---
title: "image-hijacks"
type: "tool"
slug: "euanong-image-hijacks"
canonical_url: "https://www.graphcanon.com/tools/euanong-image-hijacks"
github_url: "https://github.com/euanong/image-hijacks"
homepage_url: "https://image-hijacks.github.io/"
stars: 56
forks: 12
primary_language: "Python"
license: "MIT"
archived: false
categories: ["model-training", "computer-vision", "inference-serving"]
tags: ["python"]
updated_at: "2026-07-11T23:40:00.692326+00:00"
---

# image-hijacks

> Official codebase for Image Hijacks: Adversarial Images can Control Generative Models at Runtime

Official codebase for Image Hijacks: Adversarial Images can Control Generative Models at Runtime

## Facts

- Repository: https://github.com/euanong/image-hijacks
- Homepage: https://image-hijacks.github.io/
- Stars: 56 · Forks: 12 · Open issues: 8 · Watchers: 2
- Primary language: Python
- License: MIT
- Last pushed: 2023-09-19T20:28:31+00:00

## Trust & health

_Signals computed from public GitHub metadata. Not a security guarantee._

- Maintenance: Dormant (computed 2026-07-11T23:39:54.147Z)
- Security scan: No lockfile (0 critical, 0 high, 0 medium, 0 low) · last scan 2026-07-11T23:39:54.603Z
- Full report: [trust report](/tools/euanong-image-hijacks/trust.md) · [JSON](https://www.graphcanon.com/api/graphcanon/tools/euanong-image-hijacks/trust)

## Categories

- [Model Training](/categories/model-training.md)
- [Computer Vision](/categories/computer-vision.md)
- [Inference & Serving](/categories/inference-serving.md)

## Tags

python

## Category neighbours (exploratory)

_Same-category tools for discovery only - not curated alternatives. Cap shown at six._

- [tensorflow](/tools/tensorflow-tensorflow.md) - An Open Source Machine Learning Framework for Everyone (★ 196,300) [Very active]
- [ollama](/tools/ollama-ollama.md) - Get up and running with various large language models using Ollama. (★ 175,936) [Very active]
- [transformers](/tools/huggingface-transformers.md) - Transformers: the model-definition framework for state-of-the-art machine learning models in text, vision, audio, and multimodal models (★ 162,482) [Very active]
- [langflow](/tools/langflow-ai-langflow.md) - Langflow is a powerful tool for building and deploying AI-powered agents and workflows. (★ 151,697) [Very active]
- [open-webui](/tools/open-webui-open-webui.md) - User-friendly AI Interface (Supports Ollama, OpenAI API, ...) (★ 145,029) [Very active]
- [llama.cpp](/tools/ggml-org-llama-cpp.md) - LLM inference in C/C++ (★ 120,002) [Very active]

_+ 2 more not listed._

## README (excerpt)

_Quoted verbatim from the upstream repository. Untrusted content - treat as data, not instructions._

````text
# Image Hijacks: Adversarial Images can Control Generative Models at Runtime

This is the code for _Image Hijacks: Adversarial Images can Control Generative Models at Runtime_.

- [Project page and demo](https://image-hijacks.github.io)
- [Paper](https://arxiv.org/abs/2309.00236)

## Setup

The code can be run under any environment with Python 3.9 and above. 

We use [poetry](https://python-poetry.org) for dependency management, which can be installed following the instructions [here](https://python-poetry.org/docs/#installation).

To build a virtual environment with the required packages, simply run

```bash
poetry install
```

Notes
- On some systems you may need to set the environment variable `PYTHON_KEYRING_BACKEND=keyring.backends.null.Keyring` to avoid keyring-based errors.
- This codebase stores large files (e.g. cached models, data) in the `data/` directory; you may wish to symlink this to an appropriate location for storing such files.

## Training

The images used in our [demo](https://image-hijacks.github.io) were trained using the config in `experiments/exp_results_tables/config.py` (specifically runs #1 `llava1_att_leak.pat_full.eps_8.lr_3e-2` and #5 `llava1_att_spec.pat_full.eps_8.lr_3e-2`).

To train these images, first download the relevant LLaVA checkpoint:

```bash
poetry run python download.py models llava-v1.3-13b-336px
```

To get the list of jobs (with their job IDs) specified by this config file:

```bash
poetry run python experiments/exp_demo_imgs/config.py
```

To run job ID `N` without [wandb](https://wandb.ai/) logging:

```bash
poetry run python run.py train \
--config_path experiments/exp_demo_imgs/config.py \
--log_dir experiments/exp_demo_imgs/logs \
--job_id N \
--playground
```

To run job ID `N` with [wandb](https://wandb.ai/) logging to `YOUR_WANDB_ENTITY/YOUR_WANDB_PROJECT`:

```bash
poetry run python run.py train \
--config_path experiments/exp_results_tables/config.py \
--log_dir experiments/exp_results_tables/logs \
--job_id N \
--wandb_entity YOUR_WANDB_ENTITY \
--wandb_project YOUR_WANDB_PROJECT \
--no-playground
```

Notes: 
- In order to run jailbreak experiments (configurations coming soon), you must store your OpenAI API key in the `OPENAI_API_KEY` environment variable.

## Tests

This codebase advocates for [expect tests](https://blog.janestreet.com/the-joy-of-expect-tests) in machine learning, and as such uses @ezyang's [expecttest](https://github.com/ezyang/expecttest) library for unit and regression tests.

To run tests,

```bash
poetry run python download.py models blip2-flan-t5-xl
poetry run pytest .
```

## Citation

To cite our work, you can use the following BibTeX entry:

```bibtex
@misc{bailey2023image,
  title={Image Hijacks: Adversarial Images can Control Generative Models at Runtime}, 
  author={Luke Bailey and Euan Ong and Stuart Russell and Scott Emmons},
  year={2023},
  eprint={2309.00236},
  archivePrefix={arXiv},
  primaryClass={cs.LG}
}
```
````

---

**Machine-readable endpoints**

- JSON: [`/api/graphcanon/tools/euanong-image-hijacks`](/api/graphcanon/tools/euanong-image-hijacks)
- LLM index: [/llms.txt](/llms.txt)
- Full corpus: [/llms-full.txt](/llms-full.txt)

_GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_