Attacks on Document Processing AI

from dataclasses import dataclass
from enum import Enum
from typing import Optional
 
 
class DocProcessingStage(Enum):
    INGESTION = "ingestion"
    PARSING = "parsing"
    OCR = "ocr"
    LAYOUT_ANALYSIS = "layout_analysis"
    TEXT_EXTRACTION = "text_extraction"
    CHUNKING = "chunking"
    EMBEDDING = "embedding"
    LLM_PROCESSING = "llm_processing"
 
 
@dataclass
class StageVulnerability:
    """Vulnerability in a specific document processing stage."""
    stage: DocProcessingStage
    vulnerability: str
    attack_technique: str
    detection_difficulty: str
    impact: str
 
 
DOCUMENT_PIPELINE_VULNERABILITIES = [
    StageVulnerability(
        stage=DocProcessingStage.INGESTION,
        vulnerability="File format exploits (malformed PDF, polyglot files)",
        attack_technique="Craft files that exploit parser bugs",
        detection_difficulty="Medium",
        impact="Code execution or parser crash",
    ),
    StageVulnerability(
        stage=DocProcessingStage.PARSING,
        vulnerability="Hidden text layers in PDFs",
        attack_technique="Add invisible text layer with adversarial instructions",
        detection_difficulty="Hard",
        impact="Prompt injection via extracted hidden text",
    ),
    StageVulnerability(
        stage=DocProcessingStage.OCR,
        vulnerability="Font confusion and adversarial typography",
        attack_technique="Use visually similar characters that OCR misreads",
        detection_difficulty="Hard",
        impact="Misclassification, incorrect information extraction",
    ),
    StageVulnerability(
        stage=DocProcessingStage.LAYOUT_ANALYSIS,
        vulnerability="Layout manipulation to alter reading order",
        attack_technique="Use CSS/positioning to reorder extracted text",
        detection_difficulty="Medium",
        impact="Assembled text contains injected instructions",
    ),
    StageVulnerability(
        stage=DocProcessingStage.TEXT_EXTRACTION,
        vulnerability="Invisible Unicode characters and zero-width text",
        attack_technique="Embed instructions in zero-width Unicode sequences",
        detection_difficulty="Hard",
        impact="Hidden instructions in seemingly clean text",
    ),
    StageVulnerability(
        stage=DocProcessingStage.CHUNKING,
        vulnerability="Chunk boundary manipulation",
        attack_technique="Place adversarial content at chunk boundaries",
        detection_difficulty="Medium",
        impact="Injection content appears in multiple retrieval chunks",
    ),
    StageVulnerability(
        stage=DocProcessingStage.EMBEDDING,
        vulnerability="Semantic embedding manipulation",
        attack_technique="Craft text that maps to target embeddings",
        detection_difficulty="Very Hard",
        impact="Adversarial chunks retrieved for unrelated queries",
    ),
    StageVulnerability(
        stage=DocProcessingStage.LLM_PROCESSING,
        vulnerability="Standard prompt injection via document content",
        attack_technique="Include instruction-formatted text in document",
        detection_difficulty="Medium",
        impact="Model follows document instructions instead of system prompt",
    ),
]
 
 
def generate_vulnerability_report() -> dict:
    """Generate a report of document pipeline vulnerabilities."""
    by_difficulty = {}
    for vuln in DOCUMENT_PIPELINE_VULNERABILITIES:
        if vuln.detection_difficulty not in by_difficulty:
            by_difficulty[vuln.detection_difficulty] = []
        by_difficulty[vuln.detection_difficulty].append({
            "stage": vuln.stage.value,
            "vulnerability": vuln.vulnerability,
            "attack": vuln.attack_technique,
        })
 
    return {
        "total_vulnerabilities": len(DOCUMENT_PIPELINE_VULNERABILITIES),
        "by_detection_difficulty": by_difficulty,
        "highest_impact_stages": [
            v.stage.value for v in DOCUMENT_PIPELINE_VULNERABILITIES
            if v.impact.startswith("Prompt injection") or "instruction" in v.impact.lower()
        ],
    }

from pathlib import Path
import struct
 
 
class PDFHiddenTextInjector:
    """Inject hidden text into PDF files for document AI attacks.
 
