Hi @kiki-morozova @suhacker1 @dguido — the anamorpher work and the Trail of Bits "Weaponizing image scaling against production AI systems" blog post have been on my reading list since publication. I maintain Agent Threat Rules (ATR), an MIT-licensed YAML detection-rule library (462 rules, 10 categories) shipped in Microsoft Agent Governance Toolkit (PR microsoft/agent-governance-toolkit#1277, 287 rules), Cisco AI Defense skill-scanner (PR cisco-ai-defense/skill-scanner#99, 314 rules), MISP via CIRCL Luxembourg (PR MISP/misp-galaxy#1207, 336 rules), and Microsoft PyRIT (PR microsoft/PyRIT#1715, merged 2026-05-27 by Roman Lutz).
ATR currently has nothing in the multimodal / image-scaling injection space — none of our 10 categories cover it. I want to propose a new multimodal_injection category, and the seed content would be ATR rules that detect:
- Image dimensions that imply downscale-target manipulation (preprocessing-time check)
- Hash + perceptual-hash mismatches between original / downscaled (post-scaling check)
- Known-bad bicubic / bilinear coefficients from anamorpher payload corpus (if you'd share representative test fixtures)
The ATR rules would be authored as detection signatures with explicit Trail of Bits attribution (source_research: trailofbits/anamorpher, references: blog.trailofbits.com/...) and the rule fixtures linked back to anamorpher's payload generators where they exist.
Two questions:
- Would you be open to ATR citing anamorpher + the blog post as the canonical research source for this category?
- Is there a small set of representative test images (or scaling parameters + algorithm fingerprints) you'd be comfortable seeing in an MIT-licensed public rule corpus?
If the answer is "we'd rather hold the research private for now", I'll defer the category. Just want to ask first.
ATR repo: https://github.com/Agent-Threat-Rule/agent-threat-rules
Hi @kiki-morozova @suhacker1 @dguido — the anamorpher work and the Trail of Bits "Weaponizing image scaling against production AI systems" blog post have been on my reading list since publication. I maintain Agent Threat Rules (ATR), an MIT-licensed YAML detection-rule library (462 rules, 10 categories) shipped in Microsoft Agent Governance Toolkit (PR microsoft/agent-governance-toolkit#1277, 287 rules), Cisco AI Defense skill-scanner (PR cisco-ai-defense/skill-scanner#99, 314 rules), MISP via CIRCL Luxembourg (PR MISP/misp-galaxy#1207, 336 rules), and Microsoft PyRIT (PR microsoft/PyRIT#1715, merged 2026-05-27 by Roman Lutz).
ATR currently has nothing in the multimodal / image-scaling injection space — none of our 10 categories cover it. I want to propose a new
multimodal_injectioncategory, and the seed content would be ATR rules that detect:The ATR rules would be authored as detection signatures with explicit Trail of Bits attribution (
source_research: trailofbits/anamorpher,references: blog.trailofbits.com/...) and the rule fixtures linked back to anamorpher's payload generators where they exist.Two questions:
If the answer is "we'd rather hold the research private for now", I'll defer the category. Just want to ask first.
ATR repo: https://github.com/Agent-Threat-Rule/agent-threat-rules