Text that matches its background

docx.white-text

A run's colour is too close to whatever is painted behind it for the text to be legible.

How the text is hidden

The colour comes from w:color on the run or a style, resolved through word/theme/theme1.xml with the colour mapping in settings.xml applied. The ground is whichever of run shading, run highlight, paragraph shading, table cell fill, shape fill or page background is nearest. White on white is the ordinary spelling, but any pair that does not contrast qualifies.

Why a model still reads it

Colour is applied at render time. The characters in the part are the same bytes whether they are painted black on white or white on white.

What we do about it

The parser computes a contrast ratio between the resolved foreground and the resolved ground and marks the run background-match when it falls below limits.minVisibleContrastRatio, read from the rule pack. Automatic colour follows Word's own rule — black on a light ground, white on a dark one — rather than defaulting to black. Where the ground cannot be named (a transparent floating box under a filled floating shape large enough to cover it, or a table whose fill lives in its style) the contrast check is skipped and a coverage gap is recorded instead of a finding. The rule fires at medium, action flag; the text is not removed, because white-on-shaded and legitimately styled fine print both exist.

How often it fires

0.50% of open-data portal DOCX — 200 real government publications (corpus-ckandocx at its current size), measured 2026-08-28.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.

Seen in the wild

29 Jul 2026 · The Register · research
Word worm crawls into Copilot, spreads chaos

A researcher showed that small white text in a Word document could tell Copilot to alter financial figures and copy the same instructions into every document it generated — a worm, disclosed after 144 days without a fix.

Every recorded incident, across all techniques.

next

Check your own file

Three commands: a key, credit, a verdict.

Start with the API