Field instructions in legacy Word

How the text is hidden

In a Word 97-2003 file the text lives in the WordDocument stream, addressed through a piece table. A field is delimited inside that character stream by three control codes: 0x13 begins it, 0x14 separates it, 0x15 ends it. Everything between the begin and the separator is the field INSTRUCTION — PAGE, HYPERLINK "…", FORMTEXT, INCLUDETEXT, INCLUDEPICTURE — and everything after the separator is the result. Word paints the result and never the instruction.

Why a model still reads it

The instruction is ordinary text in the same stream as the body, distinguished only by two control bytes. Anything that reads the character stream rather than modelling Word's field machinery returns the instruction alongside the visible text, so a sentence written into a field code reaches a model while a reader sees only the field's result.

What we do about it

Severity is raised on the individual finding when its own concealed text matches an escalating instruction-shape family — with one caller-controlled exception: R-5d suppresses the escalation entirely when the request declares provenance: 'first-party', and the finding stays at informational.

How often it fires

81.1% of GovDocs1 legacy .doc — real government correspondence and reports, measured 2026-08-21.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.