Anamorpher

Anamorpher is a tool designed for crafting and visualizing image scaling attacks against multi-modal AI systems. It allows users to generate images that hide multi-modal prompt injections, which only become visible to the AI when the image is downscaled.

Key capabilities include:

• Generating payloads for specific downscaling algorithms (bicubic, bilinear, and nearest neighbor).
• Comparing payload effectiveness via a frontend interface that supports implementations from OpenCV, PyTorch, TensorFlow, and Pillow.
• Extending the tool with custom image downscaling implementations via a modular Python API.

Anamorpher requires Python 3.11+. It is recommended to use uv for dependency management.

Note for Windows users: You must use WSL2 because of TensorFlow dependencies.

# 1. Install dependencies
uv sync

# 2. Run the backend
uv run python backend/app.py

# 3. Open the frontend
# Open 'frontend/index.html' in your web browser

When using Anamorpher, keep the following in mind:

• Probabilistic Results: Due to the nature of multi-modal AI systems, results can vary. For consistent evaluation, it is recommended to run each example 5 times.
• Transformations: Applying additional image transformations may interfere with the effectiveness of the prompt injections.
• Algorithm Variability: Payloads may not work across all implementations of bicubic and bilinear algorithms due to differences in anti-aliasing robustness, default library parameters, and implementation-specific optimizations.
• System Changes: Production AI systems may change their scaling behavior, which can affect payload effectiveness.

Perform image downsampling using a specific engine and method.

Requirements:

• The input image must be square.
• The image dimensions must be divisible by 4.
• The target_resolution must be an integer between 64 and 2048.

Request Body (JSON):

• image: Base64 encoded string of the image.
• downsampler: The engine name (e.g., opencv).
• method: The interpolation method supported by the engine.
• target_resolution: The desired side length of the square output image.

Response (JSON): Returns the original image, the downsampled image (both as base64 data URLs), their respective sizes, and metadata about the operation.

POST /api/downsample
{
  "image": "data:image/png;base64,...",
  "downsampler": "opencv",
  "method": "bilinear",
  "target_resolution": 800
}

Retrieve a list of available demo images stored in the demo_images directory. Each entry includes filename, path, width, and height.

GET /api/demo-images

Retrieve a list of available decoy images used for adversarial generation. Each decoy object includes its filename, path, width, and height.

GET /api/decoy-images

Retrieve a list of all available downsampling engines and the specific interpolation methods they support (e.g., opencv, pytorch, tensorflow, pillow).

GET /api/downsamplers

A simple health check endpoint to verify the backend service is running.

GET /health

Retrieve the list of supported target resolutions for downsampling operations. Currently, these are returned as a list of strings representing dimensions (e.g., ["1092x1092", "800x800"]).

GET /api/resolutions

Create a square image containing specified text. This is useful for creating target images for adversarial attacks.

Request Body (JSON):

• text: The string to render.
• size: The side length of the square image (64 to 2048).
• font_size: The font size (20 to 64).
• alignment: Text alignment (center, top, bottom, left, right, topleft, topright, bottomleft, bottomright).

Response (JSON): Returns the base64 image, its size, the rendered text, font size, alignment, and a text_overflowed boolean flag indicating if the text exceeded the image bounds.

POST /api/generate-text-image
{
  "text": "Sample Text",
  "size": 1092,
  "font_size": 32,
  "alignment": "center"
}

Fetch a specific demo image by its filename and receive it as a base64 encoded string along with its dimensions.

GET /api/demo-images/<filename>