Pith. sign in

REVIEW 3 major objections 5 minor 35 references

A document-aware detector can catch hidden prompt injections in PDFs before flattening discards the evidence—at 0.960 F1 on a controlled benchmark.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 04:28 UTC pith:Y626FQOA

load-bearing objection A well-scoped, honestly evaluated benchmark for hidden PDF injection; the main risk is that everything is generated by the authors' own pipeline, so treat the headline F1 as evidence about that pipeline. the 3 major comments →

arxiv 2607.19396 v2 pith:Y626FQOA submitted 2026-07-03 cs.AI

CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

Pukaphol Thienpreecha ("Volk") , Karthik Subramanian This is my paper
classification cs.AI
keywords prompt injectionPDF securityhidden textdocument-aware detectionbenchmarkLLM securitypaired evaluationstructural features
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to show that hidden prompt-injection attacks in PDFs—instructions invisible to the human reader but readable by the parsing pipeline—can be detected if inspection happens before the PDF is flattened into plain text. It builds a controlled benchmark of 29,322 generated PDFs, with each injected file paired against a benign variant of the same base document, and evaluates detectors under splits that prevent leakage. The central result is that a hybrid detector using PDF structure plus sanitized text reaches 0.960 F1 on the held-out test set, 95.9% accuracy on balanced paired comparisons, and ranks the injected file above its benign twin in all 973 pairs. Text-only and structure-only baselines are much weaker. The authors are careful that this does not prove robustness to real-world PDFs, unseen generators, or OCR pipelines; the value is a hard-to-fool evaluation design.

Core claim

On the paper's own terms, the discovery is that hidden PDF instructions leave detectable evidence at the document layer: a detector that reads content-stream operators, font and rendering state, coordinates, and sanitized extracted text can separate injected from benign files even when the benign file is a matched confounder from the same base document. Under provenance-split evaluation, this detector achieves 0.960 F1 (ROC-AUC 0.998, PR-AUC 0.997) on 2,919 held-out PDFs, 95.9% accuracy on the 973-pair balanced subset, and 100% within-pair ranking. The paper frames this as evidence for document-aware screening at ingestion, not as a general solution.

What carries the argument

The carrying mechanism is pre-flattening feature extraction: PDF content streams are parsed with their operator sequences, font choices, rendering modes, coordinates, and stream structure preserved, then combined with text features after removing wrapper markers. Pairing each injected PDF with a benign confounder from the same base document, and splitting by base document, forces the detector to use injection-specific evidence rather than generation artifacts. A sanitized hybrid detector—structural operators plus cleaned text, with metadata excluded—is the primary model; the benchmark itself, CrackedPDFs, is the evaluation instrument.

Load-bearing premise

The entire evaluation lives inside PDFs produced by the authors' own deterministic generators, so the detector's high performance may partly reflect the specific way this generator writes PDFs rather than a general property of hidden injections.

What would settle it

Take the trained hybrid detector and run it on PDFs created by an independent injection tool or on real-world documents with hidden text; if within-pair ranking drops from 100% toward chance while the generator-specific test set stays high, the central claim survives as a controlled result but not as evidence of general document-aware detection.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Document-layer screening at ingestion can catch hidden injections that text-only guardrails miss, so PDF structure should be part of the security boundary for LLM systems.
  • The paired-confounder protocol gives a reusable template for evaluating other document security detectors.
  • The attack families (invisible render mode, tiny fonts, off-page text, split text objects, steganographic variants) show that hidden text can be placed through low-level PDF operators without changing the visible layout.
  • Because the hybrid detector still fails on steganographic acrostics in held-out family tests, even strong document-aware detection needs complementary semantic and model-level safeguards.
  • The benchmark's 29,322-document corpus provides a controlled testbed for future injection detectors.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If this transfers beyond the synthetic generator, ingestion-time structural screening could become a practical pre-filter for document pipelines; a direct way to test that is to feed the detector PDFs produced by unrelated tools and measure rank accuracy.
  • The 100% within-pair ranking suggests the detector is not just finding suspicious text but a stable signal tied to how the hidden text is embedded, which could be compressed into a lightweight feature for real-time screening.
  • The paper's negative results—text-only guardrail recall around 0.25 and structural-only F1 below 0.65—imply that neither pure semantics nor pure syntax alone solves the problem, pushing future work toward multimodal or provenance-aware models.
  • Since the benchmark is synthetic and single-generator, the strongest testable extension is a cross-generator study: generate the same attack families with different PDF libraries and see whether the detector's 0.960 F1 holds or collapses.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces CrackedPDFs, a synthetic benchmark of 29,322 PDFs (9,774 injected, 19,548 benign/confounders) generated from 4,983 base documents using PDFAutoGen and a pikepdf-based injector. It evaluates PromptGuard, a rule baseline, structural-only logistic regression/XGBoost, a text-only TF-IDF comparator, and a sanitized hybrid detector. The evaluation uses hard provenance splits grouped by base document, paired benign confounders, label-shuffle checks, shortcut audits, and held-out attack-family stress tests. The headline result is that the hybrid detector reaches 0.960 F1, 0.998 ROC-AUC, and 0.997 PR-AUC on a 2,919-document held-out test set, with 95.9% thresholded accuracy and 100% within-pair ranking on 973 matched injected/benign pairs. The authors explicitly limit their claims to this controlled generator distribution and disclaim OCR-only pipelines, adaptive attackers, unseen generators, and real-world PDFs.

