CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

Abstract

Document-based LLM systems often flatten a PDF before guardrails inspect it. That step can discard evidence that an instruction was never visible to the user. We introduce CrackedPDFs, a controlled benchmark for hidden prompt injection in PDFs. The benchmark contains 29,322 generated PDFs from 4,983 base documents. It includes 9,774 injected files and 19,548 benign or matched-confounder files. We evaluate PromptGuard and a rule baseline. We also evaluate structural-only learned models and a sanitized hybrid detector. The evaluation uses held-out provenance splits and paired benign-confounder controls. It also uses label-shuffle checks and shortcut audits. On a 2,919-document held-out test set, the hybrid detector reaches 0.960 F1. ROC-AUC is 0.998 and PR-AUC is 0.997. On a balanced subset containing 973 injected PDFs and 973 matched benign confounders, the hybrid detector achieves 95.9% classification accuracy. Using score ordering, it ranks the injected member above its matched confounder in 100% of 973 pairs. PromptGuard has low recall when given extracted text only. Structural-only learned models are weak under paired controls. A text-only TF-IDF model reaches perfect held-out scores but fails shortcut audits. These results show that document-aware hybrid detection is useful under controlled paired evaluation. They do not show broad real-world robustness or reliable cross-family generalization.