Prompt injection in retail loss prevention AI — adversarial product labels, shelf analytics evasion, self-checkout bypass, and shrinkage detection manipulation

Four multimodal injection surfaces in retail loss prevention AI

1. Product label and packaging graphics injecting adversarial payloads into self-checkout computer vision. Self-checkout AI systems — both traditional assisted self-checkout and cashierless autonomous checkout (Amazon Just Walk Out, Zippin, Standard AI) — use computer vision to identify products from packaging images rather than relying solely on barcode scans. This enables theft detection when items are placed in bagging areas without scanning, enables item verification against declared scan data, and drives the core identification capability of cashierless checkout where no explicit scan step exists. Product packaging is entirely controlled by the product’s manufacturer or seller: every graphic, label element, and packaging image is a potential injection surface. An adversarially crafted product label — a genuine product label design with a typographic injection payload rendered at sub-visible opacity over a busy packaging graphic region — can cause the self-checkout computer vision to assign the item a different product identity: a premium item that self-identifies as a budget equivalent, or an item whose adversarial label causes the computer vision to return a lower price SKU. For autonomous checkout systems where computer vision is the only identification mechanism, this attack directly causes the store to charge the wrong price with no barcode correction step. The adversarial payload on the product label is invisible to a human cashier or loss prevention officer who physically examines the item — the attack is effective against AI-only identification pipelines precisely because it exploits the VLM layer while bypassing human visual inspection.

2. Shelf intelligence camera feed injection suppressing removal detection. Shelf intelligence AI platforms like Focal Systems and Verkada’s retail analytics use continuous camera feeds to monitor shelf stock levels, detect item removal events, and classify shopper interaction patterns. These platforms apply computer vision models to camera frame images at high frequency to generate structured shelf state data: item counts per SKU position, removal event timestamps, and stock level alerts. A retail adversary who introduces adversarial visual elements into the physical shelf environment — a shelf label, a product tag, or a positioned marketing insert with an adversarial pattern designed to interfere with the AI shelf monitoring’s event classification — can cause the shelf intelligence AI to misclassify item removal events as shelf reorganisation, suppress low-stock alerts for targeted product positions, or introduce false readings into the inventory data stream. The adversarial element is a physical object placed in the camera’s field of view that exploits the shelf monitoring AI’s VLM classification layer. While this attack requires physical access to the store environment, it does not require sophisticated technical equipment beyond a printed adversarial pattern — a barrier comparable to that required for traditional camera-obstruction loss prevention evasion, with greater reliability against AI detection systems. The same attack surface applies to AI-enabled electronic article surveillance (EAS) systems that use computer vision alongside traditional RF/RFID tag detection.

3. Vendor-submitted product image catalogue injection for AI-assisted merchandising. Large-format retailers and marketplace platforms process thousands of vendor-submitted product images through AI ingestion pipelines for catalogue management: product images are classified by category, automatically tagged with attributes (colour, material, style, size indicators), matched against existing catalogue records, and routed to AI-assisted merchandising and recommendation systems. These product image ingestion pipelines process vendor-supplied images at scale with minimal human review per image — automated classification and tagging is the efficiency mechanism that enables catalogue management at retail scale. A vendor who submits adversarially crafted product images — genuine product photos with injected instruction payloads — can cause the AI catalogue system to assign false product attributes, misclassify products into incorrect categories, generate incorrect AI-generated product descriptions, or manipulate recommendation algorithm weights by injecting false attribute signals into the catalogue data. This attack is structurally a supply chain injection: the adversarial payload enters the retailer’s own AI systems through the vendor catalogue submission channel, which is a trusted input channel with high automation and low per-image review. A Glyphward scan gate at the vendor image intake API blocks adversarial catalogue injection before the AI classification pipeline processes the submitted images.

