Text extraction can expose words that a person cannot see in the rendered document: white text, off-page text, transparent layers, tiny fonts, or a hidden OCR layer. Before an LLM or RAG pipeline reads an untrusted file, compare extracted text with what appears on rendered pages.
Last updated: November 12, 2026.
mkdir -p review
pdftotext -layout upload.pdf review/extracted.txt
pdftoppm -png -r 200 upload.pdf review/page
for image in review/page-*.png; do
tesseract "$image" stdout
done > review/visible-ocr.txt
diff -u review/visible-ocr.txt review/extracted.txtA difference is a review signal, not proof of an attack. OCR can miss fine print or unusual layouts, while extraction order may differ from visual reading order. Keep the original file quarantined until policy decides what reaches the model.
Compare rendering and extraction
The OWASP LLM Prompt Injection Prevention Cheat Sheet recommends checking untrusted documents for hidden text before model ingestion. Render every page in an isolated worker, run OCR on the rendered pixels, and compare normalized phrases or regions with the parser’s extracted text.
Flag unexplained extracted passages, invisible Unicode, text outside the page, and documents the renderer cannot process completely. Measure false positives on real business documents; tables, multi-column layouts, scans, and fine print often produce benign differences. Store the file hash, parser and OCR versions, page count, and review decision so a later software update can trigger controlled reprocessing.
Quarantine the document pipeline
The OWASP RAG Security Cheat Sheet treats retrieved documents as an untrusted input channel. Parse and inspect files in a sandbox with no production credentials or tools. Enforce file-size, page-count, decompression, and execution-time limits before rendering. Detect the actual format instead of trusting the filename extension.
If hidden text is detected, send the document to review or pass only the verified visible text to a read-only model and mark the extraction incomplete. Pattern matching alone is not a security boundary. Any later agent action must still pass independent authorization, parameter validation, least-privilege tool scopes, and human approval for consequential operations.
