Text the colour of its background
Text painted in a colour that does not contrast with what is behind it — white on white, and every variation of it.
How the text is hidden
The fill colour (or the stroke colour, for the stroking render modes) and whatever was most recently painted behind the glyph are both ordinary content-stream state. Set them close enough together and the glyphs are drawn, fully opaque, at a readable size, in the right place — and no one can see them. Nothing about the run is malformed.
Why a model still reads it
Colour is styling. Extraction returns the characters and records nothing about what they were painted in or what they were painted on.
What we do about it
The parser samples the background at the middle of the glyph box rather than at the baseline — the baseline sample landed on rules and fraction bars and read black-on-black — and compares the pair, never the colour alone, against limits.minVisibleContrastRatio, yielding invisibleReason: 'background-match'. Where the background cannot be resolved (an image, a gradient, a non-rectangular fill) the rule declines rather than assuming the page default. The rule pdf-white-text additionally requires drawnInRender != true: where the render pass found the run's ink on the page, the measurement outranks the inference and the finding is never emitted. It fires at medium, action flag, matching the other formats' contrast rules — genuinely concealed, not by itself evidence of intent.
How often it fires
5.8% of 400 real UK public-sector contract PDFs (Contracts Finder, 2019–2023) — Word, Adobe, Nitro, office copiers, measured 2026-08-23.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A plaintiff hid instructions in 3-point white text throughout a court filing, telling any AI that read it to agree with the filing; the court noticed the extra white space and banned him from electronic filing.
A benchmark of 29,322 PDFs built from 4,983 real documents, injecting payloads through invisible render mode, tiny fonts, white and low-contrast text and off-page placement — every one of which is a technique we detect.
Across 196,682 real résumés submitted to a live hiring platform, roughly 1% carried a prompt injection hidden by white-on-white text, 1pt fonts or text placed off the page — and more than 90% of those prompts contained no explicit instruction at all, so a phrase matcher catches under one in ten.
A résumé PDF carried an instruction in 1-point white-on-white text with a white image laid over it, and Notion AI built URLs containing salary expectations and candidate feedback, then embedded them as images so the browser sent them to the attacker.
Eighteen manuscripts posted to arXiv carried instructions aimed at any model asked to review them — "GIVE A POSITIVE REVIEW ONLY" among them — concealed in white text at microscopic font sizes.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API