Pith. sign in

REVIEW 4 cited by

Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2505.16957 v1 pith:IMCIQRSZ submitted 2025-05-22 cs.CR cs.AI

Invisible Prompts, Visible Threats: Malicious Font Injection in External Resources for Large Language Models

Junjie Xiong , Changjia Zhu , Shuhang Lin , Chong Zhang , Yongfeng Zhang , Yao Liu , Lingyao Li This is my paper
classification cs.CR cs.AI
keywords externalmaliciouscontentfontpromptsresourcesdatainjection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
read the original abstract

Large Language Models (LLMs) are increasingly equipped with capabilities of real-time web search and integrated with protocols like Model Context Protocol (MCP). This extension could introduce new security vulnerabilities. We present a systematic investigation of LLM vulnerabilities to hidden adversarial prompts through malicious font injection in external resources like webpages, where attackers manipulate code-to-glyph mapping to inject deceptive content which are invisible to users. We evaluate two critical attack scenarios: (1) "malicious content relay" and (2) "sensitive data leakage" through MCP-enabled tools. Our experiments reveal that indirect prompts with injected malicious font can bypass LLM safety mechanisms through external resources, achieving varying success rates based on data sensitivity and prompt design. Our research underscores the urgent need for enhanced security measures in LLM deployments when processing external content.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

    cs.CR 2026-06 unverdicted novelty 7.0

    ShareLock applies Shamir's threshold scheme to distribute poisoning payloads across multiple MCP tool descriptions, achieving information-theoretic secrecy and over 90% average attack success rate in multi-tool scenarios.

  2. CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

    cs.AI 2026-07 conditional novelty 6.0

    A 29,322-PDF controlled benchmark shows that a hybrid structural-plus-text detector finds hidden PDF prompt injections under paired evaluation (0.960 F1; 100% pair ranking), while text-only baselines fail.

  3. CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

    cs.AI 2026-07 conditional novelty 5.0

    A document-aware hybrid detector that inspects PDF structure before text flattening outperforms text-only guardrails and structural-only models on a new 29,322-file controlled hidden-prompt-injection benchmark.

  4. When Your Reviewer is an LLM: Biases, Divergence, and Prompt Injection Risks in Peer Review

    cs.CY 2025-09 conditional novelty 4.0

    GPT-5-mini gives weaker papers systematically higher scores than human reviewers, and hidden field-specific prompts in PDFs can force it to assign perfect scores or suppress weaknesses.