Skip to content

README.md

Latest commit

 

History

History
73 lines (48 loc) · 2.75 KB

README.md

File metadata and controls

73 lines (48 loc) · 2.75 KB
Raw

Size-based Image Collision

This module demonstrates a dimension-based image collision attack, where the same raw pixel data displays completely different visual content when interpreted with different image dimensions.

Concept

The key insight is that image dimensions (width × height) are metadata, not part of the raw pixel data. If two images have the same total number of pixels (N = W1 × H1 = W2 × H2), their raw pixel bytes can be identical while displaying entirely different content.

For example:

  • Image A: 30×150 (width × height) → displays "VERTICAL"
  • Image B: 150×30 (width × height) → displays "HORIZONTAL"

Both images have N = 4500 pixels, so the same byte sequence reshapes into two visually distinct images.

How It Works

  1. Create Target Images: Generate two clean target images with text

    • Target A: Tall vertical image with "VERTICAL" text
    • Target B: Wide horizontal image with "HORIZONTAL" text

  2. Merge Pixel Data: For each pixel position i (0 to N-1):

    • Calculate its (row, col) position in both dimension interpretations
    • Take the minimum pixel value from both targets (darker wins)

  3. Reshape Results: The merged pixel list can be reshaped into either dimension, showing the intended text for each configuration.

Security Implications

In LLM serving frameworks that cache based on raw image bytes (e.g., using image.tobytes()), this attack enables:

  • Cache Poisoning: An attacker can prime the cache with a "safe" image (e.g., 30×150), then request the same bytes as a different dimension (e.g., 150×30) to retrieve cached results for different visual content.

  • Content Filter Bypass: If content filtering is applied at cache time but not at retrieval time, the dimension-altered image may bypass safety checks.

Files

size-image/
├── size.py                         # Main script to generate collision images
├── image/
│   ├── result_A_merged_30x150.png  # Merged result displayed as 30×150
│   └── result_B_merged_150x30.png  # Merged result displayed as 150×30
└── README.md                       # This file

Usage

# Run the script to generate collision images
python size.py

Requirements

  • Python 3.x
  • NumPy
  • Pillow (PIL)
  • Matplotlib

Example Output

The script generates two PNG images from the same pixel data:

Image A (30×150) Image B (150×30)
VERTICAL text HORIZONTAL text

Both images have identical tobytes() output, demonstrating the collision.

Related

  • P-image: Palette-based image collision using identical pixel indices with different color palettes
  • sha256_coll: SHA-256 hash collision examples for images