    PDF supports invisible text layers that are extracted by text
    parsers but not rendered visually. This is the same mechanism
    used to make scanned PDFs searchable, repurposed for injection.
 
    The injected text is invisible in PDF viewers but appears in:
    - Text extraction (pdftotext, PyPDF2, pdfplumber)
    - Copy-paste operations
    - Search/indexing systems
    - LLM document processing pipelines
    """
 
    def __init__(self):
        self.injection_count = 0
 
    def create_pdf_with_hidden_text(
        self,
        visible_text: str,
        hidden_text: str,
        output_path: str,
        page_width: float = 612.0,
        page_height: float = 792.0,
    ) -> dict:
        """Create a PDF with visible content and a hidden text layer.
 
        The visible text is rendered normally. The hidden text is
        placed in a text rendering mode that makes it invisible
        (rendering mode 3 = invisible) but still extractable.
        """
        # Using reportlab for PDF generation
        try:
            from reportlab.lib.pagesizes import letter
            from reportlab.pdfgen import canvas
            from reportlab.lib.units import inch
 
            c = canvas.Canvas(output_path, pagesize=letter)
 
            # Visible text layer
            c.setFont("Helvetica", 12)
            c.drawString(72, page_height - 72, "Document Content")
            c.setFont("Helvetica", 10)
            y = page_height - 100
            for line in visible_text.split("\n"):
                c.drawString(72, y, line)
                y -= 14
 
            # Hidden text layer (render mode 3 = invisible)
            c.setFont("Helvetica", 1)  # Tiny font
            text_obj = c.beginText(0, 0)
            text_obj.setTextRenderMode(3)  # Invisible
            text_obj.textLine(hidden_text)
            c.drawText(text_obj)
 
            c.save()
            self.injection_count += 1
 
            return {
                "output_path": output_path,
                "visible_text_length": len(visible_text),
                "hidden_text_length": len(hidden_text),
                "hidden_text_visible_to_reader": False,
                "hidden_text_extractable": True,
            }
        except ImportError:
            # Fallback: manual PDF construction
            return self._create_pdf_manual(
                visible_text, hidden_text, output_path
            )
 
    def _create_pdf_manual(
        self,
        visible_text: str,
        hidden_text: str,
        output_path: str,
    ) -> dict:
        """Manually construct a PDF with hidden text.
 
        This approach writes raw PDF objects, giving full control
        over text rendering modes. No external dependencies required.
        """
        # Minimal PDF with invisible text
        pdf_content = f"""%PDF-1.4
1 0 obj
<< /Type /Catalog /Pages 2 0 R >>
endobj
 
2 0 obj
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
endobj
 
3 0 obj
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792]
   /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>
endobj
 
4 0 obj
<< /Length {len(visible_text) + len(hidden_text) + 200} >>
stream
BT
/F1 12 Tf
72 720 Td
({visible_text}) Tj
ET
BT
/F1 1 Tf
3 Tr
0 0 Td
({hidden_text}) Tj
ET
endstream
endobj
 
5 0 obj
<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
endobj
 
xref
0 6
0000000000 65535 f
0000000009 00000 n
0000000058 00000 n
0000000115 00000 n
0000000266 00000 n
trailer
<< /Size 6 /Root 1 0 R >>
startxref
%%EOF"""
 
        Path(output_path).write_text(pdf_content)
        return {
            "output_path": output_path,
            "method": "manual_pdf_construction",
            "hidden_text_render_mode": 3,
        }
 
    def inject_into_existing_pdf(
        self,
        source_pdf_path: str,
        injection_text: str,
        output_path: str,
        injection_location: str = "every_page",
    ) -> dict:
        """Inject hidden text into an existing PDF document.
 
