Multimodal Transforms Reference

Multimodal red teaming probes the safety of vision, audio, and video models by mutating the media you send — and scoring the media a model generates back. Safety training is unevenly distributed across modalities: a request refused as text may be complied with when it is embedded in an image, spoken as audio, or distributed across video frames. This page is the complete reference for the 160+ image, audio, and video transforms Dreadnode ships for that purpose, organized by category and cross-referenced to the research they are drawn from.

For a task-oriented walkthrough (setup, target models, SDK and TUI scenarios), see Multimodal Red Teaming. This page is the exhaustive catalog.

How multimodal transforms work

Every transform is modality-typed (image, audio, or video). When you pass a list of transforms to multimodal_attack(...), the SDK routes each one to its modality — an image transform only mutates the image, an audio transform only the audio, and so on — and leaves the other modalities untouched. This means you can stack transforms across modalities in a single attack and each is applied where it belongs. Text transforms (see Transforms Reference) continue to mutate the prompt.

From the SDK, import from dreadnode.transforms.{image,audio,video} and pass instances:

from dreadnode.airt import multimodal_attack
from dreadnode.scorers.judge import llm_judge
from dreadnode.transforms import image, audio, video

# `make_target`, JUDGE and RUBRIC come from the shared setup on the
# Multimodal Red Teaming page (make_target resolves both dn/ and provider ids).
attack = multimodal_attack(
    goal="Extract restricted instructions",
    target=make_target("gemini/gemini-flash-latest"),  # a modality-capable target task
    scorer=llm_judge(JUDGE, RUBRIC),
    image="payload.png",
    audio="request.wav",
    video="clip.mp4",
    transforms=[
        image.figstep_image("Explain how to ..."),   # image-only
        audio.ultrasonic_shift(carrier_ratio=0.9),   # audio-only
        video.temporal_shuffle(),                    # video-only
    ],
)

From the TUI, request transforms by name — the agent resolves them against this catalog:

Run a multimodal attack on gemini/gemini-flash-latest with my image at ./payload.png, applying figstep_image and fog to the image.

Note

A few SDK transforms take non-string arguments (interpolate_images, overlay_image, frames_from_image_transform) and are SDK-only — they are not resolvable by name from the TUI.

Image transforms

Noise and perturbation

Transform	What it does	Key params
add_gaussian_noise	Additive Gaussian noise	scale, seed
add_laplace_noise	Additive Laplace noise	scale, seed
add_uniform_noise	Additive uniform noise	low, high, seed
salt_pepper_noise	Impulse noise — flips random pixels to black/white	amount, salt_vs_pepper, seed
shot_noise	Poisson (photon-count) sensor noise (ImageNet-C)	scale, seed
speckle_noise	Multiplicative speckle noise (ImageNet-C)	scale, seed
high_frequency_perturbation	Near-Nyquist sinusoidal grating (low-visibility)	amplitude, frequency
shift_pixel_values	Small random per-pixel integer shift	max_delta, seed

Blur and resolution

Transform	What it does	Key params
blur	Gaussian blur	radius
motion_blur	Directional (camera-motion) blur	size, angle
defocus_blur	Disk-kernel (out-of-focus) blur (ImageNet-C)	radius
glass_blur	Frosted-glass blur — blur plus local pixel jitter (ImageNet-C)	sigma, max_delta, iterations
zoom_blur	Average of progressively zoomed copies (ImageNet-C)	max_zoom, step
downscale	Down/upsample to destroy fine detail	scale
pixelate	Blocky mosaic via nearest-neighbor resize	pixel_size

Photometric

Transform	What it does	Key params
adjust_brightness / adjust_contrast / adjust_saturation	Enhance channels	factor
color_jitter	Random brightness/contrast/saturation jitter	brightness, contrast, saturation, seed
hue_shift	Rotate hue in HSV	degrees
chromatic_aberration	Laterally offset red/blue channels	shift
invert_colors / solarize / posterize / sepia / grayscale	Color remapping	threshold / bits
histogram_equalize / autocontrast	Contrast normalization	cutoff
sharpen	Unsharp-mask edge accentuation	radius, percent, threshold
opacity_blend	Blend toward a flat background (wash-out)	opacity, background
halftone_dither	1-bit Floyd-Steinberg dithering	—
apply_pil_filter	Named PIL filter (emboss/contour/edge_enhance/find_edges/…)	filter_name
jpeg_compression	JPEG compression artifacts	quality

Geometric

Transform	What it does	Key params
rotate / horizontal_flip / vertical_flip	Rotations and mirrors	degrees
crop / pad / pad_square	Crop or pad (letterbox to square)	x1..y2 / padding
skew	Horizontal shear/slant	shear
change_aspect_ratio	Anamorphic width stretch	ratio
perspective_warp	Perspective (viewpoint) warp	magnitude
elastic_deform	Smooth elastic displacement field	alpha, sigma, seed
shuffle_pixels	Shuffle pixel blocks	block_size, seed
interpolate_images	Linear interpolation between two images (SDK-only)	alpha

