Catching prompt injections hidden in PDFs
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Tom Clancy, a QA engineer, describes how he tested an internal tool that parses financial PDFs for prompt injection. Hidden white-on-white earnings figures, zero-height text and off-page text all got through on his first attempts. He built six single-purpose "judges" (HiddenInk, text-versus-pixel divergence, Unicode, accessibility tags, glyph overlap, non-text ink), each with stated blind spots, such as inline /ActualText substitution. Two further attack vectors remain open as Jira tickets, and he has caught no real-world attempts. The claims are his own, unverified.