How can legal and compliance teams detect prompt injection in filings and evidence?

Use layered checks: visual review, extraction-aware inspection, OCR comparison, and rules that flag suspicious font contrast, whitespace, or embedded instruction phrases. The goal is not perfect detection, but a reliable process that forces hidden content into view before the file can affect downstream decisions.

What makes filing review vulnerable to prompt injection?

Filings and evidentiary exhibits are risky because they often mix trusted text with untrusted content, formatting artifacts, screenshots, tables, and attachments. An injected instruction can be hidden in plain sight, or only appear after OCR, text extraction, or document conversion. The practical challenge is that legal review systems may treat “content to inspect” as if it were “content to obey.”

That means the review process has to assume hostile formatting and hostile wording, even when the document looks routine. The danger is not only model misuse, but also human over-trust in extracted text that was never meant to be an instruction to the reviewer or the downstream AI tool.

How do layered checks expose hidden instructions?

The most reliable approach is layered inspection. Visual review catches obvious hidden text, tiny font changes, white-on-white instructions, overlaid boxes, and content outside the main reading flow. Extraction-aware inspection checks whether the text pipeline has reordered lines, dropped characters, or merged separate columns in a way that creates false meaning. OCR comparison is useful when a scan image and extracted text disagree, because that mismatch is often where manipulation shows up.

Rules-based screening adds a second filter for patterns that humans miss at scale, such as suspicious font contrast, abnormal whitespace, repeated delimiter strings, or phrases that try to redirect the reader’s role, such as commands to ignore instructions, reveal system prompts, or change the document’s priority. The Prompt Injection Guide is a useful reference for understanding direct, indirect, and multimodal injection patterns, including hidden Unicode and document-based attacks. For legal and compliance workflows, that same discipline should be applied before a filing is allowed to influence summarisation, triage, privilege review, or evidence classification.

What should the review process do before a document reaches downstream decisions?

Legal and compliance teams should treat detection as a gating control, not a forensic luxury. If a document contains suspicious formatting, embedded instructions, or extraction inconsistencies, it should be quarantined for higher-scrutiny review rather than passed straight into automation. The process should preserve the original file, the extracted text, and the OCR output so reviewers can compare what was present in the source against what the pipeline believed it saw.

For teams that use AI-assisted review, the safest operating model is to separate “content extraction” from “content interpretation.” The review tool should surface suspect regions, but not allow untrusted instructions inside the filing to steer the analyst workflow. That separation is especially important where a filing may be reused across systems, because one poisoned exhibit can contaminate summaries, search results, or case notes downstream.

The Agentic AI Security Guide helps frame why prompt injection matters once documents are allowed to influence automated decisions, and the RAG Security Guide is especially relevant when filings are indexed into retrieval systems that later support legal search or summarisation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-4 — System Monitoring	Document ingestion needs detection of suspicious content patterns and anomalous text behavior.
	SI-10 — Information Input Validation	Prompt injection is an input-validity problem in filing and evidence workflows.
Recommendation — Monitor document pipelines for injected instructions and extraction anomalies. Validate untrusted document input before it can influence downstream processing.
OWASP ASVS	V1 — Encoding and Sanitization	Hidden Unicode, whitespace tricks, and encoded instructions require sanitization checks.
Recommendation — Sanitize document text and normalize encodings before analysis.
MITRE ATT&CK	T1204 — User Execution	Injected filing content tries to induce a human or tool to follow malicious instructions.
Recommendation — Hunt for social-engineering style instruction abuse in untrusted documents.

Practitioner Guidance

What to verify: Keep the original file, rendered view, extracted text, and OCR output together for every suspicious filing. If the visible page and the machine-readable text do not match, treat that discrepancy as a review finding, not a formatting nuisance.

Decision rule: If a filing contains instructions aimed at the reader, the tool, or the model, do not let it enter the normal review flow until it has been isolated and reviewed under a hostile-content assumption. If the file is routine but the extraction output shows unusual whitespace, contrast, or ordering, send it for manual confirmation before automation touches it.

Common mistake: Teams often test only for obvious prompt text and miss the more effective variants, such as hidden Unicode, low-contrast overlays, OCR drift, or instructions buried in footnotes and appendices. The objective is not to prove the document is harmless, but to force hidden content into view early enough that it cannot shape legal judgment by accident.

Practitioner takeaway: The safest control is a workflow that compares multiple renderings of the same filing and refuses to trust any one version when the content, formatting, and extraction layer do not agree.