Prompt injection in government and border control AI

Four adversarial injection surfaces in government identity and border control AI

1. Passport scan adversarial injection (Idemia MorphoReader, Thales Cogent, Vision-Box Orchestra ABC)

Border control AI at international airports and land border crossings processes e-passport biodata page photographs and Machine Readable Zone (MRZ) scans submitted through optical document scanners as the first stage of identity verification in the traveller clearance workflow. The MRZ — standardised under ICAO Document 9303, Part 3, Machine Readable Official Travel Documents — consists of two lines of 44 OCR-B font characters each, encoding the holder’s surname and given name, document number, nationality code (ISO 3166-1 alpha-3), date of birth (YYMMDD), sex, document expiry date, optional data field, and check digits computed from each field using a modulo-97 algorithm. The Idemia Smart Identity MorphoReader, Thales Digital Identity Cogent Systems, and Vision-Box Orchestra ABC gate all process the MRZ using AI-assisted OCR models trained on OCR-B character sets with tolerance for scanner resolution degradation, ink variation, and document wear — models that produce a parsed MRZ data structure that is then transmitted to the immigration authority’s APIS (Advance Passenger Information System) for pre-clearance or border alert database lookup.

The APIS system receives the AI-parsed MRZ fields and queries the host country’s border watchlist database — US CBP Automated Targeting System (ATS), UK Border Force National Border Targeting Centre (NBTC), Schengen Information System (SIS II), INTERPOL Stolen and Lost Travel Documents (SLTD) database — using the document number, nationality, and date of birth as primary lookup keys. A watchlist hit against a Red Notice, Green Notice, or border alert record requires the document number, nationality, and date of birth to match the watchlist record within the APIS system’s matching tolerance. At international airports processing volumes — Heathrow processes approximately 80 million passengers annually; Dubai International processes approximately 90 million; Singapore Changi processes approximately 58 million — the document scanning AI is the authoritative source of the APIS data record for every arriving international passenger.

An adversarially crafted passport biodata page image — in which pixel perturbations in the MRZ character region cause the Idemia or Thales MRZ AI to misread a single character of the document number, transpose a digit in the nationality code, or shift the date-of-birth field by one day — causes the APIS record to be populated with an incorrect identifier. The perturbation does not need to visually change the MRZ; a pixel-level adversarial attack applies imperceptible changes to the image in the frequency domain that shift the AI’s character classification probability distribution without altering the luminance values observable to a human reviewer comparing the AI output to the printed document. The consequence of an AI-introduced MRZ misread is not flagged at the scanner — the scanner confirms a successful read and passes the parsed data downstream — because the check digit validation in the ICAO MRZ standard validates the arithmetic relationship between the check digit and the field value as read, not the relationship between the read value and the chip data. If the adversarial attack introduces an MRZ misread that happens to produce a valid check digit combination (which is achievable with careful perturbation construction given that the check digit is a single modulo-97 character), the parsed MRZ will pass the check digit validation while containing incorrect field values.

The adversarial motive for passport MRZ injection includes watchlist bypass by sanctioned individuals subject to INTERPOL Red Notices or national border alerts — where a document number misread of a single digit causes the APIS database query to return no match for a record that would otherwise trigger a border hold; identity spoofing causing the traveller’s APIS record to partially match a different individual’s identity (incorrect nationality causing routing to the wrong clearance lane or watchlist database); and human trafficking document fraud where traffickers use adversarially modified victim passport photographs to create identity confusion in the APIS system. ICAO Document 9303 is binding on all 196 ICAO member states under the Chicago Convention framework; violation of the integrity of the MRZ reading process engages national security and immigration enforcement obligations across all member state jurisdictions. Vision-Box Orchestra’s ABC gate systems are deployed at over 100 airports including Lisbon, Amsterdam Schiphol, Singapore Changi, and Dubai International; Idemia MorphoReader is deployed at US CBP ports of entry and European Schengen external borders; Thales Cogent systems are deployed at UK Border Force e-gates and Australian Department of Home Affairs SmartGate systems. The aggregate scale means that a systematic adversarial attack on passport scan AI affects a security-critical layer of global border management infrastructure. Glyphward’s pre-scan applied at the document image ingestion boundary — before the image reaches the MRZ OCR AI model — detects adversarially perturbed passport biodata page images and raises an AdversarialBorderControlImageError before the corrupted MRZ parse reaches the APIS transmission layer. Threshold: 50 (national security and immigration enforcement).