4. Clothing tag and apparel label injection in fashion retail AI. Fashion retail AI systems — including fitting room recommendation AI, virtual try-on platforms, and returns fraud detection AI — process garment images to identify item characteristics: fabric composition indicators, size labels, brand tags, care instruction labels, and original-vs-counterfeit authentication signals. Returns fraud detection AI specifically uses garment tag and label image analysis to verify that returned items match the original purchase: the AI checks label integrity, brand mark authenticity, and item-specific identifiers. Adversarially crafted clothing tags — counterfeit tags with adversarial injection payloads embedded in the label graphics — can cause the returns fraud detection AI to misidentify a fraudulent return item as a genuine original, suppress counterfeit detection signals, or generate false authenticity confirmations for tag-swapped items. This attack is relevant both to organised retail crime groups producing adversarially crafted counterfeit tags at scale and to individual returns fraud actors who substitute counterfeit tags on high-value garments. Authentication AI for luxury goods — platforms including Entrupy and Real Authentication — face a parallel exposure when processing adversarially crafted product authentication images submitted by sellers on secondary marketplaces.

Integration: retail product image intake with Glyphward pre-scan

import base64
import hashlib
import requests
from datetime import datetime, timezone

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65

def scan_retail_product_image(
    image_bytes: bytes,
    image_source: str,  # "vendor_catalogue" | "self_checkout_camera" | "returns_authentication" | "shelf_camera_frame"
    sku_id: str | None,
    vendor_id: str | None,
    store_id: str | None = None,
) -> dict:
    """
    Pre-AI scan for retail product images and computer vision inputs.
    Returns scan audit record.
    Raises ValueError on adversarial detection; RuntimeError on scan failure.

    For self-checkout and shelf camera frames, integrate at the frame
    capture API level before frames enter the classification model batch.
    For vendor catalogue submissions, integrate at the product image upload
    endpoint in the supplier portal.
    """
    encoded = base64.b64encode(image_bytes).decode()
    image_hash = hashlib.sha256(image_bytes).hexdigest()

    scan_resp = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )

    audit_record = {
        "image_source": image_source,
        "sku_id": sku_id,
        "vendor_id": vendor_id,
        "store_id": store_id,
        "image_sha256": image_hash,
        "scanned_at": datetime.now(timezone.utc).isoformat(),
        "scan_status": None,
        "scan_id": None,
        "scan_score": None,
    }

    if scan_resp.status_code != 200:
        # Fail-closed: do not process image through loss prevention AI
        # when scan gate is unavailable. Route to manual review queue.
        audit_record["scan_status"] = "error_held_for_manual_review"
        persist_retail_scan_audit(audit_record)
        raise RuntimeError(
            f"Glyphward scan unavailable: source={image_source} sku={sku_id}"
            f" — image held for manual review"
        )

    scan = scan_resp.json()
    audit_record["scan_id"] = scan["scan_id"]
    audit_record["scan_score"] = scan["score"]

    if scan["score"] >= GLYPHWARD_THRESHOLD:
        audit_record["scan_status"] = "adversarial_blocked"
        persist_retail_scan_audit(audit_record)
        # For vendor catalogue: flag vendor account for LP security review.
        # For self-checkout: route item to attended checkout lane.
        # For shelf camera: flag frame sequence for human LP review.
        raise ValueError(
            f"Adversarial retail image blocked: source={image_source} "
            f"sku={sku_id} vendor={vendor_id} store={store_id} "
            f"score={scan['score']} scan_id={scan['scan_id']}"
        )

    audit_record["scan_status"] = "clean_passed"
    persist_retail_scan_audit(audit_record)
    return audit_record

def persist_retail_scan_audit(record: dict):
    # Append to loss prevention audit log alongside item/transaction record.
    pass

For vendor catalogue workflows, integrate at the supplier image upload API. For self-checkout and shelf intelligence workflows, integrate at the computer vision frame intake layer — scanning at frame capture before frames enter the classification model batch. For returns fraud detection, integrate at the garment tag image capture step before authentication AI processes the label image. Get early access

Coverage matrix

Related questions

Further reading

• Adversarial images in e-commerce product catalogues — adjacent attack surface for online retail AI product ingestion
• Vision-language model security — VLM attack surface and adversarial example techniques
• Real-time vs batch prompt injection scanning — architectural guidance for high-throughput retail computer vision pipelines
• CCTV and physical security AI prompt injection — adversarial attacks on security camera analytics systems
• Glyphward API free tier — scan retail product images today at no cost