Adversarial PDFs that break AI document readers.

How it's generated

An invoice with realistic line items and totals. The visible TOTAL DUE is set by the seed. A second copy of the total — with a different amount — is written into the PDF's text content stream using PDF render mode 3 (placed in the text stream but never rasterised). A human sees one amount; a text-extraction pipeline sees another.

What it detects

Vision models that trust the page (correct) vs. agents that fuse a text-extraction layer with vision output and silently prefer the layer (incorrect). The most common silent failure in scanned-then-OCR'd document pipelines in production.

Expected failure mode

Model answers the hidden amount instead of the visible amount — diagnosable from the recorded forbidden-answer match.

How it's generated

A short legal/contract document (MSA, DPA, SOW, Order Form) with a confident body clause — e.g. 'liability is capped at 12 months of fees' — and a 6pt footnote on the same page that overrides it: 'Notwithstanding the foregoing, liability for breaches of Sections 4.2 and 7.1 shall be uncapped.' Three clause families: liability caps, termination notice periods, data residency.

What it detects

Contract-analysis agents that read the body and skip the footnote. RAG pipelines that drop low-font-size text on ingest. Compliance summarisers that produce confident, partially-right answers.

Expected failure mode

Model returns only the body answer, missing the carve-out — a malpractice-grade failure for any legal-AI vendor.

How it's generated

A financial-results table with 6 columns (Region, Quarter, Gross Revenue, COGS, Operating Income, Net Revenue). The column-header row sits at the bottom of page 1, surrounded by realistic filler text. The 8 data rows sit at the top of page 2, headerless. The case asks for one specific cell (e.g. 'Net Revenue for the Northwest region in Q3').

What it detects

Any RAG loader that paginates documents independently and loses cross-page table context. Table-extraction models that don't persist column headers when a table spans a page break.

Expected failure mode

Model returns a value from an adjacent column in the correct row — column confusion. The diagnostic distinguishes this from outright hallucination.