2. Biometric border control AI adversarial enrolment injection (CLEAR, SITA ABC, NEC NeoFace, Cognitec FaceVACS-Entry)

Automated Border Control (ABC) gates and trusted traveller programmes process face images at two distinct points in the identity verification lifecycle: the biometric enrolment phase — in which a traveller submits photographs through a digital onboarding application — and the gate verification phase — in which a live-capture camera image at the ABC gate is compared against the stored biometric template to perform either a 1:1 (verification: does this face match the enrolled template?) or 1:N (identification: who is this face?) matching operation. The adversarial injection surface at enrolment is structurally different from the adversarial injection surface at verification; this section addresses the enrolment injection vector, which has compounding consequences because a corrupted enrolment template affects all future verification events using that template until re-enrolment.

CLEAR’s Known Traveller identity programme — which provides biometric identity verification for TSA PreCheck lanes at over 50 US airports, stadium and venue access at major US sports facilities, and Known Traveller Number (KTN) integration with the TSA PreCheck programme — processes biometric enrolment photographs submitted by travellers through CLEAR’s iOS and Android onboarding application. The enrolment workflow accepts face photographs captured through the CLEAR app or uploaded from the device photo library, combined with identity document photographs (driver’s licence, passport), and processed through NEC NeoFace or Cognitec FaceVACS-class facial recognition AI to generate a biometric template — a mathematical representation of the facial geometry derived from the enrolment photograph — stored in the CLEAR database and associated with the traveller’s Known Traveller account. SITA’s Automated Border Control system and NEC NeoFace Watch, deployed at international ABC gates including those operated by the UK Home Office, US CBP Global Entry kiosks, and Asia-Pacific border management authorities, process both face capture and biometric template generation using NIST FRVT-evaluated face recognition engines.

NIST FRVT (Face Recognition Vendor Testing) — the US government’s authoritative evaluation programme for face recognition accuracy, published by NIST PSCR (Public Safety Communications Research) — establishes performance benchmarks for border control face recognition deployment. NIST FRVT 1:1 verification results require leading vendors (NEC, Cognitec, Idemia, Thales) to achieve a False Non-Match Rate (FNMR) ↣ 0.1% at a False Match Rate (FMR) of 0.01%. These benchmarks are established on unperturbed enrolment photographs. An adversarially crafted enrolment photograph — in which pixel perturbations applied to the face image region before submission to the CLEAR onboarding API or SITA enrolment system cause the NEC NeoFace or Cognitec FaceVACS feature extractor to generate a corrupted biometric template — can degrade FNMR for the targeted individual to values orders of magnitude higher than the NIST FRVT benchmark, causing the traveller to be systematically unable to pass ABC gate face verification using that enrolment until re-enrolment is completed.

The more sophisticated adversarial attack constructs a perturbed enrolment photograph such that the generated biometric template is deliberately similar — within the FMR matching threshold — to the template of a different known individual whose biometric template is present in the border control database. This is the adversarial identity confusion attack: by controlling the enrolment photograph’s pixel values, the attacker causes the face recognition AI to generate a template that belongs — from the matcher’s perspective — to a different individual, enabling ABC gate verification to succeed for the wrong person in subsequent 1:1 verification events. The enrolment injection attack is submitted through the photograph upload API of the traveller onboarding workflow, which accepts JPEG and PNG images from mobile device cameras or photo libraries without adversarial content validation. The attack requires no physical access to the ABC gate hardware; it is executed entirely through the authenticated enrolment API. GDPR Article 9 classifies biometric data processed for the purpose of uniquely identifying natural persons as a special category of personal data requiring explicit consent and heightened processing justification; corruption of the biometric template through adversarial enrolment injection constitutes a data integrity violation under Article 5(1)(d) (accuracy principle) as well as a potential breach notification obligation under Article 33 if the corruption is discovered. At the scale of CLEAR’s 20 million enrolled members, systematic adversarial enrolment injection creates both a national security threat and a mass biometric data integrity incident. Glyphward’s pre-scan applied to enrolment photograph submissions before they reach the face recognition feature extractor detects adversarially perturbed face images and raises an AdversarialBorderControlImageError before the corrupted template is written to the biometric database. Threshold: 50 (biometric data integrity, national security).

3. Visa application document AI injection (Thomson Reuters CLEAR AI, IBM Verify)

Consular visa application processing for tourist, work, student, and family reunification visa categories requires applicants to submit collections of supporting documents — bank statements, employer letters, accommodation booking confirmations, travel itineraries, sponsor identity documents, payslips, tax returns, business registration certificates, educational transcripts, and proof of ties to the home country — through online visa application portals operated by consulates, commercial visa processing centres (VFS Global, TLScontact), and national immigration agencies. The documents are submitted as scanned JPEG or PDF images and processed by AI classification systems that assess document authenticity, consistency between declared application data and supporting evidence, financial sufficiency relative to visa category requirements, and risk scoring for visa fraud indicators.

