcement department policy obligations for officer safety incident notification create officer safety duty-of-care concerns when adversarial gunshot detection AI suppression delays the armed patrol officer response that provides perimeter control and protection for potential victims at active shooter incidents. Threshold: 55 for gunshot detection camera AI, reflecting first responder safety and public safety dimensions.

4. eDiscovery document image AI injection (Relativity AI, Nuix AI, Everlaw AI)

eDiscovery document image AI processes scanned paper document photographs, email screenshot images, digitised business record photographs, and digital document screenshot files submitted through AI-assisted electronically stored information (ESI) review, privilege logging, responsiveness determination, and production set compilation tools that extract document content classifications, privilege marker identifications, responsiveness determinations, and confidentiality designations from document image inputs, generating privilege log entries, production set inclusion/exclusion determinations, and responsive document classifications that govern litigation discovery production obligations under Federal Rules of Civil Procedure and state discovery rules. Relativity AI processes eDiscovery document image files through AI-assisted document review, privilege determination, and predictive coding tools deployed at Am Law 200 law firms, AmLaw 100 corporate legal departments, and federal and state government agencies across more than 40 countries for civil litigation, regulatory investigation, and government enforcement matter document review. Nuix AI processes scanned document images and digital exhibit files through AI-assisted forensic data collection, processing, and review tools at law enforcement digital forensic laboratories, regulatory agencies, and corporate investigation teams. Everlaw AI processes civil litigation document image files through AI-assisted review and production tools at litigation boutique law firms and corporate legal departments.

The adversarial injection surface is the scanned paper document photograph, email screenshot, and digital exhibit image file submission pathway: document images submitted through Relativity AI, Nuix AI, or Everlaw AI eDiscovery review interfaces for AI privilege determination, responsiveness classification, and production set inclusion determination. An adversarially crafted eDiscovery document image — in which pixel perturbations applied to the attorney-client communication header region, work product privilege marker, or responsive keyword occurrence on a scanned document photograph cause the AI to classify a privileged document as non-privileged and responsive when the actual document contains protected attorney-client communication that should be logged as privilege and withheld from production — can cause inadvertent production of privileged documents to adverse parties in civil litigation or government regulatory investigations, triggering attorney-client privilege waiver analysis and Federal Rules of Civil Procedure Rule 26(b)(5)(B) clawback procedure obligations. Conversely, adversarial perturbations can suppress the responsiveness classification of actually responsive documents, causing them to be excluded from production in violation of Federal Rules of Civil Procedure Rule 34 production obligations.

The sanctions and liability consequences of adversarially manipulated eDiscovery document AI span Federal Rules of Civil Procedure Rule 37 discovery sanctions, attorney-client privilege waiver doctrine, and federal obstruction of justice dimensions. FRCP Rule 37(e) (Failure to Preserve Electronically Stored Information) authorises courts to impose severe sanctions — including adverse inference instructions, issue preclusion, and case-terminating sanctions — for failure to preserve or produce relevant ESI; adversarial manipulation of eDiscovery AI that causes non-production of responsive documents constitutes a failure to produce responsive ESI with Rule 37 sanctions exposure. FRCP Rule 26(b)(5)(A) requires a privilege log entry for each document withheld from production on privilege grounds; adversarial AI manipulation that causes inadvertent production of privileged documents triggers Rule 26(b)(5)(B) clawback procedures and subject matter waiver analysis under FRE 502 that may result in broader privilege waiver affecting related communications. 18 USC § 1512 (Tampering with a witness, victim, or informant) imposes criminal liability for corruptly altering, concealing, or destroying a record with intent to impair its integrity or availability for use in an official proceeding; adversarial manipulation of eDiscovery document AI inputs that alters the production classification of documents in federal criminal investigation productions may constitute a § 1512 offense. Threshold: 60 for eDiscovery document image AI, reflecting privilege waiver, constitutional rights, and obstruction of justice dimensions.

Integration: criminal justice and forensic AI image ingestion with Glyphward pre-scan

Criminal justice and forensic AI image ingestion flows from forensic evidence photograph channels, facial recognition probe submission interfaces, gunshot detection camera APIs, and eDiscovery document image upload portals into forensic examination AI, facial identification AI, incident confirmation AI, and document review AI pipelines. Insert Glyphward’s pre-scan at the ingestion boundary before AI-generated output is committed to forensic case records, facial identification candidate lists, dispatch alert systems, or discovery production sets:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Criminal justice & forensic AI — Brady v. Maryland, 18 USC §1519,
# 42 USC §1983, BIPA 740 ILCS 14, GDPR Article 9, FRE 702, FRCP Rule 37.
# False forensic misclassification, wrongful facial ID, gunshot suppression,
# and eDiscovery privilege waiver create criminal and civil liability.
THRESHOLD_BIOMETRIC_EDISCOVERY = 60  # facial recognition, forensic, eDiscovery
THRESHOLD_GUNSHOT_DETECTION    = 55  # gunshot detection (public safety)


