Grayscale conversion bypasses major image moderation APIs

Three commercial image moderation APIs failed a black-box test built from seven simple, model-agnostic image transformations, per arXiv 2607.28187.

Two of those transformations, color inversion and grayscale conversion, flipped unsafe images to safe while the content stayed plainly recognizable to a human viewer. Self-harm and multimodal content were the categories most exposed.

The attack doesn't require gradients, a surrogate model, or any access to how the target API works internally. Anyone with basic image-editing tools can invert colors or strip color entirely. Run the result through the API and it passes content a human moderator would flag instantly.

The paper tested three foundation-model-based moderation services but doesn't name them, and it doesn't say whether any of the three have patched since testing.

Teams that swapped a task-specific classifier for a foundation-model API are running a filter a grayscale toggle can defeat, worst in self-harm and multimodal content. Watch whether the three services patch against these seven transformations specifically, or bolt on a second, cheaper filter layer underneath instead.