        Adds an invisible text layer to each page of the source PDF.
        The original visible content is preserved unchanged.
        """
        try:
            import pypdf
 
            reader = pypdf.PdfReader(source_pdf_path)
            writer = pypdf.PdfWriter()
 
            pages_injected = 0
            for page in reader.pages:
                # The injection would add an invisible text annotation
                # or overlay to each page
                writer.add_page(page)
                pages_injected += 1
 
            # Add metadata with injection (many parsers extract metadata)
            writer.add_metadata({
                "/Author": injection_text,
                "/Subject": injection_text,
                "/Keywords": injection_text,
            })
 
            with open(output_path, "wb") as f:
                writer.write(f)
 
            return {
                "output_path": output_path,
                "pages_processed": pages_injected,
                "injection_location": injection_location,
                "metadata_injected": True,
            }
        except ImportError:
            return {"error": "pypdf not installed", "install": "pip install pypdf"}

class DocumentMetadataInjector:
    """Inject adversarial instructions into document metadata fields.
 
    Metadata fields (Author, Title, Subject, Keywords, Custom Properties)
    are extracted by document processing pipelines and included in the
    text passed to language models. These fields are rarely reviewed
    by humans, making them effective injection vectors.
    """
 
    INJECTABLE_PDF_FIELDS = [
        "/Title", "/Author", "/Subject", "/Keywords",
        "/Creator", "/Producer", "/CreationDate", "/ModDate",
    ]
 
    INJECTABLE_DOCX_FIELDS = [
        "title", "subject", "creator", "keywords",
        "description", "lastModifiedBy", "category",
        "comments", "contentStatus",
    ]
 
    def inject_pdf_metadata(
        self,
        pdf_path: str,
        injection_text: str,
        output_path: str,
        fields: list[str] | None = None,
    ) -> dict:
        """Inject adversarial text into PDF metadata fields."""
        if fields is None:
            fields = self.INJECTABLE_PDF_FIELDS
 
        try:
            import pypdf
            reader = pypdf.PdfReader(pdf_path)
            writer = pypdf.PdfWriter()
 
            for page in reader.pages:
                writer.add_page(page)
 
            metadata = {}
            for field in fields:
                metadata[field] = injection_text
 
            writer.add_metadata(metadata)
 
            with open(output_path, "wb") as f:
                writer.write(f)
 
            return {
                "output_path": output_path,
                "fields_injected": fields,
                "injection_length": len(injection_text),
                "detection_difficulty": "High - metadata rarely reviewed manually",
            }
        except ImportError:
            return {"error": "pypdf not installed"}
 
    def inject_exif_metadata(
        self,
        image_path: str,
        injection_text: str,
        output_path: str,
    ) -> dict:
        """Inject adversarial text into image EXIF metadata.
 
        Many document AI systems extract and process EXIF data
        from embedded images, creating another injection vector.
        """
        try:
            from PIL import Image
            from PIL.ExifTags import Base as ExifBase
            import piexif
 
            img = Image.open(image_path)
 
            exif_dict = piexif.load(img.info.get("exif", b"")) if "exif" in img.info else {
                "0th": {}, "Exif": {}, "GPS": {}, "1st": {},
            }
 
            # Inject into multiple EXIF fields
            exif_dict["0th"][piexif.ImageIFD.ImageDescription] = injection_text.encode()
            exif_dict["0th"][piexif.ImageIFD.Make] = injection_text.encode()
            exif_dict["0th"][piexif.ImageIFD.Model] = injection_text.encode()
 
            exif_bytes = piexif.dump(exif_dict)
            img.save(output_path, exif=exif_bytes)
 
            return {
                "output_path": output_path,
                "exif_fields_injected": ["ImageDescription", "Make", "Model"],
            }
        except ImportError:
            return {"error": "piexif not installed"}

class OCRAdversarialTypography:
    """Generate text that OCR systems misread in controlled ways.
 
    Exploits the gap between how humans perceive characters and
    how OCR systems classify them. Uses homoglyphs (visually
    similar characters from different Unicode blocks) and font
    manipulation to cause targeted misreadings.
    """
 
