Type too small to read
Text set at a size a person cannot resolve, in a format where extraction ignores size entirely.
How the text is hidden
A run's rendered size is the font size composed through the text matrix and the current transformation matrix, so a small Tf value is only one way to get there — scaling by the matrix reaches the same place. The glyphs are painted in the ordinary way, in an ordinary colour, on the page; they are simply below the size at which a reader can make them out.
Why a model still reads it
Font size is styling. Text extraction returns the characters, and nothing in the extracted string records how large they were drawn.
What we do about it
invisibleReason returns 'sub-readable' either when the run marks nothing at all (see the zero-area rule) or when the rendered height is at or below limits.subReadableMaxFontSizePt, read from the rule pack rather than compared against a literal. The rule pdf-tiny-font fires on that reason at high, action flag, and explicitly excludes runs carrying the scanned-page microtext flag, which is a different kind of evidence and gets its own technique.
How often it fires
3.1% of CUAD — 510 real commercial contracts (EDGAR EX-10 exhibits), bulk-converted from HTML by Aspose/EVO, measured 2026-08-17.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A plaintiff hid instructions in 3-point white text throughout a court filing, telling any AI that read it to agree with the filing; the court noticed the extra white space and banned him from electronic filing.
PromptArmor showed that a PDF uploaded to Atlassian's Rovo assistant could carry an instruction set in transparent colour at one pixel, telling it to gather sensitive data and post it to an attacker's URL — with no approval click and no warning.
A benchmark of 29,322 PDFs built from 4,983 real documents, injecting payloads through invisible render mode, tiny fonts, white and low-contrast text and off-page placement — every one of which is a technique we detect.
Across 196,682 real résumés submitted to a live hiring platform, roughly 1% carried a prompt injection hidden by white-on-white text, 1pt fonts or text placed off the page — and more than 90% of those prompts contained no explicit instruction at all, so a phrase matcher catches under one in ten.
A résumé PDF carried an instruction in 1-point white-on-white text with a white image laid over it, and Notion AI built URLs containing salary expectations and candidate feedback, then embedded them as images so the browser sent them to the attacker.
Eighteen manuscripts posted to arXiv carried instructions aimed at any model asked to review them — "GIVE A POSITIVE REVIEW ONLY" among them — concealed in white text at microscopic font sizes.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API