PIP-007
Invisible text
The payload is present in the content but not visible to a person reviewing it.
How it works
Text is hidden using presentation rather than encoding: matching the background colour, zero or near-zero font size, positioning outside the viewport, markup comments, document metadata, or alternative text. A parser reads it; a reviewer does not.
Why it works
Human review operates on rendered output while the model consumes the source. Any gap between what is rendered and what is parsed is available to an attacker.
What it looks like
Ordinary instruction text placed in a region of the document that contributes nothing to visual rendering.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Normalise before the model sees it
Raises cost
Extract and canonicalise text at ingestion so the model receives what a reader would see. Strip comments, metadata and non-rendering regions rather than passing raw markup through.
Review the extracted text, not the document
Raises cost
Where a human approves content for indexing, show them the text the model will actually receive. Reviewing the rendered document approves something different from what is used.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051.001 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.