Significance. If the reported results hold, CrackedPDFs is a well-executed controlled benchmark with unusually rigorous evaluation hygiene: provenance-based splits, matched paired negatives, label-shuffle sanity checks, shortcut audits, and published failure cases (e.g., steganographic acrostics paired-rank accuracy 0.424). The honest separation of clean positive evidence from shortcut-prone comparators is a strength. The main limitation is external validity: all PDFs come from the authors' own generators, and no independent detector is benchmarked on the corpus. This does not invalidate the controlled paired-evaluation claim, but it limits the benchmark's usefulness as a community resource until transfer evidence is supplied.

major comments (3)
  1. [Abstract; §4.1, §4.10] The single-generator distribution is the main threat to the headline result. All 29,322 PDFs are produced by PDFAutoGen and the authors' pikepdf-based injector, so the abstract's '0.960 F1' is an estimate on one synthetic distribution; the near-deterministic AUCs are consistent with learning generator-specific signatures (e.g., render-mode-3, off-page, and low-contrast features listed in §4.5). The paper explicitly disclaims transfer (§4.10, §5.6), so this is a scope boundary rather than an internal contradiction. Nevertheless, for a benchmark contribution the usefulness depends on transfer. Please add at least one cross-generator transfer test—e.g., train on CrackedPDFs and test on an independent invisible-text injector, or report a seed/template ablation—and state precisely what the controlled benchmark is intended to support.
  2. [§5.4 vs §5.5] The relationship between the 100% within-pair ranking claim and the held-out family stress tests needs clarification. If the 973-pair balanced subset contains steganographic acrostics, then the later statement that steganographic acrostics have paired-rank accuracy 0.424 cannot both hold on the same pairs. If the family stress tests use a separate split (e.g., attack family excluded from training), this should be stated explicitly, and the composition of the 973-pair subset should be reported. As written, the abstract's '100%' can be misread as holding across all attack families, which the stress tests themselves contradict.
  3. [§5.1, §5.5] The results are reported as point estimates without confidence intervals, repeated-seed variance, or any comparison to the closest prior detector. PhantomLint is cited as the closest prior work but is never run on CrackedPDFs, so the relative difficulty of the benchmark is unknown. Similarly, the generator is seeded and deterministic, but 0.960 F1 may vary with generator seed; no bootstrap or repeated-seed results are reported. For a benchmark paper, at least one independent baseline detector and a measure of variability across seeds are needed to make the headline numbers interpretable.
minor comments (5)
  1. [§4.7 / §5.1] The rule baseline is never described. Please specify its rules or cite the implementation so that its 0.623 F1 result is interpretable.
  2. [§5.2] The label-shuffle sanity check is described as 'repeated training,' but only one result is reported. Please report the mean and standard deviation over multiple shuffled-label runs.
  3. [§4.5] The feature list includes 'artifact-wrapper counts,' while the excluded metadata list includes 'Artifact-wrapper flag.' Please clarify the distinction to rule out feature leakage from wrapper markers.
  4. [§4.3] The message sourcing from public prompt-injection datasets [34,35] should include version and license information for reproducibility.
  5. [References] PDFAutoGen [33] is cited as a GitHub repository. Please cite a versioned release or DOI so the exact generator version is pinned.

