Text the colour of its background
Text painted in a colour that does not contrast with what is behind it — white on white, and every variation of it.
How the text is hidden
The fill colour (or the stroke colour, for the stroking render modes) and whatever was most recently painted behind the glyph are both ordinary content-stream state. Set them close enough together and the glyphs are drawn, fully opaque, at a readable size, in the right place — and no one can see them. Nothing about the run is malformed.
Why a model still reads it
Colour is styling. Extraction returns the characters and records nothing about what they were painted in or what they were painted on.
What we do about it
The parser samples the background at the middle of the glyph box rather than at the baseline — the baseline sample landed on rules and fraction bars and read black-on-black — and compares the pair, never the colour alone, against limits.minVisibleContrastRatio, yielding invisibleReason: 'background-match'. Where the background cannot be resolved (an image, a gradient, a non-rectangular fill) the rule declines rather than assuming the page default. The rule pdf-white-text additionally requires drawnInRender != true: where the render pass found the run's ink on the page, the measurement outranks the inference and the finding is never emitted. It fires at medium, action flag, matching the other formats' contrast rules — genuinely concealed, not by itself evidence of intent.
How often it fires
5.8% of 400 real UK public-sector contract PDFs (Contracts Finder, 2019–2023) — Word, Adobe, Nitro, office copiers, measured 2026-08-23.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A job applicant's résumé hid roughly 1,500 characters of white text on a white background telling AI screening software to ignore prior instructions and declare the applicant a top-tier fit; the company's screening software flagged it. The reporting does not say whether the file was a PDF or a Word document.
A plaintiff hid instructions in 3-point white text throughout a court filing, telling any AI that read it to agree with the filing; the court noticed the extra white space and banned him from electronic filing.
A benchmark of 29,322 PDFs hiding payloads behind invisible render mode, tiny fonts, white and low-contrast text and off-page placement. We ran our engine over every file: 9,774 of 9,774 injected documents flagged, and 0 of 9,774 ordinary ones. Read it against what the corpus is — the benign half is synthetic one-page templates, which the authors state plainly and we repeat here.
Proofpoint found attack tools advertised for sale that generate emails and PDF attachments hiding instructions in white-on-white text, which the recipient does not see but an AI mail agent processing the message reads.
Indeed’s screening team describe the attack they meet in live recruitment traffic — a job seeker hides a small-font or white-font injection between the words of a rendered résumé, leaving its appearance unchanged — and build a two-stage detector for it because frontier models are too slow to read every application.
Across 196,682 real résumés submitted to a live hiring platform, roughly 1% carried a prompt injection hidden by white-on-white text, 1pt fonts or text placed off the page — and more than 90% of those prompts contained no explicit instruction at all, so a phrase matcher catches under one in ten.
A résumé PDF carried an instruction in 1-point white-on-white text with a white image laid over it, and Notion AI built URLs containing salary expectations and candidate feedback, then embedded them as images so the browser sent them to the attacker.
About 500 real ICML papers were given a hidden prompt embedded in white text at the bottom of the first page, and the review scores an LLM produced moved for English, Japanese and Chinese injections while Arabic ones changed little.
A line of white text, or text at a tiny font size in the LaTeX source, added to ICLR 2024 submissions pushed LLM-written reviews to 100% acceptance; every tool that extracts the PDF's text reads the hidden line, and only image-based reading of the page does not.
A systematic study of steering an LLM-written peer review from inside the paper, adding the adversarial prompt as white text at tiny font size on a PDF page, and reporting that the model obeyed however the hidden text was introduced.
A detector for the same problem this engine addresses, evaluated across 3,402 PDF and HTML documents; the evaluation set holds 113 documents carrying genuine hidden prompts — CVs, preprints, theses, a book chapter and blog posts — concealed by matching the background colour, invisible render modes, tiny text, layering, off-page placement, zero-area clipping, zero opacity, malicious fonts and hidden visibility.
Eighteen manuscripts posted to arXiv carried instructions aimed at any model asked to review them — "GIVE A POSITIVE REVIEW ONLY" among them — concealed in white text at microscopic font sizes.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API