The visa processing AI platforms that operate in this environment include Thomson Reuters CLEAR AI (used by US law enforcement and immigration enforcement agencies for entity resolution and document classification), IBM Verify (successor to IBM Security Identity Governance, used for document authenticity and identity proofing in government workflows), and SAS Government Analytics (used by European immigration authorities for visa application risk scoring). The US Embassy Global Visa Processing System (GVPS) processes non-immigrant visa applications for all US consular posts globally; the UK Visas and Immigration Atlas system processes visa applications for the UK Home Office; Schengen visa processing systems at VFS Global and TLScontact processing centres process applications for Schengen Area member states. Each system accepts uploaded document images from applicants and processes them through AI models that perform document authenticity classification (is this a genuine bank statement, or a digitally fabricated one?), consistency scoring (does the declared monthly income on the application form align with the bank balance trajectory visible in the submitted statement?), and fraud indicator detection (does the statement exhibit formatting anomalies, font inconsistencies, or digital manipulation artefacts consistent with document fraud?)

The adversarial injection surface involves crafting a bank statement photograph or employer letter scan in which pixel perturbations cause the visa AI to classify a fraudulent or forged supporting document as genuine, or suppress an inconsistency flag that the AI would otherwise generate when comparing the declared income on the application form to the bank balance trajectory in the submitted statement. The adversarial attack does not require the document to be visually indistinguishable from a genuine document — the perturbation operates at the pixel level in frequency domain features that the document classification AI uses to distinguish genuine from fabricated documents (paper texture features, scanner noise spectral characteristics, font embedding metadata artefacts) without altering the legible content visible to a human reviewer. A forged bank statement with adversarial perturbation applied to its scanned image can therefore defeat the AI document authenticity classifier while remaining visually suspicious to an experienced consular officer — but in high-volume visa processing environments where AI classification provides the first-pass filter that determines which applications receive detailed human review, adversarially crafted documents that pass the AI filter bypass the detailed human review.

The consequence of fraudulent visa document AI injection includes fraudulent tourist visa issuance to economic migrants who intend to remain beyond their visa validity — contributing to unauthorised immigration and downstream immigration enforcement cost; fraudulent work visa issuance to individuals who do not meet financial or sponsorship eligibility criteria; and, most seriously, the processing of human trafficking victims presented with fraudulent sponsorship documents that create a plausible visa application narrative for trafficking operations using consular channels. The National Referral Mechanism (UK), Trafficking Victims Protection Act (US), and FATF human trafficking typology guidance all identify visa fraud as a primary enabler of cross-border human trafficking. UK Home Office immigration enforcement conducts document fraud audits; adversarial document AI injection creates systematic gaps in the AI-assisted fraud detection layer that audits may not identify because the AI is reporting genuine classifications rather than errors. Glyphward’s pre-scan applied to uploaded visa application document images before they reach the document authenticity AI detects adversarially perturbed document scans and raises an AdversarialBorderControlImageError before the fraudulent classification reaches the visa decision workflow. Threshold: 50 (national security, immigration enforcement, human trafficking prevention).

4. Immigration status document AI injection (DHS CBP USCIS AI, UK Home Office Verify AI, E-Verify)

Immigration status verification AI processes photographs of immigration status documents — Form I-94 (Arrival/Departure Record), Employment Authorisation Document (EAD / Form I-766), US Permanent Resident Card (Form I-551 / “Green Card”), work permit cards, asylum seeker documentation, and student visa status records — submitted through employer I-9 verification systems (E-Verify), immigration court proceedings, benefit eligibility determination workflows, and local authority housing and welfare systems. The E-Verify system — operated by USCIS as an internet-based employment eligibility verification service used by over 1 million employers across all 50 US states — processes Form I-9 supporting document images submitted by employers to verify that employees are authorised to work in the United States, querying USCIS and CBP databases using the information extracted from the submitted document images by the E-Verify document AI.