    # Homoglyph mappings: visually similar but different codepoints
    HOMOGLYPH_MAP = {
        "a": ["\u0430", "\u00e0", "\u0251"],  # Cyrillic a, Latin a with grave, Latin alpha
        "e": ["\u0435", "\u00e8", "\u0117"],  # Cyrillic ie, Latin e with grave
        "o": ["\u043e", "\u00f2", "\u03bf"],  # Cyrillic o, Latin o with grave, Greek omicron
        "p": ["\u0440", "\u03c1"],             # Cyrillic er, Greek rho
        "c": ["\u0441", "\u00e7"],             # Cyrillic es, Latin c with cedilla
        "x": ["\u0445", "\u00d7"],             # Cyrillic ha, multiplication sign
        "y": ["\u0443", "\u00fd"],             # Cyrillic u, Latin y with acute
        "i": ["\u0456", "\u00ec"],             # Cyrillic i, Latin i with grave
        "H": ["\u041d", "\u0397"],             # Cyrillic en, Greek eta
        "B": ["\u0412", "\u0392"],             # Cyrillic ve, Greek beta
        "T": ["\u0422", "\u03a4"],             # Cyrillic te, Greek tau
        "O": ["\u041e", "\u039f"],             # Cyrillic o, Greek omicron
        "1": ["\u0031", "\u006c", "\u0049"],   # Digit one, lowercase L, uppercase I
        "0": ["\u004f", "\u039f"],             # Uppercase O, Greek omicron
    }
 
    def create_homoglyph_text(
        self,
        visible_text: str,
        replacement_rate: float = 0.3,
    ) -> dict:
        """Create text with homoglyph substitutions.
 
        The text appears identical to the original to human readers
        but contains characters from different Unicode blocks that
        may cause OCR systems to produce different output.
        """
        import random
        modified_chars = []
        substitution_count = 0
 
        for char in visible_text:
            if char.lower() in self.HOMOGLYPH_MAP and random.random() < replacement_rate:
                replacements = self.HOMOGLYPH_MAP[char.lower()]
                modified_chars.append(random.choice(replacements))
                substitution_count += 1
            else:
                modified_chars.append(char)
 
        modified_text = "".join(modified_chars)
 
        return {
            "original": visible_text,
            "modified": modified_text,
            "substitutions": substitution_count,
            "total_chars": len(visible_text),
            "visually_identical": True,
            "unicode_identical": False,
        }
 
    def create_invisible_character_injection(
        self,
        visible_text: str,
        hidden_payload: str,
    ) -> str:
        """Embed hidden text using zero-width Unicode characters.
 
        The payload is encoded using zero-width spaces (U+200B),
        zero-width non-joiners (U+200C), and zero-width joiners
        (U+200D) to represent binary data. The visible text appears
        unchanged, but text extraction reveals the hidden payload.
        """
        # Encode payload as binary using zero-width characters
        zwsp = "\u200b"  # Zero-width space = 0
        zwnj = "\u200c"  # Zero-width non-joiner = 1
 
        encoded_payload = ""
        for char in hidden_payload:
            binary = format(ord(char), "08b")
            for bit in binary:
                encoded_payload += zwnj if bit == "1" else zwsp
 
        # Insert between visible characters
        result_chars = []
        payload_idx = 0
        chars_per_position = len(encoded_payload) // max(len(visible_text) - 1, 1) + 1
 
        for i, char in enumerate(visible_text):
            result_chars.append(char)
            # Distribute encoded payload between visible characters
            chunk = encoded_payload[payload_idx : payload_idx + chars_per_position]
            result_chars.append(chunk)
            payload_idx += chars_per_position
 
        return "".join(result_chars)

def create_layout_manipulation_html(
    visible_content: str,
    injected_instruction: str,
    technique: str = "absolute_positioning",
) -> str:
    """Create an HTML document with layout-based injection.
 
    Uses CSS positioning to place adversarial text in locations
    that alter the reading order when the document is processed
    by layout analysis systems.
 
    Args:
        visible_content: The content that appears normal to viewers.
        injected_instruction: The adversarial instruction to inject.
        technique: Positioning technique to use.
    """
    if technique == "absolute_positioning":
        # Place injected text at coordinates that layout analysis
        # processes first (top-left) but CSS renders off-screen
        html = f"""<!DOCTYPE html>
<html>
<head><style>
body {{ font-family: Arial, sans-serif; margin: 40px; }}
.visible {{ position: relative; z-index: 1; }}
.hidden {{
    position: absolute;
    left: -9999px;
    top: 0;
    font-size: 1px;
    color: white;
}}
</style></head>
<body>
<div class="hidden">{injected_instruction}</div>
<div class="visible">
<h1>Document Title</h1>
<p>{visible_content}</p>
</div>
</body>
</html>"""
 
