Guided security lab

Document / PDF Prompt Injection

A guided document trust exercise: separate extracted document text from storage, authorship and lineage facts, decide which fact the application may rely on, then apply policy to a model proposal.

Conceptual simulationIntermediate15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional documents. It parses no files, calls no model or tools and does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Explain why storage location is not authorship or trust.
Separate a trusted parser, extractor, OCR or renderer from the variable text it produces.
Preserve document provenance and lineage outside model text.
Treat document claims such as approved, confidential or authorized as prose unless application-side evidence backs them.
Distinguish output validation (shape and contract) from authorization (permission), neither of which makes model output trusted.

Prerequisites

Trust Boundaries and Model Context lab (recommended)
Document or PDF Prompt Injection attack article (optional)

Choose a scenario

Each fictional scenario shows extracted document text the model sees and storage, authorship and lineage facts the application recorded separately. Security decisions belong to the second column.

User-uploaded document for a summaryA user uploads a report and asks for a summary of its findings.Internal document with an imported external sectionAn internal handbook page contains a section imported from a supplier's document.PDF whose extracted text mixes content and instruction-like textAn extractor returns ordinary content plus a passage that reads like instructions to an assistant.Authenticated storage returns a mixed-authorship documentAn authenticated storage connector returns a shared contract draft edited by internal and external collaborators.Workflow proposes a payment based on invoice textAn accounts assistant reads an invoice PDF and proposes paying it.

Document path and trust flow

Documents pass through storage, parsing and extraction components before the model sees them. Components are system; extracted text and the model's proposal stay variable.

Uploaded fileVariable content->
Upload and type checkSystem component->
ExtractorSystem component->
Extracted textVariable content->
Context assemblySystem component->
ModelSystem component->
ProposalVariable content->
Output policySystem component

Model-visible extracted text

Text produced from the document that the model reads. Bracketed text is a neutral placeholder, not a real instruction.

Extracted report text
Quarterly findings for a fictional logistics team, with three recommendations.

Application-side provenance and records

Recorded by the application outside model text. Document labels are not policy metadata.

Uploaded by: The requesting user, authenticated
Document author: Unknown, not recorded in the file's provenance
Task scope: Summarize for the uploading user only