Multi-modal prompt injection image attacks against GPT-4V