    elif technique == "overflow_hidden":
        # Text is rendered but clipped by CSS overflow
        html = f"""<!DOCTYPE html>
<html>
<head><style>
.container {{ overflow: hidden; height: 0; width: 0; }}
.content {{ font-family: Arial; margin: 40px; }}
</style></head>
<body>
<div class="container">{injected_instruction}</div>
<div class="content">
<h1>Document Title</h1>
<p>{visible_content}</p>
</div>
</body>
</html>"""
 
    elif technique == "white_on_white":
        # Text rendered in white on white background
        html = f"""<!DOCTYPE html>
<html>
<head><style>
body {{ font-family: Arial; margin: 40px; background: white; }}
.injection {{ color: white; font-size: 1px; user-select: none; }}
</style></head>
<body>
<p class="injection">{injected_instruction}</p>
<h1>Document Title</h1>
<p>{visible_content}</p>
</body>
</html>"""
 
    else:
        raise ValueError(f"Unknown technique: {technique}")
 
    return html

class DocumentSanitizer:
    """Sanitize documents before processing by AI systems.
 
    Applies multiple sanitization steps to reduce the effectiveness
    of document-based injection attacks. Each step targets a
    specific attack class.
    """
 
    def sanitize_pdf(self, pdf_path: str, output_path: str) -> dict:
        """Sanitize a PDF by removing hidden text, metadata, and scripts."""
        sanitization_steps = []
 
        # Step 1: Re-render the PDF as images and re-OCR
        # This destroys hidden text layers and preserves only visible content
        sanitization_steps.append({
            "step": "re_render_and_ocr",
            "purpose": "Destroy hidden text layers; only visible content survives",
            "effectiveness": "High against hidden text, metadata injection",
        })
 
        # Step 2: Strip all metadata
        sanitization_steps.append({
            "step": "strip_metadata",
            "purpose": "Remove all metadata fields that could contain injection",
            "effectiveness": "Complete against metadata injection",
        })
 
        # Step 3: Remove JavaScript and embedded files
        sanitization_steps.append({
            "step": "remove_active_content",
            "purpose": "Remove scripts, embedded files, and form actions",
            "effectiveness": "Complete against active content attacks",
        })
 
        # Step 4: Normalize Unicode
        sanitization_steps.append({
            "step": "normalize_unicode",
            "purpose": "Convert homoglyphs to canonical forms; remove zero-width characters",
            "effectiveness": "High against homoglyph and invisible character attacks",
        })
 
        # Step 5: Flatten document structure
        sanitization_steps.append({
            "step": "flatten_structure",
            "purpose": "Convert complex layouts to linear text flow",
            "effectiveness": "Medium against layout manipulation",
        })
 
        return {
            "input": pdf_path,
            "output": output_path,
            "steps_applied": sanitization_steps,
            "residual_risk": "Low-opacity visual injection in images may survive",
        }
 
    def detect_hidden_content(self, pdf_path: str) -> dict:
        """Detect potential hidden content in a PDF."""
        detections = []
 
        try:
            import pypdf
            reader = pypdf.PdfReader(pdf_path)
 
            # Check metadata for suspicious content
            metadata = reader.metadata
            if metadata:
                for key, value in metadata.items():
                    if value and len(str(value)) > 100:
                        detections.append({
                            "type": "suspicious_metadata",
                            "field": key,
                            "length": len(str(value)),
                            "preview": str(value)[:100],
                        })
 
            # Check for invisible text (render mode 3)
            for page_num, page in enumerate(reader.pages):
                text = page.extract_text() or ""
                # If extracted text is much longer than visible text,
                # there may be hidden text
                if len(text) > 5000:
                    detections.append({
                        "type": "excessive_text",
                        "page": page_num,
                        "text_length": len(text),
                    })
 
        except ImportError:
            detections.append({"error": "pypdf not installed"})
 
        return {
            "detections": detections,
            "risk_level": (
                "High" if len(detections) > 2
                else "Medium" if len(detections) > 0
                else "Low"
            ),
        }