The Office document you see may not be the one an AI reads

An AI assistant can faithfully summarize the text it receives and still misrepresent the document its user opened. The problem may arise before the model starts reasoning: the software extracting text can produce a different account from the one displayed on screen.

In a preprint submitted to arXiv on November 4, 2026, Penghui Li of Nanyang Technological University investigates this gap in Word documents, Excel spreadsheets and PowerPoint presentations. The study calls it “extraction divergence.” Its findings concern the evaluated software and experiments, not a guarantee that every document upload will behave this way.

One file, different readings

Modern Office files package linked XML components inside a ZIP archive. Text, formatting, notes and other information can reside in separate components. An Office application combines these elements to display a document; an extractor decides which elements to read and how to turn them into text.

Those decisions can change meaning. In the paper’s spreadsheet example, a cell stores 1,000,000 but uses a number format that displays $1,000. An extractor that ignores the format returns the stored number instead. The assistant can then answer consistently with its input while reporting a figure different from the one the human reviewer saw.

Visibility is similarly contextual. Speaker notes are absent from a slide show but accessible elsewhere in PowerPoint. The study defines the human view using default application views, rather than treating such content as impossible for a person to discover.

Measuring what reaches the model

Li combines source-code analysis with experiments on documents containing uniquely identifiable marker strings. The static analysis models declaration frameworks used by Python Office libraries, recovering XML selectors that ordinary searches can miss. The dynamic analysis runs all ten selected extractors and checks which markers appear in their output.

Across the tested extractors, the study identifies 19 channels that expose content absent from the default human view and 12 that omit visible content. These are counts of distinct channels exhibiting a discrepancy in at least one extractor, not counts of vulnerabilities shared by every tool.

The work also examines presentation. Some extractors follow XML order or exact coordinates when reading slide text boxes, rather than the apparent visual sequence. Spreadsheet extractors can disregard display formats. Word extractors join adjacent text runs, including hidden fragments when their extraction behavior permits it.

Attacks without instructions

The paper constructs five attack scenarios. Hidden text introduces a false claim; a visible footer containing a safety limit disappears during extraction; number formatting changes the reported amount; slide ordering reverses who indemnifies whom; and a hidden prefix turns the visible word “authorized” into the extracted word “unauthorized.”

These examples do not ask the model to ignore its instructions. Instead, they alter the evidence available for an otherwise ordinary task. That distinction matters: an instruction detector does not directly address a missing warning or a reordered sentence.

The end-to-end evaluation tests four chat assistants and four coding agents, with ten trials per scenario and system. Li reports that every evaluated system was misled by at least one scenario. Success means adopting the attacker’s reading without flagging a discrepancy—not merely producing different wording.

A separate controlled experiment holds the model and prompt fixed while switching between naive extracted text and text extracted from a clean control document. Across the four scenarios included in that experiment, the answers follow the supplied representation. This supports extraction divergence as the cause in those tests, rather than a model reasoning failure.

Reconstructing the displayed evidence

The proposed defense, Prism, interprets supported Office display rules before supplying text to the model. It filters hidden content, includes referenced visible components and applies number formats. For layout-dependent cases, it uses multiple rendering engines and a vision-language model, reporting disagreements rather than selecting one rendering as authoritative.

The paper reports mitigation of all five original scenarios and successful static reconstruction on 28 additional payloads. These results do not establish complete Office-format coverage. The static interpreter does not yet cover PowerPoint content channels or certain spreadsheet content, including chart text and print headers.

Other limits are consequential. Prism’s checking mode tolerates some whole-line reorderings and can therefore miss a spatial inversion that its mediation mode handles through rendering. Agreement between rendering engines is not proof of correctness, and the vision model can misread an image. Evaluation of the image-reading oracle against extremely small text remains future work.

The end-to-end attack set is also small, and commercial products can change their ingestion pipelines. The preprint therefore offers evidence of a specific security boundary: validating an assistant’s reasoning is insufficient when its document representation differs from the evidence a person reviewed.