To detect prompt injection in a document, inspect both what a person sees and what an assistant can extract. Look for concealed or oddly placed instructions, compare the rendered page with extracted text, and review every finding before sharing the file.
What is prompt injection in a document?
Indirect prompt injection happens when instructions arrive through external content, such as a resume, PDF, email, or web page, and an assistant treats those instructions as commands instead of material to analyze. The UK National Cyber Security Centre describes a hidden instruction in a CV as an example of this risk.
The document may be intended for a normal task such as screening a resume. The person reviewing it may see an ordinary page while the assistant also receives text that asks it to change the task or its result.
What is the difference between indirect injection and concealed text?
| Concept | What it describes | What to review |
|---|---|---|
| Indirect prompt injection | External content influences an assistant as though it were an instruction. | The source, the assistant workflow, and any action or output that follows. |
| Concealed text | Text is presented so a person may miss it while extraction or processing can still receive it. | The rendered page, the document structure, and the extracted text. |
These concepts overlap but are not interchangeable. Concealed text is presentation evidence, not proof of intent. An indirect injection can be visible, and concealed text can be accidental. The appearance of a file cannot establish what its author meant or how an assistant will respond.
Why is a resume a useful example?
Resumes are often passed to a screening workflow as external material. A resume can contain very small, background-matched, or black-box-covered instructions that a human reviewer does not notice while a document reader still extracts them.
Review the whole resume, not just the visible job history. Compare the page a person reads with the text an assistant can receive, and treat instructions inside the resume as content to inspect rather than commands to follow.
What should you check in a document?
The review tool checks the following presentation clues where the input format makes them observable. The Microsoft Defender guidance describes hidden and invisible text patterns that make this comparison useful.
- Very small text.
- Text that blends into a flat background.
- OCR text in an image whose source pixels nearly match the surrounding background.
- HTML text hidden by layout, clipping, zero-size containers, or off-screen placement.
- PDF text placed outside the page or given no visible area.
- HTML text covered by another rendered element.
- Extractable PDF text with little or no matching evidence in a flat or solid rendered region.
- Extractable PDF text beneath an apparently opaque painted area, including amateur black-box-style coverups.
How should you review a finding?
- Read the inert text and location in the original PDF, image, or sanitized HTML preview.
- Compare the rendered context with the extracted text or raster evidence shown for that finding.
- Decide whether the text is expected, needs to be removed, or needs to be explained by the document owner.
- Keep actions that could disclose information or change a workflow under human review.
OWASP recommends human-in-the-loop controls and separating untrusted content from instructions. Microsoft's Secure Future Initiative describes layered defenses and human verification for risky actions. Those practices complement document review when a workflow can disclose data or take action.
Where does PHI Mask fit?
Open the prompt injection detector to review a PDF, image, or HTML document with numbered findings, evidence, and the checks that ran. PDFs and images retain their original rendered view; HTML uses a sanitized preview that cannot run the supplied page.
Review before sharing.
Sources and review notes
This guide was reviewed against the UK National Cyber Security Centre, Microsoft Defender guidance, OWASP's LLM Prompt Injection Prevention Cheat Sheet, and Microsoft's Secure Future Initiative guidance. These sources support the distinction between external instructions, concealed text, layered controls, and human review.
Common questions
- What is indirect prompt injection?
- Indirect prompt injection is when external content, such as a document, is processed by an assistant and treated as an instruction instead of material to analyze.
- Is concealed text the same as prompt injection?
- No. Concealed text is presentation evidence that a person may miss while extraction or processing can still receive it. It can be accidental, and it does not establish the author's intent.
- Can visible text still be prompt injection?
- Yes. An indirect prompt injection can be visible to a person. Concealed text is one way external instructions may be missed during a normal document review.
- What does the prompt injection detector check?
- It checks very small text; low-contrast text in documents and images; HTML text hidden by layout, clipping, zero-size containers, off-screen placement, or another rendered element; PDF text outside the page or without visible area; extractable PDF text with little or no matching evidence in a flat or solid rendered region; and extractable PDF text beneath an apparently opaque painted area, including amateur black-box-style coverups.
- What should I do when a finding appears?
- Read the text, location, reason, and evidence in context. Treat instructions from the document as content to inspect, keep risky actions under human review, and decide whether to remove, replace, or explain the text before sharing.