technique reference · by file type
Hidden text in PDF files
A PDF can carry text that never appears on the page. It can be drawn in an invisible rendering mode, set in white on a white background, shrunk below readable size, placed outside the page, or covered by an image. A person reading the document sees none of it.
A text extractor, and any AI model fed its output, reads all of it. That is how hidden prompt injection reaches a model through a PDF: the instruction is in the file, not on the page. Each technique below is one way the text is hidden, how we detect it, and what we still miss.
pdf.annotation-rich-textA PDF comment carries two bodies — the formatted one a reviewer reads and the plain one an extractor reads — and they do not agree.pdf.blank-glyphThe font maps the codes a run actually draws to glyphs that have no outline, so the word takes up space on the page and paints nothing while `/ToUnicode` still spells it out.pdf.cmap-divergenceThe character the document claims for a code is not the glyph that code actually draws, so the page reads one way and the extracted text reads another.pdf.hidden-annotationA comment or form-field value carrying text that the annotation's own flags tell the viewer not to show.pdf.hidden-layerThe document's own catalogue records that a layer is off, and text inside it is never drawn while every extractor reads it perfectly.pdf.occluded-textText drawn normally and then painted over — by a rectangle, a picture, or a gradient — so the reviewer sees the cover and the extractor reads what is underneath.pdf.ocr-text-layerA page whose text is essentially all invisible over a page image — the ordinary searchable-scan construction, reported so the record is complete rather than because anything is wrong.pdf.offpage-textText positioned beyond the page boundary, so no viewer draws it and every extractor still reads it.pdf.render-mode-3Text drawn in the rendering mode that paints no glyphs at all, on a page that also carries visible text.pdf.scan-microtextOn a page that is only pixels, a run of consecutive words drawn far smaller than the page's own body text — read cleanly by OCR, skimmed past by a person.pdf.signature-invalidatedNot a concealment technique — a disclosure that the source PDF was digitally signed and the cleaned artifact returned is no longer the signed bytes.pdf.tiny-fontText set at a size a person cannot resolve, in a format where extraction ignores size entirely.pdf.uninspected-embedded-fileA disclosure that the PDF carries an attached file whose bytes this engine could not analyse, so its contents were not examined.pdf.vision-divergenceA run the structural analysis already suspected, confirmed by rendering the page and finding the text is not on it — the one PDF rule that removes anything.pdf.vision-value-divergenceA visible run carrying a number that the rendered page does not show — the corrupted-encoding attack caught where the structural check is blind.pdf.white-textText painted in a colour that does not contrast with what is behind it — white on white, and every variation of it.pdf.zero-area-glyphText scaled by the text matrix until it puts no resolvable mark on the page, in either dimension.pdf.zero-opacityText drawn with a fill alpha low enough that it renders nothing at all.