Multimodal prompt injection in financial document AI — bank statements, invoices, receipts

Four multimodal injection surfaces in financial document AI

1. Invoice processing AI with automated SWIFT/FedNow payment initiation. Automated accounts payable platforms (SAP Concur, Coupa, Tipalti, and custom AP automation built on AWS Textract or Azure Document Intelligence) extract payment details — vendor name, bank account number, routing code, invoice amount, payment reference — from supplier-submitted invoice images and feed extracted fields directly into payment initiation workflows for SWIFT wire transfers, ACH payments, or FedNow instant payments. An adversarially crafted invoice image — a legitimate invoice photo with typographic injection text printed at low opacity in the invoice reference field or embedded in the bank details section — can cause the VLM extraction step to return attacker-specified account numbers alongside the genuine invoice data. If the payment automation pipeline applies straight-through processing (STP) for invoices below a certain amount threshold (a common pattern to reduce manual approval overhead), adversarially modified payment details can initiate a real transfer to attacker-controlled accounts before any human reviews the extracted fields. Business Email Compromise (BEC) fraud uses social engineering to modify payment instructions before an invoice reaches an AP system; adversarial invoice images achieve the same outcome by modifying the payment instructions within the invoice image itself — bypassing the email security controls that BEC defences address. The Glyphward scan gate applied to every invoice image at upload time blocks adversarially crafted invoices before the extraction step runs.

2. Bank statement and financial document analysis in mortgage and loan underwriting AI. Mortgage origination platforms (Blend, ICE Mortgage Technology, and custom underwriting workflows built on document AI APIs) use VLMs and OCR engines to analyse bank statement images submitted by loan applicants — extracting account balances, regular deposit patterns, recurring payment obligations, and cash flow summaries to feed automated underwriting models. When loan applicants submit bank statement images, those images are external user-submitted content. An adversarially crafted bank statement image can inject instructions that cause the extraction model to return inflated balance figures, omit identified debt obligations, or generate a summary of financial health that does not match the actual statement content. Unlike invoice payment injection (where the goal is to redirect a real transfer), bank statement injection targets the underwriting decision — the adversarial payload is designed to improve the extracted financial profile of a borrower who would otherwise fail the underwriting criteria. This is AI-enabled loan fraud. Financial institutions relying on automated document AI for underwriting without an adversarial image detection layer have a structural fraud vulnerability in their origination pipeline. The Glyphward scan applied to each bank statement image before it enters the document extraction step catches adversarially manipulated images before their extracted data influences any credit decision.

3. Expense receipt OCR in employee reimbursement and T&E automation platforms. T&E automation platforms (Expensify, Concur, Ramp, Brex AI, and enterprise expense apps built on mobile OCR SDKs) accept employee-submitted receipt images and use OCR and VLM extraction to capture merchant name, date, amount, and category for automatic reimbursement processing. The adversarial surface here is the submitting employee — or an attacker who has compromised an employee's expense submission workflow. An adversarially crafted receipt image — a genuine receipt photograph with typographic injection text added at low opacity in the itemised list section — can cause the OCR extraction to return a higher amount than what appears in the real receipt amount field, add fictitious line items not present on the original receipt, or alter the merchant category classification (changing "coffee shop" to a higher-limit "business meal" category). For platforms with automated approval for small amounts or for specific expense categories, adversarially inflated receipt data can result in larger reimbursements than warranted without triggering an approval workflow. Expense audit systems typically compare the submitted image to the extracted data — if the adversarial text is invisible to a human reviewer examining the image, the audit check (does the extracted amount match what I see on the receipt?) will pass. The Glyphward scan added to the receipt image upload API before extraction detects adversarially crafted receipt images that a human auditor would not catch.

