Prompt injection scanner for Azure Functions AI workloads

The four multimodal attack surfaces in Azure Functions AI pipelines

1. Blob Storage–triggered Azure Functions — adversarial images in automated document processing pipelines. The canonical Azure pattern for AI document processing is Blob Storage event binding: a document uploaded to an Azure Blob container triggers a Blob-triggered function, which reads the blob, extracts page images, and passes them to Azure OpenAI or Document Intelligence for analysis. Microsoft Defender for Storage can scan uploaded files for malware signatures and sensitive data patterns; Azure Blob lifecycle management policies control retention; SAS tokens and Entra ID object-level RBAC control upload access — none of these controls inspect image pixel content for embedded prompt injection payloads. An adversarially crafted image uploaded by an external user (a customer submitting an invoice, a supplier uploading a certificate, a partner delivering a contract) to a monitored Blob container triggers the Azure Function, which reads the blob bytes and passes them to the VLM. Defender for Storage will classify the image as a standard JPEG with no malware signature — because the adversarial payload is not malware code but structured pixel content that affects VLM interpretation. The function's Entra managed identity controls which Azure resources the function can access, not which image content it will process.

2. HTTP-triggered Azure Functions with Azure Front Door WAF — adversarial images bypassing WAF managed rule sets. Azure Functions deployed behind Azure Front Door use WAF policies with Microsoft-managed rule sets to inspect incoming HTTP traffic. The Microsoft managed rule set (DRS 2.1) covers OWASP CRS rules for web application attacks: SQL injection, XSS, protocol attacks, and path traversal — all text-layer attack patterns in HTTP request headers and bodies. Image content submitted as a multipart form upload or base64-encoded JSON body within the WAF-inspected request passes through WAF inspection without pixel-level analysis: WAF validates that the content type is image/jpeg, checks byte limits on the request body, and applies text-pattern rules to the surrounding JSON structure. Adversarial pixel content within the image bytes does not match any WAF managed rule and passes through to the Azure Function handler. The function's HTTP trigger binding extracts the image from the request, and the image is passed to Azure OpenAI with the WAF-approved request metadata that provides no indication of adversarial content.

3. Azure OpenAI Service multi-modal GPT-4o calls — adversarial images in managed Azure AI deployments. Azure Functions that invoke Azure OpenAI Service (AOAI) GPT-4o or GPT-4o-mini multi-modal endpoints pass images as base64-encoded content blocks within the chat completion request. Azure OpenAI Service provides content filtering on both inputs and outputs, configurable per deployment. Azure OpenAI content filters use text-based classifiers for hate, violence, sexual content, and self-harm categories applied to the text prompt and model-generated response — they do not inspect image pixel content for embedded prompt injection instructions. Azure AI Content Safety Prompt Shields (a separate service) provides text-based prompt injection detection for the text portions of multi-modal requests; it does not analyse image pixel content. An adversarially crafted image passed to a GPT-4o multi-modal deployment via an Azure Function reaches the model with image content filters checking for harmful visual content categories (violence, explicit content) but not for pixel-level prompt injection payloads designed to redirect the model's reasoning. Azure OpenAI's responsible AI layer is a different concern than the adversarial input layer — the former addresses output content categories; the latter addresses adversarial input manipulation of model behaviour.

4. Event Grid–orchestrated multi-function pipelines — adversarial images propagating through chained function invocations. Azure Event Grid routes events between Azure services and functions, enabling multi-stage AI pipelines where images move through a chain of Azure Functions: a pre-processing function resizes and validates the image, publishes an Event Grid event; an analysis function subscribes to the event, invokes Document Intelligence for OCR, publishes another event; a post-processing function subscribes, calls Azure OpenAI with the extracted text and original image, writes results to Cosmos DB. Each function in the chain is an independently deployed Azure Function with its own Entra managed identity and Key Vault references. The Event Grid subscription schema validates event structure (event type, subject, data schema) — not the image content within the event data payload. An adversarial image that passes the pre-processing function's file type validation enters the Event Grid pipeline and propagates through every subsequent function in the chain, reaching Document Intelligence and Azure OpenAI with the adversarial pixel payload intact. The Event Grid dead-letter destination handles events that fail delivery — not events whose content causes adversarial VLM behaviour within the receiving function.