The E-Verify document AI extracts key fields from submitted document images: for an Employment Authorisation Document (Form I-766), the AI extracts the card number (USCIS number), alien registration number (A-Number), category code (C09, A12, etc.), card expiry date, and surname and given name. These extracted fields are transmitted to the USCIS Central Index System (CIS) and DHS SAVE (Systematic Alien Verification for Entitlements) database to return an Employment Authorised, Tentative Nonconfirmation (TNC), or Final Nonconfirmation (FNC) result. The Leidos ACUITY document processing system, L3Harris ProVision AI, and Smiths Detection HI-SCAN imaging AI platforms also process immigration-related travel documents at air travel security checkpoints — e-passport scanning in TSA PreCheck lanes and CBP primary inspection lanes uses AI document processing models that extract e-passport chip data and compare it to the optically scanned biodata page.

An adversarially crafted EAD card photograph — in which pixel perturbations in the expiry date region cause the E-Verify document AI to classify the date characters as a future date when the printed date is in the past, or to suppress a card number format flag that would otherwise trigger an authenticity validation failure — enables an employer to submit I-9 verification for a worker whose employment authorisation has expired or was never issued, receiving an Employment Authorised result from E-Verify that creates a facially valid compliance record for the employer. Under 8 USC 1324a (Unlawful Employment of Unauthorised Aliens), the employer’s good-faith reliance on an E-Verify Employment Authorised result is a statutory defence to civil and criminal liability — meaning that an adversarially crafted document that generates a false Employment Authorised result from E-Verify effectively creates a statutory safe harbour for an employer who is, in fact, employing an individual without valid work authorisation. US Immigration and Customs Enforcement (ICE) Form I-9 audits — which ICE has conducted at increasing frequency under recent enforcement priorities, resulting in civil fines of $272 to $2,702 per I-9 violation for first offences — review employer E-Verify records and Form I-9 documentation. A false Employment Authorised result driven by adversarial document image injection is effectively invisible to an I-9 audit because the employer’s E-Verify record shows a genuine Employment Authorised case result, not a documentation error.

An adversarially crafted Form I-94 printout photograph submitted to a benefit eligibility determination AI — for example, in the Systematic Alien Verification for Entitlements (SAVE) workflow used by state agencies to determine alien benefit eligibility under welfare, Medicaid, and housing assistance programmes — can suppress a visa overstay flag that would otherwise cause the AI to return a status indicating that the individual’s immigration status does not support benefit eligibility, enabling fraudulent benefit access. The UK Home Office Verify AI, which processes biometric residence permits (BRPs) and visa vignettes submitted through Right to Work (RTW) and Right to Rent (RTR) checking services under the Immigration Act 2014, is exposed to the same adversarial document image injection pattern through the online RTW and RTR checking portals available to UK employers and landlords. An adversarially crafted BRP photograph submitted through the online RTW portal that causes the Home Office document AI to return a valid Right to Work result for an individual whose permission to work has expired creates a statutory defence to illegal working under section 24 of the Immigration, Asylum and Nationality Act 2006. Glyphward’s pre-scan applied to immigration status document images submitted through E-Verify, SAVE, and online RTW/RTR portals before they reach the document AI detects adversarially perturbed document photographs and raises an AdversarialBorderControlImageError before the false authorisation result reaches the employer or benefit determination workflow. Threshold: 50 (immigration enforcement, employment law).

Integration: government identity AI image ingestion with Glyphward pre-scan

Government identity and border control AI image ingestion flows from document scanner APIs at border crossings, biometric enrolment photograph submission APIs in traveller onboarding applications, visa application document upload portals, and immigration status document submission workflows into AI processing queues. Insert Glyphward’s pre-scan at the ingestion boundary before images reach the MRZ reading, facial recognition enrolment, document authenticity, or immigration status AI models:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# National security threshold — MRZ misreads bypass watchlists, corrupted
# biometric templates defeat border identity verification, fraudulent visa
# document classifications enable trafficking, and false E-Verify results
# create statutory safe harbours for unlawful employment.
THRESHOLD_BORDER_CONTROL = 50


class BorderControlAIContext(str, Enum):
    PASSPORT_SCAN = "passport_scan"              # Idemia MorphoReader, Thales Cogent, Vision-Box
    BIOMETRIC_ENROLMENT = "biometric_enrolment"  # CLEAR, SITA ABC, NEC NeoFace, Cognitec FaceVACS
    VISA_DOCUMENT = "visa_document"              # Thomson Reuters CLEAR AI, IBM Verify
    IMMIGRATION_STATUS = "immigration_status"    # E-Verify, USCIS AI, Home Office Verify AI


async def scan_border_control_image(
    image_source: str | Path | bytes,
    context: BorderControlAIContext,
    traveller_id_hash: str,    # SHA-256 of traveller identifier — no raw passport numbers
    document_type: str,        # e.g. "passport", "ead-i766", "i94", "brp", "bank-statement"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan a government identity or border control AI image for adversarial
    injection payloads before forwarding to MRZ reading, biometric enrolment,
    document authenticity, or immigration status AI.

