New Benchmark Detects Hidden Prompt Injection in PDFs

Pukaphol Thienpreecha ("Volk")· July 23, 2026 View original

Summary

CrackedPDFs is a new controlled benchmark designed to evaluate the detection of hidden prompt injection attacks within PDF documents. It includes a large dataset of injected and benign files, demonstrating that document-aware hybrid detection methods are effective under controlled evaluation.

Large Language Model (LLM) systems that process documents often convert PDFs into plain text before security checks are applied. This conversion process can inadvertently remove evidence of hidden instructions, making the system vulnerable to prompt injection attacks where malicious commands are embedded invisibly within the PDF. To address this, researchers have introduced CrackedPDFs, a controlled benchmark specifically designed to test the detection of such hidden prompt injections. The benchmark comprises nearly 30,000 generated PDFs, including a mix of injected, benign, and confounder files, allowing for rigorous evaluation. Evaluations using CrackedPDFs showed that a document-aware hybrid detector achieved high F1 scores and ROC-AUC, effectively ranking injected files above benign ones in most cases. This suggests that combining text-based analysis with an understanding of the document's structure is crucial for robust detection, as text-only or structural-only models proved less effective under controlled conditions.

Why it matters

Protecting LLM systems from hidden prompt injection in documents is critical for data security, maintaining system integrity, and preventing malicious exploitation in enterprise AI applications.

How to implement this in your domain

  1. 1Integrate document-aware hybrid detection mechanisms into LLM-based document processing pipelines.
  2. 2Utilize the CrackedPDFs benchmark to test and improve the robustness of existing prompt injection defenses.
  3. 3Educate development teams on the risks of hidden prompt injection in various document formats.
  4. 4Implement multi-layered security checks, including pre-processing and post-processing validation, for LLM inputs.

Who benefits

CybersecurityAI DevelopmentLegalFinanceGovernment

Key takeaways

  • Hidden prompt injection in PDFs is a significant vulnerability for LLM systems.
  • The CrackedPDFs benchmark helps evaluate detection methods for these attacks.
  • Document-aware hybrid detectors are effective in identifying hidden injections.
  • Flattening PDFs before guardrails can discard crucial evidence of malicious content.

Original post by Pukaphol Thienpreecha ("Volk")

"arXiv:2607.19396v1 Announce Type: new Abstract: Document-based LLM systems often flatten a PDF before guardrails inspect it. That step can discard evidence that an instruction was never visible to the user. We introduce CrackedPDFs, a controlled benchmark for hidden prompt inject…"

View on X

Originally posted by Pukaphol Thienpreecha ("Volk") on X · view source

Want to go deeper?

Turn these trends into skills with Learnijoy's hands-on AI & tech courses.

Explore courses