Integration: Glyphward pre-scan gate in Azure Functions (Python)

import azure.functions as func
import base64
import json
import logging
import os
import requests
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from azure.storage.blob import BlobServiceClient
from openai import AzureOpenAI

GLYPHWARD_THRESHOLD = 65
KEY_VAULT_URL = os.environ["KEY_VAULT_URL"]  # e.g. https://myvault.vault.azure.net/

def get_glyphward_key() -> str:
    """Retrieve Glyphward API key from Azure Key Vault via managed identity."""
    credential = DefaultAzureCredential()
    client = SecretClient(vault_url=KEY_VAULT_URL, credential=credential)
    return client.get_secret("glyphward-api-key").value

def scan_image(image_bytes: bytes, glyphward_key: str) -> dict:
    """Scan image bytes with Glyphward. Raises on scan API failure (fail-closed)."""
    encoded = base64.b64encode(image_bytes).decode()
    response = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {glyphward_key}"},
        json={"image": encoded},
        timeout=5,
    )
    response.raise_for_status()
    return response.json()

app = func.FunctionApp(http_auth_level=func.AuthLevel.FUNCTION)

@app.blob_trigger(arg_name="blob", path="uploads/{name}", connection="AzureWebJobsStorage")
def process_document_blob(blob: func.InputStream):
    """Blob-triggered function with Glyphward pre-scan gate before Azure OpenAI call."""
    glyphward_key = get_glyphward_key()
    image_bytes = blob.read()

    # Glyphward pre-scan gate
    try:
        scan = scan_image(image_bytes, glyphward_key)
    except Exception as e:
        logging.error(f"Glyphward scan failed: {e}")
        # Fail-closed: raise so the blob trigger retries with dead-letter routing
        raise RuntimeError("Scan unavailable — aborting VLM call") from e

    if scan["score"] >= GLYPHWARD_THRESHOLD:
        logging.warning(f"Adversarial image rejected: score={scan['score']} scan_id={scan['scan_id']}")
        # Move blob to quarantine container
        blob_service = BlobServiceClient.from_connection_string(os.environ["AzureWebJobsStorage"])
        blob_service.get_blob_client("quarantine", blob.name).upload_blob(image_bytes, overwrite=True)
        return  # Do not invoke Azure OpenAI

    # Azure OpenAI GPT-4o multi-modal call — only reached by non-adversarial images
    aoai_client = AzureOpenAI(
        azure_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
        api_version="2025-04-01-preview",
        azure_ad_token_provider=lambda: DefaultAzureCredential().get_token(
            "https://cognitiveservices.azure.com/.default"
        ).token,
    )

    encoded = base64.b64encode(image_bytes).decode()
    completion = aoai_client.chat.completions.create(
        model=os.environ["AZURE_OPENAI_DEPLOYMENT"],
        max_tokens=512,
        messages=[
            {
                "role": "user",
                "content": [
                    {"type": "image_url", "image_url": {"url": f"data:image/jpeg;base64,{encoded}"}},
                    {"type": "text", "text": "Extract the key information from this document."},
                ],
            }
        ],
    )

    logging.info(f"Document processed: scan_id={scan['scan_id']} result_length={len(completion.choices[0].message.content)}")

Retrieve the Glyphward key from Azure Key Vault using DefaultAzureCredential and a managed identity with Key Vault Secrets User role assignment on the vault — never store the key in application settings or environment variables in plaintext. For HTTP-triggered functions returning results to callers, return HTTP 400 with the scan rejection reason (do not raise an exception, which would cause a 500 response). For Blob-triggered and Event Grid–triggered functions, raise an exception on adversarial image detection so Azure Functions' built-in retry logic routes the event to the configured dead-letter storage or dead-letter queue. Add the quarantine blob copy before raising so the image is preserved for security analysis. For Event Grid–orchestrated pipelines, add the scan gate in the first function subscriber and publish a Glyphward.ImageRejected Event Grid event on rejection so downstream security monitoring functions can react. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection scanner for AWS Lambda AI — the equivalent AWS serverless pattern with S3 triggers, Bedrock, and Secrets Manager
• Prompt injection scanner for Google Cloud Run AI — the equivalent GCP serverless container pattern
• OWASP LLM01 Prompt Injection — multimodal dimension — the attack mechanism that Azure Functions platform controls do not address
• Indirect prompt injection via image — the attack pattern most relevant to Blob-triggered pipelines processing third-party documents
• Multimodal AI security checklist — structured security review for Azure AI workloads including Functions, AOAI, and Glyphward integration