Circularity Check

0 steps flagged

No significant circularity: the headline 0.960 F1 is a measured held-out evaluation on a deliberately controlled benchmark, and the paper explicitly disclaims generalization beyond its own generator.

full rationale

The paper's central result is not a derived prediction but an empirical evaluation on a held-out, provenance-split test set, with label-shuffle and shortcut audits as controls. The hybrid detector's features (e.g., render-mode-3 counts, off-page text counts) are aligned with the known injection construction, but this is stated feature engineering on a controlled threat model, not a fitted parameter renamed as a prediction. The detector is trained only on the training split; the test labels, paired-ranking outcome, and F1 are not used in fitting. The single self-citation, PDFAutoGen [33], is the authors' own deterministic generator for benign documents; it is cited as a publicly available data-generation tool, not as a theorem or uniqueness argument, and it does not force the detection result. The paper repeatedly disclaims real-world and cross-generator generalization (§4.10, §5.6), so the single-generator distribution is an external-validity boundary, not a logical circle. No specific reduction to the paper's own inputs—by equation, by construction, or by self-citation chain—could be identified, so no circular step is reported.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central empirical claim rests on a fully synthetic, author-controlled data distribution. The detector, benchmark, and generator are from the same research group and the same generation pipeline, so outside this distribution the results are unvalidated. The label-shuffle and paired-control checks support internal validity, while §4.10 and §5.6 explicitly disclaim external validity. No new physical or conceptual entities are introduced.

free parameters (4)
  • Detection threshold τ = 0.5 (default for simple baselines; hybrid threshold not fully specified)
    Reported accuracy/F1 depend on this threshold; no threshold sweep or operating-point analysis is given (§4.7).
  • Hand-selected structural feature set = Hand-chosen; no single numeric value
    Feature groups (off-page counts, render-mode-3 counts, white-text counts, tiny-font counts, stream length, etc.) were engineered with knowledge of the injection construction (§4.5); ablation effects are defined but not reported numerically.
  • Benign-document generation configuration (PDFAutoGen) = 14 templates, 2 page sizes, 3 margins, 3 densities, 6 fonts
    This distribution defines the benign class; detector performance is only measured on documents from this hand-designed generator (§4.2, [33]).
  • Injection regime mix = Hand-picked spatial/render/structural regimes and attack families
    The attack distribution is a hand-chosen enumeration with quota balancing (§4.3); stress tests show several families remain hard, so the mix materially affects the headline metric.
axioms (5)
  • domain assumption Hidden injection can always be represented as extractable text operators in a PDF content stream.
    Injection construction and validation (§4.3–§4.4) require the marker to be present under raw extraction; attacks in metadata, glyph mappings, or pixels without extractable text are excluded.
  • domain assumption OCR-based rendered-page checks certify that injected content is not visible to a human.
    Validation uses PyMuPDF rendering plus OCR to confirm the intended hidden-render condition (§4.4); it does not model human perception with real users.
  • ad hoc to paper PDFAutoGen-generated synthetic one-page documents are an adequate stand-in for the benign PDF distribution.
    All base documents come from the authors' own deterministic generator [33]; no external or natural PDF corpus is used.
  • domain assumption Grouped-by-base_pdf_id splits sufficiently control leakage across related variants.
    The hard-provenance protocol prevents the same base document from spanning splits (§4.6), but other generator-level shortcuts (template, font, layout) could still leak; label-shuffle and shortcut audits only partially address this.
  • standard math Underlying libraries and classifiers behave as documented.
    Feature extraction and training rely on pikepdf, pdfplumber, PyMuPDF, scikit-learn, and XGBoost throughout §4.5–§4.7; assumed correct but not formally verified.

pith-pipeline@v1.3.0-alltime-deepseek · 8573 in / 15789 out tokens · 140291 ms · 2026-08-04T04:28:32.670713+00:00 · methodology

0 comments
read the original abstract

Document-based LLM systems often flatten a PDF before guardrails inspect it. That step can discard evidence that an instruction was never visible to the user. We introduce CrackedPDFs, a controlled benchmark for hidden prompt injection in PDFs. The benchmark contains 29,322 generated PDFs from 4,983 base documents. It includes 9,774 injected files and 19,548 benign or matched-confounder files. We evaluate PromptGuard and a rule baseline. We also evaluate structural-only learned models and a sanitized hybrid detector. The evaluation uses held-out provenance splits and paired benign-confounder controls. It also uses label-shuffle checks and shortcut audits. On a 2,919-document held-out test set, the hybrid detector reaches 0.960 F1. ROC-AUC is 0.998 and PR-AUC is 0.997. On a balanced subset containing 973 injected PDFs and 973 matched benign confounders, the hybrid detector achieves 95.9% classification accuracy. Using score ordering, it ranks the injected member above its matched confounder in 100% of 973 pairs. PromptGuard has low recall when given extracted text only. Structural-only learned models are weak under paired controls. A text-only TF-IDF model reaches perfect held-out scores but fails shortcut audits. These results show that document-aware hybrid detection is useful under controlled paired evaluation. They do not show broad real-world robustness or reliable cross-family generalization.

