Image Hijacks: Adversarial Images can Control Generative Models at Runtime