Prompt injection scanner for Google Gemini Flash

Four attack surfaces specific to Gemini Flash

1. Files API reuse across model calls. The Gemini Files API lets you upload a file once and reference it by URI in multiple generateContent() calls for up to 48 hours. In a batch document-processing pipeline, a user uploads a PDF; your pipeline converts it to images and uploads each page to the Files API; your Flash calls reference those file URIs. If one page contains a typographic prompt injection — text rendered in the page's font that instructs the model to change its output — every subsequent model call that includes that file URI is affected. The Files API has no built-in content inspection; it stores and serves bytes. A pre-upload scan gate is the only way to prevent a malicious page from propagating through the entire batch.

2. Long-context multi-image batches. Gemini Flash's 1M token context window enables passing hundreds of document pages in a single API call — a 300-page PDF renders as ~300 image frames, all ingestible in one request. An attacker who controls even one page in a large document batch can inject instructions that affect the model's interpretation of all subsequent pages in the same call. This is particularly relevant for contract review, financial statement analysis, and legal discovery workflows where documents come from counterparties or external sources. Scanning each frame individually before constructing the batch request prevents a single adversarial page from poisoning the entire context.

3. Inline base64 images in high-throughput pipelines. Pipelines that skip the Files API and pass images as inline base64 data in each request are vulnerable at every call site. At high throughput, the scanning overhead must be minimised. Gemini Flash's latency target (designed for real-time and near-real-time use) creates pressure to skip pre-call validation. The correct architecture is to scan asynchronously during image ingestion (when the user uploads or the pipeline fetches the source image) and cache the scan result with the image hash. The inline base64 call then uses the cached result rather than blocking on a synchronous scan.

4. Multimodal streaming responses. generateContentStream() returns partial responses as the model generates output. In agentic pipelines, downstream code processes each streamed chunk as it arrives — extracting structured fields, updating a UI, or triggering side effects. An injection instruction embedded in an image can cause the model to output a structured payload mid-stream (for example, a JSON fragment that overrides a previously parsed field, or a tool-call instruction that triggers an unintended action before the stream closes). Standard text-injection defences that scan the final assembled response are blind to mid-stream injection artefacts. The scan gate on the input image — before the stream starts — is the correct prevention layer.

Integration: Files API scan gate (Python)

import base64, hashlib, os, time
import google.generativeai as genai
import requests

GLYPHWARD_KEY = os.environ["GLYPHWARD_API_KEY"]
INJECTION_THRESHOLD = 65
genai.configure(api_key=os.environ["GEMINI_API_KEY"])

_scan_cache: dict[str, dict] = {}  # sha256 → {score, scan_id, ts}

def scan_image_bytes(image_bytes: bytes, source: str) -> dict:
    """Scan with result caching by content hash."""
    h = hashlib.sha256(image_bytes).hexdigest()
    cached = _scan_cache.get(h)
    if cached and time.time() - cached["ts"] < 3600:
        return cached

    try:
        resp = requests.post(
            "https://glyphward.com/v1/scan",
            json={"image": base64.b64encode(image_bytes).decode(), "source": source},
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            timeout=8,
        )
        resp.raise_for_status()
        result = resp.json()
    except Exception:
        # Fail-closed: scanner unreachable → treat as high-risk
        return {"score": 100, "scan_id": None}

    entry = {"score": result["score"], "scan_id": result["scan_id"], "ts": time.time()}
    _scan_cache[h] = entry
    return entry


def safe_upload_to_files_api(image_bytes: bytes, display_name: str, mime_type: str) -> str | None:
    """
    Upload an image to the Gemini Files API after scanning.
    Returns the file URI on success, None if the image was rejected.
    """
    scan = scan_image_bytes(image_bytes, f"files_api_upload:{display_name}")

    if scan["score"] >= INJECTION_THRESHOLD:
        print(
            f"Files API upload rejected: display_name={display_name}, "
            f"score={scan['score']}, scan_id={scan['scan_id']}"
        )
        return None

    # Upload the scanned-safe image
    import io
    uploaded = genai.upload_file(
        io.BytesIO(image_bytes),
        mime_type=mime_type,
        display_name=f"{display_name} [gwscan:{scan['scan_id']}]",
    )
    return uploaded.uri


def process_document_batch(page_images: list[tuple[bytes, str]], prompt: str) -> str | None:
    """
    Process a batch of page images with Gemini Flash.
    Scans each page; if any page fails, aborts the entire batch.
    """
    model = genai.GenerativeModel("gemini-2.0-flash")
    content_parts = [prompt]

    for image_bytes, display_name in page_images:
        uri = safe_upload_to_files_api(image_bytes, display_name, "image/png")
        if uri is None:
            return None  # Abort batch — adversarial image detected
        content_parts.append({"file_data": {"file_uri": uri}})

    response = model.generate_content(content_parts)
    return response.text

Get early access

Coverage matrix

Related questions

Further reading

• Prompt-injection scanner for Vertex AI Agent Builder — GCS-based document ingestion and Playbook tool scanning.
• Real-time vs batch prompt injection scanning — when to scan synchronously vs asynchronously in high-throughput pipelines.
• Multimodal prompt injection in agentic RAG pipelines — multi-hop injection when retrieval decisions are affected.
• Prompt injection prevention best practices — full defence-in-depth stack.
• Multimodal LLM security API — Glyphward API overview.