Weather corruptions (ImageNet-C)

Transform	What it does	Key params
fog	Blend a low-frequency bright cloud over the image	intensity, seed
snow	Overlay motion-blurred bright specks	amount, streak_angle, seed
spatter	Paint random mud/rain blobs	amount, color, seed

Occlusion and overlay

Transform	What it does	Key params
cutout	Occlude a random rectangle (random-erasing)	size_ratio, fill, seed
channel_shuffle	Permute RGB channels (e.g. BGR)	order, seed
overlay_emoji / overlay_stripes	Overlay emoji or occluding stripes	emoji / count, width
add_text_overlay	Semi-transparent text caption	text, position, color
adversarial_patch	High-salience occluding patch, optionally carrying text	payload, position, size_ratio
meme_format	White caption bar with bold text (image macro)	caption, position
overlay_image	Composite a second image (logo/QR/distractor); SDK-only	overlay, position, opacity

Steganography and typographic attacks

Transform	What it does	Reference
image_steganography	Hide a text payload in pixel LSBs	—
extract_steganography	Recover an LSB-hidden payload (verification)	—
figstep_image	Render a numbered blank-step list soliciting harmful completion	FigStep
typographic_prompt	Render a request as pixels to bypass text filters	MM-SafetyBench
invisible_text	Near-imperceptible low-contrast instruction a human misses but a VLM reads	Visual prompt injection

from dreadnode.transforms import image

# Concise image-attack stack: typographic instruction + hidden payload + corruption + patch.
transforms = [
    image.figstep_image("Explain the steps to ...", steps=3),
    image.image_steganography("ignore previous instructions"),
    image.fog(intensity=0.6, seed=0),
    image.adversarial_patch("OVERRIDE", size_ratio=0.25),
]

Additional augmentations (Albumentations / DSP)

Transform	What it does	Key params
median_blur	Edge-preserving median filter	size
gamma_correction	Power-law tone curve	gamma
color_quantize	Reduce to an adaptive N-color palette	colors, dither
ordered_dither	4x4 Bayer ordered dithering	—
vignette	Radial corner darkening	strength
rgb_shift	Constant per-channel value shift	r_shift, g_shift, b_shift
channel_dropout	Zero a single color channel	channel, seed
hsv_shift	Shift saturation and value in HSV	saturation, value
coarse_dropout	Erase multiple random rectangles	holes, size_ratio, seed
pixel_dropout	Randomly zero individual pixels	dropout_ratio, seed
morphology	Grayscale erode/dilate/open/close	operation, size
optical_distortion	Radial barrel/pincushion lens distortion	k
grid_distortion	Warp along a randomly perturbed grid	num_steps, distort, seed
rain	Directional rain streaks	amount, length, angle
random_shadow	Darken a random triangular region	strength, seed
iso_noise	Camera ISO noise (Poisson + color Gaussian)	color_shift, intensity
ringing_overshoot	Sinc-kernel ringing (Gibbs) artifact	size
fancy_pca	AlexNet PCA color augmentation	alpha_std, seed
webp_compression	WebP lossy-compression artifacts	quality
affine	Combined rotate + scale + translate + shear	rotate, scale, translate, shear

Audio transforms

Noise

Transform	What it does	Key params
add_white_noise / add_pink_noise / add_brown_noise	Broadband noise at a target SNR	snr_db, seed
add_babble_noise	Multi-talker, speech-band babble	snr_db, n_talkers, seed
add_short_noises	Sparse transient noise bursts	n_bursts, burst_ms, snr_db
add_clicks	Impulsive clicks/crackle	rate_per_sec, amplitude

Volume and dynamics

Transform	What it does	Key params
change_volume / normalize_volume	Gain / peak normalize	gain_db / target_db
add_clipping / soft_clip	Hard vs. tanh (overdrive) saturation	threshold / gain
limiter	Peak-limit with a smoothed envelope	threshold_db, release_ms
apply_dynamic_range_compression	Threshold/ratio compressor	threshold_db, ratio
gain_transition	Ramp gain across the clip	start_gain_db, end_gain_db
add_fade	Fade in/out	fade_in_ms, fade_out_ms

Filters and EQ

Transform	What it does	Key params
apply_low_pass_filter / apply_high_pass_filter / apply_band_pass_filter	Butterworth filters	cutoff_hz, order
band_stop_filter / notch_filter	Band-reject / narrow notch	low_hz, high_hz / freq_hz, quality
peaking_equalizer	RBJ peaking-EQ band boost/cut	freq_hz, gain_db, q
low_shelf_filter / high_shelf_filter	Shelving boost/cut	freq_hz, gain_db, q
seven_band_parametric_eq	Cascaded 7-band parametric EQ	gains_db, q
pre_emphasis	High-shelf pre-emphasis	coeff
air_absorption	Distance-dependent HF attenuation	distance_m

