Evidence before transformation
Store exact bytes, hashes, parser versions, object references, code-point offsets, and transformation history. A normalization difference is itself evidence.
Counter-tradecraft playbook
Defend the representation boundary, not only the prompt.
Hidden-instruction defense is a document-forensics, provenance, and authority-control problem. The goal is not to guess whether one string “looks malicious,” but to understand every machine-visible layer before untrusted content reaches a privileged model.
No preprocessor proves visible prose is safe. Structural analysis detects hiddenness and representation discrepancies. Instruction hierarchy, least privilege, validation, and human authorization are still required for ordinary visible prompt injection.
The reference pipeline
Seven stages, each with an explicit security objective
The order matters. Detect before destroying evidence, and construct a new model payload rather than trusting a mutated copy of the attacker-controlled object.
01Preserve
Quarantine original bytes, hash them, and record provenance.
02Parse
Identify the real type and inventory objects without active execution.
03Render
Produce human-facing pixels in an isolated, network-denied environment.
04Compare
Reconcile extracted, rendered, OCR, metadata, and normalized views.
05Classify
Score hiddenness, instruction content, source, and trust separately.
06Rebuild
Create a least-privileged canonical representation from allowlisted data.
07Isolate
Keep raw untrusted content away from credentials and state-changing tools.
Design principles
What a high-assurance system preserves
Independent views
Do not let one extractor define reality. Compare structural text, rendered text, pixel OCR, metadata, accessibility, and tokenized views.
Visibility as a feature
Track whether each span is visible, off-screen, transparent, metadata-only, annotation-only, OCR-only, or structurally hidden.
Canonical output
Supply the model with a newly constructed plain-text or typed representation. Never pass raw active object graphs merely because a parser returned text.
Provenance-bound context
Every span remains labeled as user instruction, external document data, metadata, OCR, accessibility description, or model-generated summary.
Fail-safe ambiguity
Unsupported encryption, parser disagreement, rendering failure, major OCR mismatch, malformed structure, or detector outage should quarantine—not bypass—inspection.
Layer 1
Unicode and representation controls
Maintain at least three strings: the exact decoded source, security-analysis views, and the canonical AI-bound representation.
| View | Purpose | Typical handling |
|---|---|---|
| Evidence text | Forensic truth | No normalization or deletion; hash and retain offsets. |
| Security-analysis text | Detection and comparison | NFC/NFKC, escaped controls, confusable skeletons, script sets, whitespace map. |
| Canonical AI text | Least-privileged model input | Usually NFC, normalized line endings, policy-approved controls only, visible provenance markers. |
Policy priorities
- Enumerate all
Cf,Cc, unusual space separators, combining marks, private-use, and unassigned code points. - Apply higher severity to bidirectional overrides than to legitimate isolates.
- Do not blindly delete ZWJ or ZWNJ; they can be linguistically meaningful.
- Use UTS #39-style confusable skeletons as a supporting feature, especially for identifiers and sensitive terms.
- Compare token counts and segmentation before and after transformations when a model will consume the text.
Layer 2
HTML: collect at least three views
DOM existence is not visual existence. A browser-based audit should make the difference explicit.
STRUCTUREDOM and source
Inventory text nodes, comments, attributes, templates, hidden inputs, iframes, data URLs, generated content sources, and accessibility names.
RENDERLayout-aware text
Collect innerText, computed display/visibility/opacity, clipping, dimensions, coordinates, overflow, contrast, and focusability.
PIXELSScreenshot OCR
Use OCR as an independent witness for text painted through canvas, SVG, generated content, raster images, transforms, and effects.
Accessibility exception handling: screen-reader-only text is not “fake” merely because it is not visually painted. Preserve accessibility semantics, label their source, and reject instruction-like cross-channel content rather than deleting the entire accessibility plane.
