Document-Level Hidden Prompt Injection

• Document-level hidden prompt injection is an adversarial technique that embeds covert instructions in non-visible parts of documents to manipulate LLM behavior.
• It exploits carrier formats such as HTML, PDF, and metadata, impacting web summarizers, peer review systems, and automated agents with measurable effects.
• Robust defenses require context separation, input sanitization, adversarial training, and layered mitigation to neutralize these hidden injections.

Document-level hidden prompt injection is a covert adversarial technique in which instructions intended to manipulate the behavior of LLMs are embedded in documents so that they are invisible to human reviewers, yet parsed and followed by the model. This class of attack leverages the inability of LLMs and ingestion pipelines to reliably distinguish between benign content and embedded system-level directives when concatenating inputs from external sources. Document-level hidden prompt injection can exploit non-visible markup, styling, metadata, font remapping, invisible text fields, or subtle mid-paragraph instructions in formats such as HTML, PDF, Word, Markdown, and even structured metadata fields in emails and invitations. Such attacks threaten web-integrated workflows, automated document processing, peer review, browser agents, and enterprise prompt-based systems. Robust detection and mitigation require architectural context separation, input sanitization, adversarial training, and multi-layered defenses.

1. Formal Definitions and Threat Models

Document-level hidden prompt injection is defined as the adversarial embedding of instructions ("prompts") in sections of documents not intended for human consumption, which, when presented to an LLM, causes a deviation from the specified output. Let $C$ denote the visible content, $H$ denote the hidden adversarial payload, and $M(·)$ the model summarization or action function. Injection is successful if $M(C ∥ H) ≠ M(C)$ and the difference is attributable to $H$ (Verma, 6 Sep 2025).

Key threat models assume that attackers can host or tamper with documents (HTML, PDF, DOCX, emails) but do not control the LLM weights or developer-side system prompts. Document-level hidden instructions can reside anywhere (meta-tags, comments, white-on-white text, font-mapped codepoints, calendar titles, email subjects). Defender models generally lack pre-ingestion sanitization of non-visible attributes and directly concatenate external documents into LLM context windows (Ganiuly et al., 3 Nov 2025, Reddy et al., 6 Sep 2025, Theocharopoulos et al., 29 Dec 2025).

The attack surface extends to any application that blends user instructions with external documents: summarizers, question/answer flows, peer-review workflows, browser agents, enterprise copilots, and assistant orchestration systems (Lian et al., 25 Aug 2025, Zhang et al., 25 Nov 2025, Nassi et al., 16 Aug 2025).

2. Injection Techniques and Carrier Formats

Document-level hidden prompt injection can exploit a variety of carrier formats and encoding mechanisms:

HTML and Web Content: Attackers use hidden or semi-visible markup elements (e.g., <meta>, aria-label, alt in <img>, display:none <div>, opacity:0 containers, HTML comments, base64-encoded custom attributes, hidden <script>) to encode malicious instructions. These elements are invisible to the user but included in DOM extraction, enabling LLMs ingesting raw HTML or DOM innerText to parse hidden prompts (Verma, 6 Sep 2025, Zhang et al., 25 Nov 2025).

PDF and Office Documents: White-on-white text, invisible layers, tiny font size, zero-area clipping, and off-page positioning allow instructions to remain undetected during viewing but visible to PDF-to-text extraction tools. Malicious font injection remaps codepoints—such as spaces or punctuation—to attacker-generated instruction glyphs (Murray, 25 Aug 2025, Xiong et al., 22 May 2025).

Metadata/External Fields: Email subjects, calendar invite titles, document filenames, and external resource metadata are exploited by embedding prompts in fields routinely ingested by assistants or agents. These may trigger critical device actions, exfiltration, or self-propagation (Nassi et al., 16 Aug 2025).

Markdown/Rich Text: Reference-style Markdown links, alt tags, and comment fields are used to bypass link redaction and to leak or execute payloads post-ingestion (Reddy et al., 6 Sep 2025).

Table: Representative Techniques by Format

Format	Injection Mechanism	Successful Attack Scenarios
HTML	Meta, aria-label, display:none, comment	Summarizer style/jargon change, action triggers (Verma, 6 Sep 2025)
PDF	White text, tiny font, font remapping	MCQ/grade hijack, peer review manipulation (Guo et al., 16 Aug 2025, Xiong et al., 22 May 2025, Collu et al., 28 Aug 2025)
Email	Subject, body (reference Markdown)	Copilot zero-click exfiltration, Promptware agent hijack (Reddy et al., 6 Sep 2025, Nassi et al., 16 Aug 2025)
Calendar	Title, description	Device control via agent tools (Nassi et al., 16 Aug 2025)

Techniques such as base64, Unicode homoglyphs, chunked prompt splitting, and adversarial formatting enable routine bypass of naive keyword or phrase-based detectors (Reddy et al., 6 Sep 2025, Collu et al., 28 Aug 2025).

