OCR- & typografische aanvallen

from PIL import Image, ImageDraw, ImageFont
 
def typographic_attack(
    image_path: str,
    overlay_text: str,
    position: str = "bottom",
    font_size: int = 32,
    bg_opacity: int = 180
) -> Image.Image:
    """Overlay adversarial text on an image."""
    img = Image.open(image_path).convert("RGBA")
    overlay = Image.new("RGBA", img.size, (0, 0, 0, 0))
    draw = ImageDraw.Draw(overlay)
 
    try:
        font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", font_size
        )
    except OSError:
        font = ImageFont.load_default()
 
    bbox = draw.textbbox((0, 0), overlay_text, font=font)
    text_w = bbox[2] - bbox[0]
    text_h = bbox[3] - bbox[1]
 
    # Position calculation
    if position == "bottom":
        x = (img.width - text_w) // 2
        y = img.height - text_h - 20
    elif position == "top":
        x = (img.width - text_w) // 2
        y = 20
    else:  # center
        x = (img.width - text_w) // 2
        y = (img.height - text_h) // 2
 
    # Semi-transparent background for readability
    padding = 10
    draw.rectangle(
        [x - padding, y - padding, x + text_w + padding, y + text_h + padding],
        fill=(0, 0, 0, bg_opacity)
    )
    draw.text((x, y), overlay_text, fill=(255, 255, 255, 255), font=font)
 
    return Image.alpha_composite(img, overlay).convert("RGB")

def create_confusing_text_image(
    display_text: str,
    actual_instruction: str,
    width: int = 600,
    height: int = 100
) -> Image.Image:
    """
    Create an image where visible text differs from what the VLM reads.
 
    Uses Unicode lookalike characters that VLMs may interpret differently
    than humans read them.
    """
    # Unicode confusables: characters that look similar but are different
    confusables = {
        'a': '\u0430',  # Cyrillic а
        'e': '\u0435',  # Cyrillic е
        'o': '\u043e',  # Cyrillic о
        'p': '\u0440',  # Cyrillic р
        'c': '\u0441',  # Cyrillic с
        'x': '\u0445',  # Cyrillic х
    }
 
    img = Image.new("RGB", (width, height), "white")
    draw = ImageDraw.Draw(img)
    draw.text((10, 10), display_text, fill="black")
    return img

def size_hierarchy_attack(
    benign_text: str,
    malicious_text: str,
    width: int = 800,
    height: int = 400
) -> Image.Image:
    """
    Exploit text size hierarchy -- VLMs often prioritize larger text.
    Place malicious instructions in large text, benign content in small text.
    """
    img = Image.new("RGB", (width, height), "white")
    draw = ImageDraw.Draw(img)
 
    try:
        large_font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf", 48
        )
        small_font = ImageFont.truetype(
            "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf", 10
        )
    except OSError:
        large_font = ImageFont.load_default()
        small_font = large_font
 
    # Large, prominent malicious text
    draw.text((50, 50), malicious_text, fill="black", font=large_font)
    # Small, inconspicuous benign text
    draw.text((50, 300), benign_text, fill=(180, 180, 180), font=small_font)
 
    return img

def rotated_text_attack(text: str, angle: float = 180) -> Image.Image:
    """Create upside-down or rotated text that VLMs may misread."""
    img = Image.new("RGB", (400, 100), "white")
    draw = ImageDraw.Draw(img)
    draw.text((10, 10), text, fill="black")
    return img.rotate(angle, expand=True, fillcolor="white")

def fragmented_injection(parts: list[str], img_size=(800, 600)) -> Image.Image:
    """Split injection text across image quadrants."""
    img = Image.new("RGB", img_size, "white")
    draw = ImageDraw.Draw(img)
 
    positions = [
        (50, 50),                           # top-left
        (img_size[0] - 200, 50),            # top-right
        (50, img_size[1] - 50),             # bottom-left
        (img_size[0] - 200, img_size[1] - 50)  # bottom-right
    ]
 
    for i, (part, pos) in enumerate(zip(parts, positions)):
        draw.text(pos, f"({i+1}) {part}", fill="black")
 
    return img