Anamorpher is Trail of Bits' Apache-2.0 red-team and evaluation toolkit for crafting image-scaling attacks against multimodal AI systems. The attack exploits a preprocessing gap: an uploaded image can look harmless at its original resolution, then reveal hidden instructions after an application resizes it before passing it to a vision-language model. That makes Anamorpher useful for testing whether a multimodal ingestion pipeline creates a mismatch between what a human reviewer sees and what the model receives.
The project provides both a browser-based frontend and a Python API. Maintainer-documented payload generators cover selected bicubic, bilinear, and nearest-neighbor downscaling implementations, while the comparison interface lets teams test behavior across OpenCV, PyTorch, TensorFlow, and Pillow. Its modular backend also accepts a custom scaler, which matters when an internal image service uses different interpolation settings from common libraries.
Treat Anamorpher as an attack-generation and validation tool, not a runtime firewall, malware scanner, or production guardrail. The maintainers label it active beta and warn that results are probabilistic: they recommend running each example five times, note that extra image transformations can disrupt the payload, and explain that anti-aliasing and library-specific optimizations change effectiveness. Windows users are directed to WSL2 because of TensorFlow dependencies.
Best fit is an authorized AppSec, ML-security, or red-team exercise that can reproduce the exact resize path used in production. A useful test plan records the source image, target dimensions, interpolation library, repeated-run success rate, and any normalization or transcoding applied before inference. Pair the findings with defensive controls such as eliminating hidden resizes, previewing the post-processed image, constraining image dimensions, and treating image-derived instructions as untrusted input. Do not use it against systems you do not own or have permission to test.
