Research · curated 24 Jul 2026
CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
CrackedPDFs shows that flattening PDFs before guardrail inspection discards structural evidence of hidden injected instructions, giving defenders a benchmark and hybrid-detection approach for a real document-layer indirect prompt-injection attack surface.
CrackedPDFs is a controlled benchmark of 29,322 generated PDFs (9,774 injected, 19,548 benign/confounder) for studying hidden prompt injection in documents that LLM pipelines flatten before guardrails inspect them. The authors evaluate PromptGuard, rule baselines, structural-only learned models, and a document-aware hybrid detector, which reaches 0.960 F1 with 0.998 ROC-AUC on a held-out set while noting PromptGuard's low recall on extracted text and the limits of real-world generalization.