Anamorpher is an offensive-security research tool for demonstrating and testing image-scaling prompt-injection attacks against multimodal LLM pipelines. It builds crafted images whose hidden instructions surface only after the target system's internal downscaling step, exploiting the gap between what a human uploader sees and what the model actually ingests. Vendor/maintainer claims: the tool generates payloads tuned to bicubic, bilinear, and nearest-neighbor downscaling and can compare effectiveness across OpenCV, PyTorch, TensorFlow, and Pillow implementations, with a modular design for custom scalers; a web frontend visualizes payloads alongside a Python API. Buyer framing: this is a red-team / evaluation tool, not a runtime firewall or defense â it produces attack inputs to probe your own multimodal stack, not a guardrail you deploy in production. The maintainers explicitly caveat that results are probabilistic, vary by scaling implementation, and can be defeated by additional image transforms â treat it as a testing lens, not a guaranteed exploit. Best fit for AppSec/ML-security teams and red-teamers validating multimodal ingestion defenses.
Anamorpher
Craft image-scaling prompt-injection payloads to red-team multimodal AI systems
Open-source red-team toolkit from Trail of Bits that generates image-scaling attack payloads â images that look benign at full resolution but reveal a hidden prompt injection once a multimodal model downscales them during preprocessing.
Pricing
Free and open source (Apache-2.0). No paid tier, accounts, or hosted service.
Platforms
Python 3.11+ library plus a web frontend; runs entirely locally, cross-platform. No cloud dependency or vendor account.
Categories
Tags
Alternatives
garak
NVIDIA's LLM vulnerability scanner and red-teaming tool
garak is NVIDIA's open-source LLM vulnerability scanner for red-teaming AI models and applications. Probes for prompt injection, data leakage, hallucination, toxicity, encoding-based attacks, and dozens of other vulnerability categories. Runs automated attack sequences against any LLM endpoint and generates detailed vulnerability reports. Features a modular probe/detector architecture that is extensible with custom attack patterns. Named after the Star Trek character known for deception.
PurpleLlama
Meta's open-source LLM security suite with Llama Guard and CodeShield
PurpleLlama is Meta's open-source suite of tools for evaluating and improving LLM safety. It includes Llama Guard models for input/output content safety classification, LlamaFirewall for multi-layer defense, CodeShield for insecure code detection, and CyberSecEval benchmarks for measuring LLM security. Llama Guard 4 supports multimodal safety across text and images. 4,100+ GitHub stars, backed by Meta AI with 44+ contributors.
DeepTeam
Open-source LLM red-teaming framework with 40+ attack types
DeepTeam is an open-source red-teaming framework for systematically testing LLM applications against 40+ adversarial attack types. It covers OWASP Top 10 for LLMs including jailbreaks, prompt injection, PII leakage, and hallucination attacks. Built as the sister project of DeepEval for security testing alongside evaluation. Apache-2.0 licensed.
Related Tools
CAI (Cybersecurity AI)
AI agent framework for offensive security and penetration testing
Alias Robotics' agent framework for building AI-driven offensive-security workflows — reconnaissance, exploitation, privilege escalation, and lateral movement — with multi-agent handoffs and human-in-the-loop control. Source-available, but the core is licensed for non-commercial research use only.
MEDUSA
AI-first security scanner for LLM, agent, MCP, and RAG codebases
MEDUSA is an AGPL-3.0 AI-first security scanner from Pantheon Security that checks AI and machine-learning applications, LLM agents, MCP workflows, RAG pipelines, repository-poisoning risks, secrets, and agent-specific compromise patterns.
iFixAi
Open-source diagnostic for AI operational misalignment
iFixAi is an Apache-2.0 diagnostic tool for scoring AI agents and models against operational-misalignment risks such as hallucination, manipulation, sabotage, sandbagging, and oversight evasion.
Inspect AI
UK AI Security Institute framework for LLM safety evaluations
Inspect AI is an MIT-licensed framework from the UK AI Security Institute for running large language model evaluations, including tool use, multi-turn dialogue, model-graded scoring, and reusable evaluation tasks.
Presidio
Open-source PII detection and anonymization for AI data flows
Presidio is an MIT-licensed privacy framework for identifying and anonymizing personally identifiable information in text, images, and structured data. It can act as a de-identification layer around LLM prompts, logs, RAG corpora, and customer-data workflows.
Agent Governance Toolkit
Microsoft’s public-preview runtime governance toolkit for policy, identity, sandboxing, audit, and MCP security around AI agents.
Agent Governance Toolkit is Microsoft’s MIT-licensed public-preview toolkit for governing AI agent runtimes. It adds policy enforcement, zero-trust identity, execution sandboxing, audit, reliability, and MCP security-gateway patterns around tool calls and autonomous actions, helping platform teams move beyond prompt-only guardrails while preserving architecture review requirements.