Figures

Figures reproduced from arXiv: 2607.19396 by Karthik Subramanian, Pukaphol Thienpreecha ("Volk").

Figure 1
Figure 1. Figure 1: Threat model taxonomy. The taxonomy places this work in the parser- and layout-level [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Benchmark construction pipeline. CrackedPDFs uses controlled generation and paired [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Example attack. The benign and injected PDFs can look equivalent in rendered form, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Main held-out hard-provenance results. The sanitized hybrid detector is the primary model. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Paired benign-confounder evaluation. The hybrid detector is correct when the injected PDF [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Held-out attack-family stress tests. Several families remain easy for the hybrid detector, but [PITH_FULL_IMAGE:figures/full_fig_p011_6.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

35 extracted references · 8 linked inside Pith

  1. [1]

    LLM01 2025 Prompt Injection

    OW ASP. LLM01 2025 Prompt Injection. 11 https://genai.owasp.org/llmrisk/llm01-prompt-injection/

    2025

  2. [2]

    https://arxiv.org/abs/2306.05499

    Prompt Injection Attack against LLM-Integrated Applications. https://arxiv.org/abs/2306.05499

    Pith/arXiv arXiv

  3. [3]

    https://arxiv.org/abs/2601.22240

    A Systematic Literature Review on LLM Defenses Against Prompt Injection and Jailbreaking. https://arxiv.org/abs/2601.22240

    arXiv

  4. [4]

    Prompt Injection Defenses

    tldrsec. Prompt Injection Defenses. https://github.com/tldrsec/prompt-injection-defenses

  5. [5]

    Principled Detection of Hidden LLM Prompts in Structured Documents

    PhantomLint. Principled Detection of Hidden LLM Prompts in Structured Documents. https://arxiv.org/abs/2508.17884

    arXiv

  6. [6]

    Hidden-Comment Injection in LLM Agents

    When Skills Lie. Hidden-Comment Injection in LLM Agents. https://arxiv.org/abs/2602.10498

    arXiv

  7. [7]

    Malicious Font Injection in External Resources for Large Language Models

    Invisible Prompts, Visible Threats. Malicious Font Injection in External Resources for Large Language Models. https://arxiv.org/pdf/2505.16957.pdf. See alsohttps://aclanthology.org/2025.findings-emnlp.376/

    Pith/arXiv arXiv 2025

  8. [8]

    https://arxiv.org/pdf/2509.10248.pdf

    Prompt Injection Attacks on LLM Generated Reviews of Scientific Publications. https://arxiv.org/pdf/2509.10248.pdf

    arXiv

  9. [9]

    https://arxiv.org/abs/2512.23684

    Multilingual Hidden Prompt Injection Attacks on LLM-Based Academic Reviewing. https://arxiv.org/abs/2512.23684

    arXiv

  10. [10]

    https://zenodo.org/records/16603590

    Disrupting Large Language Models with Hidden Prompt Injection Attacks Embedded in HTML Pages. https://zenodo.org/records/16603590

    arXiv

  11. [11]

    Prompt Injection Exploits Invisible PDF Text to Pass Credit Score Analysis

    Snyk. Prompt Injection Exploits Invisible PDF Text to Pass Credit Score Analysis. https://snyk.io/articles/ prompt-injection-exploits-invisible-pdf-text-to-pass-credit-score-analysis/

  12. [12]

    Invisible Prompt Injection Secure AI

    Trend Micro. Invisible Prompt Injection Secure AI. https://www.trendmicro.com/en_us/research/25/a/ invisible-prompt-injection-secure-ai.html

  13. [13]

    Invisible Unicode Jailbreak

    Promptfoo. Invisible Unicode Jailbreak. https: //www.promptfoo.dev/lm-security-db/vuln/invisible-unicode-jailbreak-779fc810

  14. [14]

    Detecting Prompt Injection Attacks in LLMs

    Attention Tracker. Detecting Prompt Injection Attacks in LLMs. https://arxiv.org/abs/2411.00348

    Pith/arXiv arXiv

  15. [15]

    Prompt Guard: Model Card formeta-llama/Prompt-Guard-86M

    Meta AI. Prompt Guard: Model Card formeta-llama/Prompt-Guard-86M. Hugging Face, 2024. https://huggingface.co/meta-llama/Prompt-Guard-86M

    2024

  16. [16]