4. Cheque image processing and remote deposit capture in banking platforms. Remote deposit capture (RDC) systems — both consumer mobile deposit apps and business RDC platforms — accept cheque images submitted by customers or business clients and use OCR and image analysis to extract payee name, amount (numeric MICR line and written words line), and routing/account data from the cheque image. Adversarially crafted cheque images can exploit the dual-encoding of the amount field (MICR line and written words) by injecting instructions into the image that cause the OCR extraction model to resolve any discrepancy between the two amount representations in the attacker's favour, or to extract an inflated amount from an adversarially modified cheque image. In high-volume RDC processing environments where large numbers of cheques are processed with automated clearing and no per-item human review below a threshold, adversarial cheque image manipulation is a scalable fraud vector. RDC fraud detection systems typically rely on statistical anomaly detection on amounts (is this significantly higher than this customer's typical deposit amount?) and MICR line validation — they do not scan cheque images for adversarial pixel-level manipulations. The Glyphward pre-scan gate applied before the RDC image processing pipeline catches adversarially structured cheque images before any amount extraction or clearing decision is made.

Integration: financial document ingestion API with Glyphward pre-scan

import base64
import hashlib
import requests
from datetime import datetime, timezone

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65

def ingest_financial_document(
    image_bytes: bytes,
    document_type: str,  # "invoice" | "bank_statement" | "receipt" | "cheque"
    submitter_id: str,
    correlation_id: str,
) -> dict:
    """
    Financial document ingestion with Glyphward pre-scan gate.
    Returns scan audit record; raises on adversarial detection.

    The scan record must be persisted to the audit trail alongside
    the extracted document data for compliance audit requirements.
    """
    encoded = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    scan_resp = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )

    audit_record = {
        "correlation_id": correlation_id,
        "document_type": document_type,
        "submitter_id": submitter_id,
        "image_sha256": image_hash,
        "scanned_at": datetime.now(timezone.utc).isoformat(),
        "scan_status": None,
        "scan_id": None,
        "scan_score": None,
    }

    if scan_resp.status_code != 200:
        # Fail-closed: scan unavailability -> hold for manual review, not auto-process
        audit_record["scan_status"] = "error_held_for_review"
        persist_audit_record(audit_record)
        raise RuntimeError(
            f"Glyphward scan unavailable for {document_type} {correlation_id} — "
            f"document held for manual processing"
        )

    scan = scan_resp.json()
    audit_record["scan_id"] = scan["scan_id"]
    audit_record["scan_score"] = scan["score"]

    if scan["score"] >= GLYPHWARD_THRESHOLD:
        audit_record["scan_status"] = "adversarial_blocked"
        persist_audit_record(audit_record)
        # Alert fraud/compliance team for high-severity document types
        if document_type in ("invoice", "bank_statement", "cheque"):
            trigger_fraud_alert(submitter_id, document_type, scan["scan_id"], scan["score"])
        raise ValueError(
            f"Adversarial {document_type} blocked: submitter={submitter_id} "
            f"score={scan['score']} scan_id={scan['scan_id']}"
        )

    audit_record["scan_status"] = "clean_passed"
    persist_audit_record(audit_record)
    return audit_record

def persist_audit_record(record: dict):
    # Write to immutable audit log (append-only database table or WORM storage)
    pass

def trigger_fraud_alert(submitter_id: str, doc_type: str, scan_id: str, score: float):
    # Alert fraud operations team; consider account suspension workflow
    pass

Persist every audit_record to an append-only audit table (PostgreSQL with a write-only service role, or AWS S3 with Object Lock WORM configuration) alongside the extracted financial data. The scan_id from Glyphward serves as a cryptographic reference proving that the document was adversarial-content-checked at a specific timestamp before extraction ran — this is the audit evidence required under SOX IT general controls for automated financial data processing. For mortgage and lending workflows, attach the audit_record to the loan origination file as a processing artefact; for AP automation, attach it to the payment record. Get early access

Coverage matrix

Related questions

Further reading

• Snowflake Cortex AI prompt injection — Cortex Document AI and LLM function injection via financial document images
• OWASP LLM09 Misinformation — multimodal dimension — financial data extraction as a high-risk LLM09 context
• OWASP LLM01 Prompt Injection — multimodal dimension — the base injection mechanism in financial document image pipelines
• SOC 2 AI security controls — mapping Glyphward document scan gates to SOC 2 Trust Services Criteria
• SOX compliance and AI security — SOX Section 404 IT general controls for financial document AI pipelines
• Multimodal AI security checklist — complete review for financial document AI deployments
• Glyphward API free tier — scan financial document images today at no cost