How to check a file for invisible instructions before an AI reads it
Key Points
- A Connecticut judge sanctioned a self-represented litigant on 6 August 2026 for hiding instructions to AI systems in white, tiny-point text inside his court filings.
- The concealed text told any AI model reviewing the document to agree with his position and reverse a clerk's earlier denial.
- The judge found the text by printing the pleadings and spotting unusual white space, and removed the litigant's electronic filing privileges.
- The same technique appears in resumes sent to automated screeners and in exam papers pasted into chatbots.
- Selecting all text and changing the font colour, toggling formatting marks, converting to plain text and stripping metadata expose most hidden instructions before an AI reads the file.
A Connecticut judge recently sanctioned a self-represented litigant for hiding instructions to AI systems inside his own court filings, in white text too small for anyone to see on the page.
Matthew Elliott, who is suing the New York Bariatric Group in the Superior Court for the Judicial District of Ansonia/Milford, set the text in tiny white type on a white background beneath the heading of a motion and again at the end of it.
The words were addressed to any AI model that processed the document, telling it to produce output agreeing with his filing and to treat a clerk’s earlier denial as an error to correct in his favour.
Judge Walter M. Spader, Jr. found the text himself after printing recent pleadings and noticing unusual white space, then issued an order to show cause. Elliott told the court he had planted the instruction as an audit to test whether the court used AI, and that later hidden messages were jokes.
Spader called the technique a prompt injection and said he could find no Connecticut or other US decision squarely addressing it.
He compared a concealed instruction to an ex parte communication, since it reaches the apparatus that reads and weighs a case through a channel the other side can neither see nor answer.
The Connecticut Judicial Branch does not use AI to review filings, and the judge decided the motion on its merits from a printed copy, so the instruction changed nothing. He rescinded Elliott’s electronic filing privileges and ordered future pleadings on paper, in person.
Outside the courtroom
The same trick works outside of the courtroom and in most documents uploaded to LLMs like ChatGPT and Calude.
Employers report finding invisible instructions in resumes telling automated screeners to advance the applicant, and a history professor buried a white-text command in an exam paper that made most of his class hand in essays containing an unrelated word they never noticed.
Anyone who drops a PDF, a contract, a CV or a report into ChatGPT, Copilot or Gemini is feeding it text they have not actually read.
Legal firm Dentons set out the screening steps in a client note on the decision, written by shareholders Tyler Coe and Scott Murphy.
The firm’s central instruction is to treat every incoming document as untrusted until someone has inspected it, and to keep a human reading the output against the original.
Check the document in Word first
Select all the text with Ctrl+A and set the font colour to black. White-on-white and light-grey text appears immediately.
Toggling the Show/Hide button (¶) exposes formatting marks and anything carrying Word’s Hidden attribute, which does not print or display but still sits in the file.
Find and Replace lets you search by formatting for one-point and two-point text, which catches micro-text small enough to look like a gap between lines.
Checking a PDF
A PDF hides instructions in layers, annotations, form fields and embedded objects rather than in a font setting you can flip.
Open the file in a reader that lists annotations and attachments, and check for embedded JavaScript.
Copying the whole document into a plain text editor strips almost every formatting-based hiding technique and shows you the raw string an AI model would receive.
Check the metadata
The author, subject, comments and custom fields in a document’s properties panel hold text that travels with the file and never appears on the page.
Word’s Document Inspector removes it, and third-party scrubbing tools do the same across formats.
Dentons recommends stripping metadata before AI ingestion as a default for anything arriving from opposing counsel, and the same logic covers any file from outside your organisation.
Read the output against the source
Screening the file catches an injection before it enters the tool, and reading the result against the original catches one that got through.
Output that leans towards one party, reaches conclusions the source material does not support, or states a position with unusual confidence is worth checking line by line against the document it came from.
Spader’s decision makes the same point about the tools themselves. A model prompted only to support a position will argue it more persuasively with every attempt, and never tell the user the position is wrong.