3. Empirical Impact and Quantitative Results

Web Summarization Pipelines

An HTML-based injection benchmark using 280 pages (10 content types) demonstrated that 29% of Llama 4 Scout outputs and 16% of Gemma 9B IT outputs were measurably induced to deviate from clean summaries due to covert injections. Meta-tags and HTML comments achieved the highest success rates (>40%) (Verma, 6 Sep 2025).

ROUGE-L and SBERT cosine similarity metrics show substantial semantic drift between clean and injected summaries. Example manipulations include tone/style shift ("summarize like a pirate") or format transformation (prose to bullets).

Academic Peer Review

PDF injections of white-on-white adversarial instructions in four languages yielded near-complete review bias: 99.6% (English), 99.4% (Japanese), 98.3% (Chinese), and 37% (Arabic) of papers saw a review decision change in reviews by llama3, with mean score drifts of –4 to –6 points for EN/JA/ZH (Theocharopoulos et al., 29 Dec 2025). High-impact acceptance reversals occurred in more than half of cases for EN/JA/ZH injections.

Multiple-Choice Question Judging

Even trivial arithmetic MCQs rendered in PDFs (with hidden prompts) resulted in GPT-4o and DeepSeek-V3 answering 100% as instructed by the hidden injection, disregarding correct answers. Gemini-2.5 Flash showed partial resistance (Guo et al., 16 Aug 2025). Defensive system prompts restored accuracy.

Browser and Copilot Agents

Prompt injection in real email and Markdown fields enabled zero-click remote exfiltration by inducing Copilot to emit image links fetched via CSP-proxied HTTP requests, fully bypassing inline link redaction. Robustness failures traced to perimeter-only classifiers and missing provenance separation (Reddy et al., 6 Sep 2025, Zhang et al., 25 Nov 2025). In Gemini-powered assistants, 73% of analyzed threats were scored as "High/Critical" and included device control, data exfiltration, phishing, and worm propagation (Nassi et al., 16 Aug 2025).

Summary Table: Injection Success Rates

Model/Use Case	Success Rate (%)	Notes/Metric	Source
Llama 4 Scout	29.3	HTML-based summarization, manual	(Verma, 6 Sep 2025)
Gemma 9B IT	15.7	HTML-based summarization, manual	(Verma, 6 Sep 2025)
llama3 (peer review)	98-99 (EN, JA, ZH)	Decision change/drift	(Theocharopoulos et al., 29 Dec 2025)
GPT-4o (MCQs)	100	Injection-induced output	(Guo et al., 16 Aug 2025)
GPT-4o (peer review)	100 (refusal); 78 (det)	Attack ASR	(Collu et al., 28 Aug 2025)
Copilot (EchoLeak)	100	Zero-click exfiltration	(Reddy et al., 6 Sep 2025)

4. Detection and Defensive Architectures

Robust detection demands viewing documents both as text streams (D_text) and from the user’s perspective (D_vis), typically via OCR over rendered images. PhantomLint demonstrates principled, format-agnostic hidden prompt detection with 100% synthetic/real-case success and a false positive rate of ∼0.092% (Murray, 25 Aug 2025). It combines sentence embedding-based semantic scan with OCR region consistency testing.

Architectural defenses include:

• Structured Queries/Context Isolation: Explicit channel separation (developer/system prompts, user data), encoded via reserved tokens unforgeable by user data, coupled with fine-tuning so the LLM strictly ignores instructions found in content segments (Chen et al., 9 Feb 2024, Lian et al., 25 Aug 2025).
• Input Sanitization: Removal of non-visible HTML elements, control characters, zero-width/white text, and base64 fragments prior to model ingestion (Verma, 6 Sep 2025, Ganiuly et al., 3 Nov 2025).
• Heuristic Filtering: Detection of imperative sentences or anomalous headers in user data; flagging exploits that mimic system-level instructions (Lian et al., 25 Aug 2025).
• Multi-layered Defense-in-Depth: Sandboxing of tool invocations, pattern/blocking regex for known directives, file write protection, secondary LLM-powered content validation and provenanced context separation (Mayoral-Vilches et al., 29 Aug 2025, Zhang et al., 25 Nov 2025).
• Prompt Partitioning/Provenance Labeling: Provenance tagging for every input chunk, UI visibility of source, and policy gating to restrict actions from untrusted sources, particularly for automatic agent/app invocation in assistants (Reddy et al., 6 Sep 2025, Nassi et al., 16 Aug 2025).

BrowseSafe-Bench and Qwen3-30B detection heads illustrate high-F1 chunked detection (F1∼0.90, Recall∼0.84, Precision∼0.98) under realistic attack/distractor mixing (Zhang et al., 25 Nov 2025). A/B consistency checks are recommended to detect semantic divergence between processed and raw views (Nassi et al., 16 Aug 2025).