class ForensicAIContext(str, Enum):
    FORENSIC_EVIDENCE    = "forensic_evidence"    # Veritone, Palantir Gotham, Cellebrite
    FACIAL_RECOGNITION   = "facial_recognition"   # NEC NeoFace, Clearview, Cognitec
    GUNSHOT_DETECTION    = "gunshot_detection"     # ShotSpotter, Motorola CommandCentral
    EDISCOVERY_DOCUMENT  = "ediscovery_document"   # Relativity, Nuix, Everlaw


def threshold_for(context: ForensicAIContext) -> int:
    if context == ForensicAIContext.GUNSHOT_DETECTION:
        return THRESHOLD_GUNSHOT_DETECTION
    return THRESHOLD_BIOMETRIC_EDISCOVERY


async def scan_forensic_ai_image(
    image_path: str | Path,
    context: ForensicAIContext,
    agency_id_hash: str,     # SHA-256 of law enforcement agency / law firm identifier
    case_ref: str,           # e.g. "CASE-2026-44721", "PROBE-NNF-2026-Q2", "EDX-MTR-4410"
    exhibit_hash: str,       # SHA-256 of exhibit / document identifier
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a criminal justice or forensic AI image for adversarial injection payloads
    before forwarding to forensic examination, facial identification, gunshot
    detection, or eDiscovery document review AI systems.

    Raises AdversarialForensicAIImageError if score meets threshold:
      - FORENSIC_EVIDENCE:   threshold 60; Brady v. Maryland; 18 USC §1519
                             (evidence tampering); FRE 702 expert admissibility
      - FACIAL_RECOGNITION:  threshold 60; 42 USC §1983 wrongful arrest; BIPA
                             740 ILCS 14; GDPR Article 9 biometric data
      - GUNSHOT_DETECTION:   threshold 55; officer safety; public safety duty-of-care
      - EDISCOVERY_DOCUMENT: threshold 60; FRCP Rule 37 sanctions; FRE 502
                             privilege waiver; 18 USC §1512 obstruction
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64   = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    client_scan_id = str(uuid.uuid4())
    threshold = threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "forensic_context":  context.value,
                "agency_id_hash":    agency_id_hash,
                "case_ref":          case_ref,
                "exhibit_hash":      exhibit_hash,
                "client_scan_id":    client_scan_id,
                "image_sha256":      image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "agency_id_hash":    agency_id_hash,
        "case_ref":          case_ref,
        "exhibit_hash":      exhibit_hash,
        "forensic_context":  context.value,
        "scan_id":           result["scan_id"],
        "client_scan_id":    client_scan_id,
        "image_sha256":      image_sha256,
        "score":             result["score"],
        "flagged_region":    result.get("flagged_region"),
        "threshold":         threshold,
        "action":            "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_forensic_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialForensicAIImageError(
            f"Forensic AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"agency={agency_id_hash} case={case_ref}"
        )
    return result


async def write_forensic_audit_record(record: dict) -> None:
    """Persist audit record to agency evidence integrity audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialForensicAIImageError(Exception):
    """Raised when a criminal justice or forensic AI image exceeds the adversarial injection threshold."""
    pass

Call scan_forensic_ai_image() with ForensicAIContext.FORENSIC_EVIDENCE before forwarding forensic evidence photographs to Veritone AI, Palantir Gotham AI, or Cellebrite digital forensic AI tools — preserving image_sha256 as the forensic anchor for Brady v. Maryland exculpatory evidence chain-of-custody documentation and FRE 702 expert witness reliability audit. Call with ForensicAIContext.FACIAL_RECOGNITION for NEC NeoFace AI or Clearview AI facial probe images before AI one-to-many search, using case_ref for 42 USC § 1983 civil rights litigation evidence documentation and agency_id_hash for BIPA and GDPR Article 9 biometric data processing audit trail purposes. Call with ForensicAIContext.GUNSHOT_DETECTION for ShotSpotter AI camera frames before AI confirmed-gunshot determination, with exhibit_hash linking to the specific acoustic sensor event record for dispatch audit trail documentation. Call with ForensicAIContext.EDISCOVERY_DOCUMENT for Relativity AI or Nuix AI document image files before AI privilege and responsiveness classification, preserving the Glyphward scan_id as evidence of technical control at the document ingestion boundary for FRCP Rule 37 sanctions defence and FRE 502 privilege waiver clawback proceedings. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four criminal justice and forensic AI injection surfaces; covers how adversarial pixel-level perturbations cause AI misclassification without detectable visual artifacts at human review resolution.
• Vision-language model security — technical architecture of adversarial image attacks against vision-language models including pixel perturbation classes applicable to forensic evidence photograph manipulation and facial recognition probe injection.
• CCTV and physical security AI prompt injection — surveillance camera AI injection context covering the adversarial attack patterns applicable to gunshot detection camera image manipulation and facial recognition surveillance frame injection.
• Legal technology AI prompt injection — legal AI injection covering the broader class of legal document AI manipulation applicable to eDiscovery document image injection and privilege determination manipulation.
• Free tier — 10 scans/day, no card required — start scanning criminal justice and forensic AI images at development volumes before committing to a production plan.