Prompt injection in Snowflake Cortex AI — multimodal data cloud security

Four multimodal injection surfaces in Snowflake Cortex AI

1. Cortex Document AI processing supplier-submitted invoice and document images. Snowflake's Cortex Document AI feature allows organisations to upload document images (PDFs, scanned invoices, receipts, forms) directly into a Snowflake stage and use a Cortex-powered extraction model to pull structured fields from the documents into table rows. Procurement teams use this to process supplier invoices at scale: upload the invoice image, Cortex Document AI extracts vendor name, invoice number, line items, and total — the extracted fields populate a procurement database table. When suppliers submit invoice images, the content of those images is entirely outside the submitting organisation's control. An adversarially crafted invoice image — visually identical to a legitimate invoice but with typographic prompt injection text printed at low opacity, in colours that match the background, or in a font size below visible threshold — causes Cortex Document AI to extract the injected instructions alongside the genuine invoice fields. If those extracted text fields are subsequently passed to SNOWFLAKE.CORTEX.COMPLETE() for downstream processing (summarisation, anomaly flagging, compliance checking), the injection payload executes in the LLM context with whatever permissions the Cortex function invocation carries. The Glyphward scan applied to each document image at upload time — before it reaches the Snowflake stage — blocks the adversarial image before extraction begins.

2. Cortex LLM functions applied to image-extracted text columns from OCR pipelines. Many Snowflake data pipelines use external OCR tools (AWS Textract, Google Document AI, Azure Form Recognizer, Tesseract) to convert image archives to text, then load the extracted text into Snowflake tables. Analysts then run Cortex LLM functions against these text columns: SNOWFLAKE.CORTEX.SUMMARIZE(extracted_text) across a corpus of scanned contracts, SNOWFLAKE.CORTEX.EXTRACT_ANSWER() on scanned form responses, or SNOWFLAKE.CORTEX.COMPLETE(prompt, extracted_text) for custom analysis tasks. The adversarial injection surface is in the original image, not in the extracted text file — an adversarially crafted image that contains visible or near-invisible injection text will have that text faithfully extracted by the OCR pipeline and stored in the Snowflake text column. When a Cortex LLM function processes that column, the injection payload is present in the function's input. Snowflake has no mechanism to distinguish between genuine document text extracted from an image and injection text extracted from the same image — it sees only a VARCHAR column value. Inserting the Glyphward scan at the point where images enter the OCR pipeline prevents adversarial payloads from reaching the text extraction step and, consequently, the Cortex function.

3. Cortex Search on image-derived document embeddings in Snowflake. Cortex Search enables semantic search over Snowflake table columns by maintaining a search index backed by LLM embeddings. When organisations build Cortex Search over image-derived content — scanned contract repositories, image-based knowledge base articles, product documentation pages distributed as image PDFs — the search corpus includes embeddings of text extracted from those images. A Cortex Search query against this corpus returns chunks from the most semantically similar documents; if those chunks include adversarially injected text extracted from a manipulated image, the injected content appears in the search result that a Cortex-powered application surfaces to the end user or passes to a downstream COMPLETE() call. In RAG architectures built on Cortex Search (retrieve relevant chunks, pass to COMPLETE for answer generation), adversarial payloads injected via document images propagate through retrieval into generation — the canonical indirect prompt injection pipeline. Cortex Search has no content safety filter on indexed chunks. The Glyphward scan at image ingestion time prevents adversarially crafted document images from contributing payloads to the search index.

4. Snowflake Marketplace data products containing image-derived text records. Snowflake Data Marketplace enables organisations to purchase or subscribe to shared data products from third-party data providers. Some data marketplace products include image-derived text records — scraped e-commerce product descriptions extracted from product image labels, publicly available regulatory document databases extracted from PDF scans, financial data products that include text from annual report images. When an organisation subscribes to such a data product and runs Cortex LLM functions against the shared data, they have no visibility into whether the source images used to produce the text records were adversarially manipulated. A malicious data provider — or a data provider whose source images were compromised before extraction — can include injection payloads in text records that activate when a subscriber's Cortex pipeline processes them. This supply-chain injection vector is unique to data cloud architectures: the adversarial content is in the data product, not in the subscriber's own ingestion pipeline. Scanning shared data records against known injection patterns before running Cortex functions against them, and auditing Cortex function outputs for anomalous instruction-following behaviour, are the correct downstream defences when the image source is not in the subscribing organisation's control.

Integration: pre-Snowflake ingestion scan with Glyphward

import base64
import snowflake.connector
import requests
from pathlib import Path

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65

def scan_and_stage_document(image_path: str, stage_name: str, conn) -> dict:
    """
    Scan document image before staging into Snowflake.
    Returns scan metadata for audit logging; raises on adversarial detection.
    """
    image_bytes = Path(image_path).read_bytes()
    encoded = base64.b64encode(image_bytes).decode()

    scan_resp = requests.post(
        "https://glyphward.com/v1/scan",
        headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
        json={"image": encoded},
        timeout=5,
    )
    scan_resp.raise_for_status()
    scan = scan_resp.json()

    if scan["score"] >= GLYPHWARD_THRESHOLD:
        # Log the rejection to Snowflake audit table before raising
        cursor = conn.cursor()
        cursor.execute(
            "INSERT INTO adversarial_image_log (file_path, score, scan_id, blocked_at) "
            "VALUES (%s, %s, %s, CURRENT_TIMESTAMP())",
            (image_path, scan["score"], scan["scan_id"])
        )
        raise ValueError(
            f"Adversarial image blocked: {image_path} "
            f"score={scan['score']} scan_id={scan['scan_id']}"
        )

    # Image is clean — PUT to Snowflake stage for Cortex Document AI
    cursor = conn.cursor()
    cursor.execute(f"PUT file://{image_path} @{stage_name} AUTO_COMPRESS=FALSE")
    return {"status": "staged", "file": image_path, "scan_id": scan["scan_id"]}

# Usage: scan each invoice before staging for Cortex Document AI extraction
conn = snowflake.connector.connect(
    account="<your-account>",
    user="<your-user>",
    password="<your-password>",
    warehouse="COMPUTE_WH",
    database="PROCUREMENT_DB",
    schema="INVOICES",
)

for invoice_path in Path("./incoming_invoices").glob("*.jpg"):
    try:
        result = scan_and_stage_document(str(invoice_path), "@invoice_stage", conn)
        print(f"Staged: {result['file']} scan_id={result['scan_id']}")
    except ValueError as e:
        print(f"BLOCKED: {e}")

For Cortex LLM functions applied to existing text columns derived from images (OCR pipelines that ran before the Glyphward gate was added), run a retroactive injection pattern scan: extract all text column values from the relevant tables, check them against known injection signatures using SNOWFLAKE.CORTEX.CLASSIFY_TEXT() with a custom adversarial-instructions category, and flag rows for manual review. The pre-ingestion Glyphward image scan is the structural fix; the retroactive text scan is remediation for data already in the lake. Get early access

Coverage matrix

Related questions

Further reading

• Multimodal prompt injection in financial document AI — bank statement analysis, invoice OCR, and payment instruction injection vectors
• OWASP LLM01 Prompt Injection — multimodal dimension — the base attack class behind all Cortex AI document injection risks
• SOC 2 AI security controls — mapping Glyphward scan gates to SOC 2 Trust Services Criteria
• Multimodal AI security checklist — structured review for Snowflake Cortex AI deployments
• Glyphward API free tier — test against your Cortex ingestion pipeline today