HiddenInk: catching prompt injections tucked into PDFs

The author's path to this work started with traditional QA: automating tests so each document type was parsed properly and regressions were caught. That raised a harder question — what 'properly parsed' even means, and whether a new model does it better or cheaper — which the author says is better handled with a Golden Dataset than by grinding through documents in CI. Prompt injection came up almost as an afterthought: no one had considered it, because the tool was internal and parsing financial filings, and so was assumed free from manipulation.

The assumption did not survive a simple test. Using a quick Markdown-to-PDF generator and text from an existing filing, the author put a second earnings number under the first in white text on white, and it worked on the first try. From there the techniques multiplied: text positioned far outside the visible box, zero-height text, and a footnote instructing the agent that 'per the SEC rule change' all numbers should be reported as $1,234,567.89. Even tall text that the PDF cannot display got through.

The response is a set of single-purpose judges, each blind to some attacks by design — the author compares it to Swiss cheese, where no single slice stops a vector but enough slices make it hard to get past. Several gaps are acknowledged: the judges cannot name a payload, only a bounding box; scans without a text layer defeat some checks; and inline /ActualText substitution can make one judge confirm a payload rather than catch it. The author describes the role as 'arsonist fireman' and says the work is still in progress, with more vectors still sitting as tickets.