    Audit record: traveller_id_hash (SHA-256) only — no raw passport numbers,
    A-Numbers, biometric data, or PII in the scan payload or audit log.
    """
    if isinstance(image_source, (str, Path)):
        image_bytes = Path(image_source).read_bytes()
    else:
        image_bytes = image_source

    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "border_context": context.value,
                "traveller_id_hash": traveller_id_hash,
                "document_type": document_type,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "traveller_id_hash": traveller_id_hash,
        "document_type": document_type,
        "border_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": THRESHOLD_BORDER_CONTROL,
        "action": "blocked" if result["score"] >= THRESHOLD_BORDER_CONTROL else "allowed",
    }
    await write_border_control_audit_record(audit_record)

    if result["score"] >= THRESHOLD_BORDER_CONTROL:
        raise AdversarialBorderControlImageError(
            f"Border control AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"document_type={document_type}"
        )
    return result


async def scan_visa_document_batch(
    document_paths: list[tuple[Path, str]],   # (path, document_type) pairs
    traveller_id_hash: str,
) -> dict:
    """
    Batch scan a visa application document collection (bank statements,
    employer letters, accommodation confirmations) concurrently before
    the visa document authenticity AI processes the submission.
    """
    allowed, blocked, errors = [], [], []

    async with httpx.AsyncClient() as client:
        tasks = [
            scan_border_control_image(
                path,
                BorderControlAIContext.VISA_DOCUMENT,
                traveller_id_hash,
                doc_type,
                client,
            )
            for path, doc_type in document_paths
        ]
        results = await asyncio.gather(*tasks, return_exceptions=True)

    for (path, doc_type), result in zip(document_paths, results):
        if isinstance(result, AdversarialBorderControlImageError):
            blocked.append({"path": str(path), "document_type": doc_type, "error": str(result)})
        elif isinstance(result, Exception):
            errors.append({"path": str(path), "document_type": doc_type, "error": str(result)})
        else:
            allowed.append({
                "path": str(path),
                "document_type": doc_type,
                "scan_id": result["scan_id"],
            })

    return {
        "traveller_id_hash": traveller_id_hash,
        "context": BorderControlAIContext.VISA_DOCUMENT.value,
        "total": len(document_paths),
        "allowed": len(allowed),
        "blocked": len(blocked),
        "errors": len(errors),
        "blocked_items": blocked,
    }


async def write_border_control_audit_record(record: dict) -> None:
    """Persist audit record to your government identity AI audit log (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialBorderControlImageError(Exception):
    """Raised when a border control AI image exceeds the adversarial injection threshold."""
    pass

The traveller_id_hash (SHA-256 of the traveller’s internal identifier, never a raw passport number, A-Number, or biometric template) and document_type fields provide the audit trail: a blocked passport scan links scan_id + traveller_id_hash + image_sha256 for post-incident investigation under ICAO Doc 9303 and national immigration enforcement frameworks without storing raw identity or biometric data in the scan API payload. For visa application document batch submissions, use scan_visa_document_batch to scan the entire document collection concurrently before any document reaches the authenticity AI — a single blocked document in the collection should prevent the entire submission from proceeding to AI assessment and trigger a consular review workflow. For biometric enrolment contexts (BIOMETRIC_ENROLMENT), a blocked enrolment photograph should halt the enrolment workflow entirely and prompt the applicant to retake the photograph under supervised conditions — adversarial enrolment injection requires controlled photograph submission to succeed, so supervised capture defeats the attack vector. Get early access

Coverage matrix

Related questions

Further reading

• Indirect prompt injection via image — foundational attack pattern covering adversarial pixel perturbation delivery through legitimate submission pathways, applicable to all four border control AI injection surfaces described on this page.
• Fintech and payments AI prompt injection — KYC document AI with overlapping identity verification attack vectors: bank statement and identity document adversarial injection in financial onboarding shares the same attack mechanism as visa application document AI injection.
• Vision-language model security — VLM security reference for next-generation border AI incorporating large vision-language models for document understanding and face image description, extending the attack surface beyond classical face recognition and OCR models.
• Public safety and emergency AI prompt injection — public safety AI with overlapping national security stakes; adversarial injection in law enforcement evidence AI and emergency dispatch AI shares the same threshold and audit trail framework as border control AI.
• Free tier — 10 scans/day, no card required — start scanning border control AI document and biometric images at development volumes before committing to a production plan.