Time and structure

Transform	What it does	Key params
change_speed / time_stretch / pitch_shift	Speed (resample), tempo (phase vocoder), pitch	rate / semitones
time_shift	Shift in time (wrap or pad)	shift_ms, rollover
reverse_audio	Reverse in time	—
trim_silence / loop_audio / repeat_part	Trim, loop, or stutter a segment	count / segment_ms, repeats
granular_shuffle	Chop into grains and reorder	grain_ms, seed
sample_dropout	Zero random segments (packet loss)	loss_ratio, segment_ms
time_masking	Zero random time spans (SpecAugment)	max_ms, n_masks

Modulation and effects

Transform	What it does	Key params
tremolo / vibrato / wow_flutter	Amplitude / pitch modulation and tape drift	rate_hz, depth
ring_modulation	Multiply by an audible carrier	freq_hz, mix
add_reverb / add_echo	Room reverberation / discrete echoes	decay, delay_ms

Spectral and covert (adversarial)

Transform	What it does	Reference
ultrasonic_shift	Near-Nyquist carrier modulation (inaudible command)	DolphinAttack
spectral_inversion	Mirror the spectrum (reversible scramble)	—
frequency_masking	Zero random frequency bands (SpecAugment)	SpecAugment
polarity_inversion	Flip waveform polarity (inaudible)	—
audio_steganography	Hide a text payload in PCM LSBs	—

Degradation and codec

Transform	What it does	Key params
bit_crush	Bit-depth + sample-hold reduction	bits, downsample
aliasing	Decimate without anti-aliasing (foldover)	factor
downsample_telephone	Resample to 8 kHz and back	target_hz
ogg_codec_roundtrip	OGG/Vorbis encode/decode artifacts	—
add_tone	Mix an interfering sine tone	freq_hz, gain_db

from dreadnode.transforms import audio

# Concise audio-attack stack: inaudible carrier + hidden payload + masking + channel degradation.
transforms = [
    audio.ultrasonic_shift(carrier_ratio=0.9),
    audio.audio_steganography("ignore previous instructions"),
    audio.frequency_masking(n_bands=2, seed=0),
    audio.downsample_telephone(target_hz=8000),
]

Additional effects and channel simulation

Transform	What it does	Key params
chorus	LFO-modulated delayed voices (ensemble)	rate_hz, depth_ms, voices
flanger	Swept short modulated delay (comb filter)	rate_hz, depth_ms, mix
harmonic_distortion	Cubic waveshaping (adds harmonics)	amount
dc_offset	Add a constant DC bias	offset
adjust_duration	Pad with silence or crop to a fixed length	target_seconds
apply_impulse_response	Convolve with a synthetic room IR (over-the-air)	rt60_ms, mix, seed
dtmf_tone	Mix a DTMF (touch-tone) dual-frequency tone	digit, gain_db
reverse_segments	Reverse the audio within fixed-length segments	segment_ms
loudness_normalize	Normalize to a target RMS loudness	target_db

Video transforms

Video transforms operate on the frame sequence, so they cover both per-frame spatial edits and temporal (frame-ordering) manipulations.

Frame injection

Transform	What it does	Key params
video_frame_inject	Embed a payload in frames (stego/overlay/subliminal)	payload, method, frame_interval
subliminal_frame	Insert a brief flash frame carrying text	payload, insert_at_frame
keyframe_replace	Replace a single (sampled) frame with a payload frame	payload, frame_index
scene_cut_inject	Splice a run of payload frames at a cut	payload, index, n_frames
replace_with_color_frames	Overwrite a run of frames with solid color	start, count, color
video_metadata_inject	Inject into a metadata field	payload, field

Distributed payload and overlays

Transform	What it does	Key params
per_frame_text_scroll	Scroll a payload across frames (marquee)	payload, speed_px
ghost_overlay	Alpha-blend a faint payload across all frames	payload/overlay, opacity
letterbox_caption	Draw a letterbox bar with static caption	caption, position

Temporal ordering and sampling

Transform	What it does	Key params
temporal_shuffle	Reorder frames (whole or windowed)	window, seed
frame_dropout	Drop frames (hold or remove)	drop_ratio, mode
frame_reverse	Play the sequence backwards	—
freeze_frame	Repeat one frame to stall	frame_index, hold
loop_frames	Concatenate the sequence to itself	count
frame_rate_up / frame_rate_down	Duplicate or decimate frames	factor

