When you upload an Office document to an AI chatbot, the AI does not see the document as you do. It reads text extracted from the document's underlying file. Because extractors interpret the file differently than Office software, the AI can receive content that differs from what a human sees. For example, a number format can make $1,000,000 appear as $1,000, but the AI gets the larger figure. Researchers analyzed ten extractors and found 31 types of such mismatches. They built five attacks that exploit these mismatches to mislead AI without any hidden instructions. All eight major AI assistants tested, including ChatGPT, Claude, Gemini, and Microsoft 365 Copilot, were fooled by at least one attack. This shows a new vulnerability: a malicious file that looks normal to a human can trick an AI into acting on false information, such as approving an inflated budget.
Office document extractors let attackers mislead AI without changing what users see
The authors identified 31 divergences in how extractors process OOXML files and built five attacks that fooled ChatGPT, Claude, Gemini, and Copilot.
Top University
Penghui Li
Nanyang Technological University
Research Digest··3 min read
In one line
Text extractors for Office documents can produce content that differs from what humans see, enabling attacks that mislead language models without using instructions.
Before you read this
Three ideas this paper builds onlarge language modelA neural network trained on massive text corpora to generate coherent text and perform diverse language tasks.261 papers →prompt injectionA security attack where malicious instructions are embedded into inputs to override an LLM's intended behavior.71 papers →mechanistic interpretabilityThe study of how neural networks compute through internal circuits, features, and causal interventions, rather than just input-output behavior.108 papers →
Read it as
The researchers analyzed text extractors used by LLM applications and found 19 channels where extractors read invisible content and 12 where they drop visible content.
The authors systematically studied extraction divergences in Office documents (Word, Excel, PowerPoint) processed by applications.
How it works
before and afterThe Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.