    Llama-Prompt-Guard-2-86M

    Meta. Llama-Prompt-Guard-2-86M. https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M

  17. [17]

    https://arxiv.org/abs/2506.06384

    Detection Method for Prompt Injection by Integrating Pre-trained Model and Heuristic Feature Engineering. https://arxiv.org/abs/2506.06384

    Pith/arXiv arXiv

  18. [18]

    https://arxiv.org/abs/2512.12583

    Detecting Prompt Injection Attacks Against Application Using Classifiers. https://arxiv.org/abs/2512.12583. 12

    arXiv

  19. [19]

    https://media.sciltp.com/articles/2506000841/2506000841.pdf

    Prompt Injection Detection in LLM Integrated Applications. https://media.sciltp.com/articles/2506000841/2506000841.pdf

    arXiv

  20. [20]

    A Lightweight Defense Against Prompt Injections in LLMs

    Zero-Shot Embedding Drift Detection. A Lightweight Defense Against Prompt Injections in LLMs. https://arxiv.org/abs/2601.12359

    Pith/arXiv arXiv

  21. [21]

    Context-Aware Prompt Injection Testing and Robustness Enhancement

    CAPTURE. Context-Aware Prompt Injection Testing and Robustness Enhancement. https://arxiv.org/html/2505.12368v1

    Pith/arXiv arXiv

  22. [22]

    Content Masking Attack Against Information-Based Online Services

    PDF Mirage. Content Masking Attack Against Information-Based Online Services. https: //www.usenix.org/system/files/conference/usenixsecurity17/sec17-markwood.pdf

  23. [23]

    Studying, Finding, and Localizing Inconsistency Bugs in PDF Readers and Files

    On the Correctness of Electronic Documents. Studying, Finding, and Localizing Inconsistency Bugs in PDF Readers and Files. https://link.springer.com/article/10.1007/s10664-018-9600-2

    doi:10.1007/s10664-018-9600-2

  24. [24]

    https://www.usenix.org/system/files/sec20-chen-yizheng.pdf

    On Training Robust PDF Malware Classifiers. https://www.usenix.org/system/files/sec20-chen-yizheng.pdf

  25. [25]

    https://www.emergentmind.com/topics/optical-character-recognition-ocr-exploits

    OCR Exploits and Adversarial Vulnerabilities. https://www.emergentmind.com/topics/optical-character-recognition-ocr-exploits

  26. [26]

    PDF Document Security

    Documind. PDF Document Security. https://www.documind.chat/blog/pdf-document-security

  27. [27]

    https://arxiv.org/html/2504.14348v1

    Manipulating Multimodal Agents via Cross-Modal Prompt Injection. https://arxiv.org/html/2504.14348v1

    Pith/arXiv arXiv

  28. [28]

    https://pmc.ncbi.nlm.nih.gov/articles/PMC4993050/

    Metamorphic Testing for Cybersecurity. https://pmc.ncbi.nlm.nih.gov/articles/PMC4993050/

  29. [29]

    https://www.cs.cornell.edu/fbs/publications/Hyperproperties.pdf

    Hyperproperties. https://www.cs.cornell.edu/fbs/publications/Hyperproperties.pdf

  30. [30]

    https://proglearn.neurodata.io/experiments/label_shuffle_exp

    Label Shuffle Experiment. https://proglearn.neurodata.io/experiments/label_shuffle_exp

  31. [31]

    https://arxiv.org/abs/2403.17212

    Sanity Checks for Explanation Uncertainty. https://arxiv.org/abs/2403.17212

    Pith/arXiv arXiv

  32. [32]

    Machine Learning Crash Course ROC and AUC

    Google. Machine Learning Crash Course ROC and AUC. https://developers.google.com/machine-learning/crash-course/classification/ roc-and-auc

  33. [33]

    PDFAutoGen: Automated Benchmark Construction Pipeline for Hidden Prompt Injection Detection in PDFs

    Pukaphol Thienpreecha. PDFAutoGen: Automated Benchmark Construction Pipeline for Hidden Prompt Injection Detection in PDFs. https://github.com/volkthienpreecha/PDFAutoGen

  34. [34]

    LLM Jailbreak & Prompt-Injection Dataset

    Necent. LLM Jailbreak & Prompt-Injection Dataset. https://huggingface.co/datasets/Necent/llm-jailbreak-prompt-injection-dataset

  35. [35]

    Prompt Injection and Jailbreak Detection Dataset

    NeurAlchemy. Prompt Injection and Jailbreak Detection Dataset. https://huggingface.co/datasets/neuralchemy/Prompt-injection-dataset. 13