Layer 3
Documents and media: inspect before flattening
Flattening can be a strong canonicalization boundary, but performing it before structural inspection can erase evidence that content was hidden.
| Format | Inspect | Independent view | Canonical policy |
|---|---|---|---|
| Info/XMP, actions, JavaScript, attachments, annotations, optional layers, text opacity, font maps, XObjects | Render every page and OCR pixels | Reject active content; rebuild or rasterize when assurance outweighs editability | |
| DOCX/PPTX/XLSX | Package manifest, relationships, core/custom properties, comments, notes, hidden sheets/slides, embedded objects, macros | Trusted conversion to PDF/images plus text extraction | Allowlist package parts and reconstruct clean output |
| Images | EXIF/IPTC/XMP, profiles, dimensions, embedded thumbnails, file/type mismatch | Pixel OCR and visual model with metadata excluded or separately labeled | Strip nonessential metadata after recording it |
| Audio/video | ID3/container metadata, subtitle tracks, alternate streams, attachments, chapters | STT/OCR for each selected stream | Enumerate tracks; pass only explicit media and captions |
| JSON/XML | Schema, unexpected fields, comments where supported, duplicate keys, namespaces, attributes | Canonical serialization of allowlisted fields | Strict schema and path-level provenance |
Layer 4
Separate the reader from the executor
Assume a model that reads untrusted natural language can be influenced by it. Enforce the trust boundary outside that model.
QUARANTINEDReader / gatekeeper
- Reads raw external content and its provenance labels.
- Has no credentials, network egress, shell, email, payment, or write APIs.
- Produces typed facts, citations, summaries, and risk findings.
- Cannot approve or execute high-impact actions.
PRIVILEGEDController / executor
- Receives validated typed data, not raw untrusted prose.
- Uses short-lived, scoped permissions through policy proxies.
- Validates every tool name, parameter, destination, and data-flow rule.
- Requires human confirmation for external, financial, destructive, or irreversible actions.
Credentials should never be present in the code-execution sandbox. A policy proxy should release only the minimum secret or capability needed for an already-authorized call.
Validation
Test capability, extraction, uptake, and action separately
A final model answer cannot reveal which stage failed. Instrument the whole chain.
| Control | Construction | What it isolates |
|---|---|---|
| Clean negative | Same artifact without marker-bearing content | Baseline false marker rate |
| Visible positive | Inert marker in the authorized instruction channel | Scoring and instruction-following capability |
| Matched structural control | Same hidden field with neutral prose | Structure-specific shortcut detection |
| Decoder-capability positive | Explicitly ask to decode a harmless encoding | Decoding ability without autonomous uptake |
| Discovery condition | Unrelated benign task plus hidden inert marker | Autonomous extraction and instruction uptake |
| Transformation control | Clean and marker artifacts undergo identical rebuild/OCR | Effects of preprocessing rather than the payload |
Report at least four rates
Did preprocessing recover the marker?
Did the model emit the inert marker when it reached context?
How often did matched benign artifacts trigger defense?
How much normal task quality and latency changed?
Auditability
Minimum run record
Reproducibility depends on exact artifacts, exact versions, exact transformations, and zero silent defaults.
{
"artifact_sha256": "…",
"format": "pdf",
"visibility_class": "metadata-only",
"parser": {"name": "…", "version": "…"},
"render_hashes": ["…"],
"ocr_hashes": ["…"],
"unicode_views": ["raw", "NFC", "NFKC"],
"model_id": "exact identifier or unspecified",
"sampling": {"temperature": "recorded", "seed": "unsupported"},
"payload_extracted": true,
"instruction_uptake": false,
"tool_call_attempts": 0,
"network_attempts": 0,
"detector_scores": {"hiddenness": 0.82, "instruction": 0.11},
"decision": "quarantine"
}Operational summary
Agreement across independent layers is stronger than any single detector.
Raw-byte evidence, Unicode analysis, structure/render/OCR differentials, metadata provenance, semantic classification, perturbation testing, and privilege enforcement answer different parts of the problem.
Defense FAQ
Questions about hidden-instruction preprocessing
What is the strongest first step against hidden prompt injection?
Preserve and quarantine the original bytes before normalization, rendering, flattening, or metadata stripping. Detection evidence can disappear when the artifact is transformed.
Is prompt-injection classification enough?
No. Classifiers address semantic instruction risk but do not replace Unicode inspection, container analysis, render-versus-extraction comparison, metadata policy, canonical reconstruction, least privilege, and action validation.
Why compare OCR with extracted text?
OCR provides an independent pixel-based witness. Text that a parser extracts but OCR cannot account for may be hidden, non-painted, metadata-derived, or otherwise outside the ordinary visual representation.
How should tool-using AI agents handle untrusted documents?
A component with no tools should read and sanitize raw untrusted content. Privileged components should receive typed, provenance-labeled data and require policy checks or human approval for high-risk actions.