Hidden PDF Text Can Change AI Assistant Responses

Security researchers have demonstrated that hidden text embedded in PDFs can change outputs of AI assistants that ingest uploaded documents. In controlled tests, engineers used files that looked normal but contained extra, invisible text. When the assistants converted the PDF to plain text, they followed the concealed instructions.

Hidden material was placed in the PDF selectable text layer, in metadata, in form fields, or as invisible characters such as white type on a white background or zero-width characters. Many document-capable AI systems extract full text layers and include those elements when generating summaries or answers.

Researchers observed assistants shifting tone, inserting specific phrases, answering in a different language, or omitting sections as directed by the hidden text. In one test, a neutral-looking company report contained a concealed instruction to praise a product; after processing, the assistant added promotional language to its summary.

The technique exploits the gap between visible page images and underlying machine-readable layers. Some parsers include metadata and comments when converting PDFs to text. Zero-width joiners or other control characters can change how text is tokenized and create instruction sequences that a language model treats as prompts.

Tests reproduced the behavior across multiple systems that convert PDF content into plain text before passing it to models. The issue affects assistants used for question-and-answer workflows and automated summarization when they accept uploaded documents.

Developers are advised to add sanitization steps before sending extracted text to models. Recommended actions include stripping nonprinting characters, ignoring metadata and form fields by default, rendering pages as images and using optical character recognition selectively, and flagging discrepancies between visible and extracted text.

A security researcher who examined the exploit commented: “These document layers were never intended as attack vectors, but once a model treats every piece of extracted text as instruction, the system becomes vulnerable.” The researcher added that comparing visible content with extracted text quickly revealed concealed instructions.

Security teams classify the issue as a form of prompt-injection attack similar to previous incidents on web pages and other inputs. Providers that offer document-upload features must balance preserving machine-readable content, such as accessibility tags, with measures to prevent hidden instructions from influencing model behavior.