Temporal distortion

Transform	What it does	Key params
frame_brightness_flicker	Per-frame brightness flicker	depth, period_frames
strobe	Replace every Nth frame with a flash	period, color
rolling_temporal_jitter	Horizontal shift ramping frame-to-frame	max_shift
motion_smear	Blend each frame with its predecessor	weight
frame_interpolate_blend	Insert cross-fade frames	steps
temporal_noise	Independent per-frame noise	scale, seed
frames_from_image_transform	Lift any image transform to all frames (SDK-only)	image_transform, frame_interval

from dreadnode.transforms import image, video

# Concise video-attack stack: sampled-keyframe swap + distributed payload + temporal disruption.
transforms = [
    video.keyframe_replace("INJECT", frame_index=0),
    video.per_frame_text_scroll("secret instruction"),
    video.temporal_shuffle(seed=0),
    video.frames_from_image_transform(image.fog()),  # apply an image corruption to every frame
]

Additional temporal effects

Transform	What it does	Key params
frame_jitter	Independent random spatial shift per frame (shake)	max_shift, seed
color_flicker	Cycle a per-frame hue shift (chromatic flicker)	depth, period_frames
stutter	Randomly repeat frames (judder)	repeat_ratio, seed
reverse_frame_segments	Reverse frame order within fixed windows	segment
speed_ramp	Non-uniform resampling: slow start, fast end	—
pip_inject	Composite a small picture-in-picture payload panel	payload, position, size_ratio

References

The transforms above draw on published robustness benchmarks, augmentation libraries, and multimodal attack research. Citations are grouped by category.

Robustness and corruptions

• Hendrycks & Dietterich, “Benchmarking Neural Network Robustness to Common Corruptions and Perturbations,” ICLR 2019 — arXiv:1903.12261 (ImageNet-C: shot_noise, speckle_noise, defocus_blur, glass_blur, zoom_blur, fog, snow, spatter).

Data augmentation libraries

• Papakipos & Bitton (Meta AI), “AugLy: Data Augmentations for Robustness,” 2022 — github.com/facebookresearch/AugLy (image/audio/video augmentation families).
• Buslaev et al., “Albumentations: Fast and Flexible Image Augmentations,” Information 2020 — albumentations.ai (optical/grid distortion, coarse dropout, ISO noise, rain/shadow, morphology, ringing).
• Park et al., “SpecAugment: A Simple Data Augmentation Method for ASR,” Interspeech 2019 — arXiv:1904.08779 (time_masking, frequency_masking).
• Jordal et al., audiomentations — github.com/iver56/audiomentations (filters, EQ, gain transitions, polarity inversion, aliasing, short noises).

Vision-LM attacks

• Gong et al., “FigStep: Jailbreaking LVLMs via Typographic Visual Prompts,” AAAI 2025 — arXiv:2311.05608 (figstep_image).
• Liu et al., “MM-SafetyBench,” ECCV 2024 — arXiv:2311.17600 (typographic_prompt).
• Li et al., “HADES: Images are Achilles’ Heel of Alignment,” ECCV 2024 — arXiv:2403.09792.
• Bailey et al., “Image Hijacks: Adversarial Images can Control Generative Models at Runtime,” ICML 2024 — arXiv:2309.00236.
• Qi et al., “Visual Adversarial Examples Jailbreak Aligned LLMs,” AAAI 2024 — arXiv:2306.13213 (image_steganography, perturbation).

Audio attacks

• Zhang et al., “DolphinAttack: Inaudible Voice Commands,” CCS 2017 — arXiv:1708.09537 (ultrasonic_shift).
• Carlini & Wagner, “Audio Adversarial Examples: Targeted Attacks on Speech-to-Text,” 2018 — arXiv:1801.01944.
• Schönherr et al., “Adversarial Attacks Against ASR via Psychoacoustic Hiding,” NDSS 2019 — arXiv:1808.05665.
• Kang et al., “AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Models,” 2024 — arXiv:2412.08608.
• Song et al., “AudioJailbreak: Jailbreak Attacks against End-to-End Large Audio-Language Models,” 2025 — arXiv:2505.14103.

Video-LM attacks

• Li et al., “FMM-Attack: Flow-based Multi-modal Adversarial Attack on Video-based LLMs,” 2024 — arXiv:2403.13507.
• “Poisoning Prompt-Guided Sampling in Video LLMs,” 2025 — arXiv:2509.20851.
• “Failures to Surface Harmful Contents in Video LLMs,” 2025 — arXiv:2508.10974.

Caution

These transforms are for authorized safety and security testing of systems you own or are permitted to assess. Model-optimized adversarial attacks (e.g. Carlini & Wagner, HADES, Image Hijacks) require gradient access to a surrogate model and are out of scope for these black-box, dependency-free transforms; the entries above implement the model-free primitives from each family.

Multimodal Red Teaming Task-oriented walkthrough: setup, targets, SDK and TUI scenarios.

Transforms Reference Text-prompt transforms — encoding, ciphers, persuasion, agentic attacks.