5. Attack Taxonomy and Analysis of Vulnerabilities

Document-level hidden prompt injection—referred to as "Promptware" in recent studies—differs fundamentally from conversational or classic prompt injection in its indirect path and persistent effects (Nassi et al., 16 Aug 2025). Key vulnerability factors include:

• Flat Concatenation: Treating all tokens in context as equally authoritative enables hidden instructions to subvert system intent (Lian et al., 25 Aug 2025).
• Semantic Interpreter Bias: Transformer architectures cannot inherently distinguish "data" from "code"; all tokens participate in next-token prediction without role markers (Mayoral-Vilches et al., 29 Aug 2025).
• Inadequate Provenance: Lack of boundary or role labels on input sources and no explicit trust partitions (Reddy et al., 6 Sep 2025).
• Adaptive Evasion: Attackers utilize steganography, encoding, chunk splits, homoglyphs, and multi-lingual variations to evade keyword, token-based, and formatting-based guards (Theocharopoulos et al., 29 Dec 2025, Collu et al., 28 Aug 2025).

Attack scenarios extend from short-term context poisoning and one-shot output hijack, to permanent memory poisoning, agent chaining, tool misuse, device control, and lateral movement (worm propagation via document-field rebroadcast) (Nassi et al., 16 Aug 2025).

6. Defensive Strategies, Mitigation, and Future Directions

Comprehensive mitigation requires multi-layered protocol changes and proactive monitoring:

• Input Layer: Strip or neutralize all non-visible, non-user-supplied attributes in HTML, PDF, Markdown, calendar event, email, and metadata prior to ingestion (Verma, 6 Sep 2025, Xiong et al., 22 May 2025, Zhang et al., 25 Nov 2025).
• Model Layer: Structured instruction tuning (StruQ) via injection-robust fine-tuning suppresses ASR to 0% for all attacks except feedback-driven TAP (residual 9–36%; future work needed) (Chen et al., 9 Feb 2024).
• Processing Layer: Provenance tags, strict CSP for web agents, sandboxed parsing, and differential output review plus human-in-the-loop (HITL) for high-risk actions (Reddy et al., 6 Sep 2025, Mayoral-Vilches et al., 29 Aug 2025).
• Policy Layer: A/B testing with/without document fields, UI provenance visibility, and explicit user confirmations for secondary agent/tool invocation (Nassi et al., 16 Aug 2025).
• Continuous Red-Teaming: Regular expansion of training sets with redteam-crafted injections spanning format, language, and obfuscation diversity (Ganiuly et al., 3 Nov 2025).
• Adversarial Training: Fine-tuning on clean/injected pairs, with response suppression for injection-induced outputs (Ganiuly et al., 3 Nov 2025, Chen et al., 9 Feb 2024).

Mitigation effectiveness is quantitatively demonstrated: in Gemini-powered assistants, deployment of layered defenses reduced the risk profile from 73% High/Critical to exclusively Very Low–Medium, preventing automatic lateral movements and device control (Nassi et al., 16 Aug 2025). Defensive system prompts recover baseline accuracy in trivial MCQ and judgment tasks (Guo et al., 16 Aug 2025).

Long-term resilience will depend on formal certification of context roles, advanced document sanitizers recognizing font-based steganography, and hardware-backed context separation for sensitive workflows (Mayoral-Vilches et al., 29 Aug 2025).

7. Broader Implications and Outlook

Document-level hidden prompt injection is architecturally analogous to cross-site scripting in web security: it transforms trusted content into executable code for LLM inference, outpacing current detection and sanitization techniques. Applications in peer review, browser agents, copilots, grading/judging, and automated document handling remain highly exposed, even to minimal, polymorphic attack payloads (Verma, 6 Sep 2025, Theocharopoulos et al., 29 Dec 2025, Collu et al., 28 Aug 2025, Nassi et al., 16 Aug 2025, Ganiuly et al., 3 Nov 2025, Xiong et al., 22 May 2025).

Alignment and safety tuning (RLHF, refusal heuristics) as practiced in proprietary models reduces effective vulnerability, but document-level attacks persist across open and closed architectures. Defenders must treat every document input as an active attack surface, enforce defense-in-depth with provenance and role separation, and institutionalize continuous adversarial testing across languages and formats.

The research consensus underscores that only the combination of architectural, model, preprocessing, and policy-level interventions can close the latent prompt-injection attack surface in LLM-integrated systems (Zhang et al., 25 Nov 2025, Reddy et al., 6 Sep 2025, Chen et al., 9 Feb 2024). Automated ingestion pipelines, peer review platforms, and agent-based assistants should integrate robust document sanitization, provenance tagging, A/B output checks, and user-facing transparency before deployment in critical or autonomous workflows.