It compares the declared text color with the rendered area around the text, covering white-on-white text and text camouflaged within decorative colors.
Detection guide
Find hidden PDF text through drawing data
A PDF can contain text that is available to text extraction tools but difficult or impossible for a person to notice in a normal viewer. PDFender is a static analysis tool for reviewing these hidden instructions—also known as indirect prompt injections—in lecture materials and other PDF documents.
PDF loading, rendering, text analysis, and result generation take place entirely in your browser. PDF contents, extracted text, and findings never leave your device.
Hiding techniques PDFender examines
PDFender focuses on abnormal visibility rather than treating suspicious wording alone as proof of an injection.
It compares text size with typical text on the page and examines transformation matrices for text made unreadable through extreme scaling or compression.
It checks invisible text rendering modes, empty clipping regions, and optional-content layers that are disabled when the document opens.
It analyzes drawing order and overlap with later paths or images, and can compare pixels after re-rendering without suspected covering objects.
It checks runs of Unicode Tags, dense zero-width sequences, and suspicious bidirectional controls. Tags and common zero-width binary encodings are decoded for review.
It checks DocumentInfo and XMP metadata for invisible Unicode and instruction-like text, reporting these separately because AI ingestion is service-dependent.
How the analysis works
- PDF.js renders each page while PDFender records text, path, and image drawing operations together with their order.
- It evaluates color, opacity, size, transforms, position, clipping, optional-content visibility, overlap with later objects, and invisible Unicode in raw extracted text.
- It calculates confidence from visual or character-code anomalies. Prompt-like language in deobfuscated text can raise confidence only when an anomaly already exists.
Development verification results
These results come from purpose-built regression PDFs that contain text unavailable to normal visual inspection but present in text extraction. They confirm known mechanisms in the current version; they are not an independent evaluation or a guarantee for unknown PDF files.
| PDF technique | Normal view | Text extraction | PDFender |
|---|---|---|---|
| Text rendering mode Tr 3 | Completely invisible | Text is extracted | Detected |
| Zero-area clipping path | Completely invisible | Text is extracted | Detected |
| Optional Content Group disabled by default | Hidden layer | Text is extracted | Detected |
| Solid-white tiling pattern | Unreadable on white | Text is extracted | Detected |
| Text matching a pale decorative stripe | Camouflaged in decoration | Text is extracted | Detected |
| Occlusion by a later-drawn object | Covered and unreadable | Text is extracted | Detected |
| Unicode Tags payload | The instruction is not shown | Special code points are extracted | Decoded and detected |
| Interspersed or binary zero-width encoding | Normal text or empty space | Contains zero-width characters | Removed or decoded and detected |
| Suspicious bidi override | Display order changes | Logical order contains controls | Detected |
How to interpret findings
A finding is a mechanical clue that helps a reviewer focus on suspicious areas. Hidden text is not necessarily a prompt injection.
A clean result does not guarantee that a PDF is safe.
Do not rely on the result alone. Always review the original PDF and any unusual areas yourself.
Scope:
PDFender primarily examines text that standard PDF text extraction can retrieve but a person may not notice. An isolated zero-width character and a valid emoji tag sequence are not findings by themselves. Rasterized text and outlined glyphs are likely to remain visible to a person, while standard text extraction does not expose them. They are therefore unlikely to function as the kind of hidden prompt injection targeted here and are outside the inspection scope. PDFender does not perform OCR.
Frequently asked questions
What is hidden text in a PDF?
It is text that extraction tools can retrieve but people may not notice because it is white, tiny, clipped, placed in a hidden layer, compressed, or covered by another object.
Does PDFender upload PDF files to a server?
No. Loading, rendering, text analysis, and result generation happen locally in the browser. PDF contents, extracted text, and findings do not leave the device.
Does prompt-like wording trigger a finding by itself?
Not in ordinary page text. PDFender uses prompt-like language only to strengthen confidence when the same text also has a visual or character-code anomaly. Instruction-like metadata is separated as a low-confidence document-property finding.
What are Unicode Tags and zero-width characters?
They are special Unicode characters that are not displayed or have no visible width. PDFender looks for abnormal runs or density and decodes known encodings when possible. A single character is not enough because these characters also have legitimate uses.
Does PDFender use OCR?
No. PDFender examines text stored inside the PDF but made difficult for a person to notice, using text information and drawing operations. Rasterized text and outlined glyphs are likely to remain visible to a person and are not exposed by standard text extraction, so they are unlikely to function as the kind of hidden prompt injection targeted here and are outside the inspection scope.
Does “no findings” mean that a PDF is safe?
No. PDFender is a static review aid. Unfamiliar rendering techniques or complex PDF structures may produce false negatives, while legitimate visual design can produce false positives.
Can PDFender inspect Japanese PDF files?
Yes. The deployed app includes the PDF.js CMaps and standard-font data needed to render Japanese CID fonts and preview detected locations. Some authoring methods can still prevent text extraction.
Inspect a PDF in your browser
No installation or PDF upload is required.
Open PDFender