Your AI may read a different version of your Office file than you do

The model does not see your slide

When you drop a Word file, a slide deck or a spreadsheet into an AI chat, it is natural to assume the model looks at the document the way you do. According to the paper, as arxiv.org reported, that assumption is often wrong. The model typically reads text that a separate piece of software, called an extractor, pulls out of the files that sit underneath the document.

Those underlying files use a format called Office Open XML, or OOXML. Different extractors read different parts of it and interpret what they find in different ways. As a result, what reaches the model can differ from what Office applications display.

The authors give a simple example. By nudging the positions of text boxes on a slide a little, an attacker can change the order in which the model reads them, while the slide looks the same to a person.

Measuring the gap

The researchers first set out to learn how much room an attacker really has. They studied widely used extractors that LLM applications depend on. They combined two methods: reading the extractors' source code, and running them to see what they actually do.

That turned up two kinds of mismatch. In 19 OOXML channels, extractors read content that a human cannot see. In 12 others, they drop content that a human can see.

There is a quieter problem too. The paper says widely used extractors ignore display formatting and reading order. So even content that is visible and does get through can arrive in a different form from the one a reader experiences.

Five attacks that plant no instructions

Most worry about AI and documents centres on prompt injection, where hidden text tells the model to do something it should not. This work is different. The authors built five attacks that push the model to interpret a document differently from a human reviewer, without injecting any instruction.

That matters because a defense that scans for suspicious commands would have nothing to catch. The document can contain no command at all. The model simply receives a version of the content that does not match what a person approved.

The team tested the attacks on four major chat assistants: ChatGPT, Claude, Gemini and Microsoft 365 Copilot. They also tested four coding agents: Codex, Claude Code, Antigravity and GitHub Copilot CLI. Every one of the eight was misled by at least one attack.

Prism: rebuilding what a human sees

The authors also propose a defense called Prism. It is described as lightweight. Before any text goes to the model, Prism reconstructs the human view of the document from the OOXML specification, the formal description of how the format should be displayed.

In other words, instead of trusting whatever an extractor happens to read, it works out what a person would actually see and passes that along. The paper says Prism also generalizes to attack payloads it was not built around.

The source we have is the abstract, so it does not tell us how well Prism performs in numbers, what it costs in speed, or whether any assistant maker plans to adopt it. Those details would be in the full paper.

What to do with this

For most readers, the practical lesson is about trust. A summary of a contract, a slide deck or a spreadsheet is only as faithful as the text the model was given. If a figure, a table or a reading order gets lost or reshuffled on the way in, the answer can be fluent and still wrong.

This is most important when the stakes are real and the file may come from someone else. If a document arrives from outside your organisation, a reviewer who sees it on screen and an assistant that reads it as extracted text may not be looking at the same thing.

• Check key numbers and conclusions in an AI summary against the original file.
• Be extra careful with files from people you do not know.
• Treat a model's reading of a document as a second opinion, not a replacement for looking.