{"id":"77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592","title":"arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","argument":"Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims.","speaker":{"name":"Li, Penghui","roleAtSource":"Article author"},"source":{"title":"When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.05806","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"Li argues that extractors can produce text for language models that differs from what Office applications display.","excerpt":"their output can differ from what Office applications display.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order.","excerpt":"we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction.","excerpt":"we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Every tested chat assistant and coding agent was misled by at least one attack.","excerpt":"every one of them is misled by at least one attack.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads.","excerpt":"Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05806","checkedAt":"2026-11-09T06:40:09.475Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does Prism perform against unseen attack payloads in the paper’s evaluation?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","summary":"Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests.","question":"How does Prism perform against unseen attack payloads in the paper’s evaluation?","claims":[{"text":"Li argues that extractors can produce text for language models that differs from what Office applications display.","excerpt":"their output can differ from what Office applications display.","support":"source-stated"},{"text":"The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order.","excerpt":"we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can.","support":"source-stated"},{"text":"Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction.","excerpt":"we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction.","support":"source-stated"},{"text":"Every tested chat assistant and coding agent was misled by at least one attack.","excerpt":"every one of them is misled by at least one attack.","support":"source-stated"},{"text":"Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads.","excerpt":"Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads.","support":"source-stated"}],"limitations":["The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims."],"mediaId":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","correctionReason":null,"id":"77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592","publicationId":"770d0b6b-355e-4ed8-8cc0-92f943b60b6c","version":1,"sourceUrl":"https://arxiv.org/abs/2611.05806","sourceTitle":"When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:06:26.154Z","createdAt":"2026-11-09T06:08:18.323Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","kind":"article","url":"https://arxiv.org/abs/2611.05806","sourceUrl":"https://arxiv.org/abs/2611.05806","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T06:05:17.061Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05806","checkedAt":"2026-11-09T06:40:09.475Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","confidence":0.9,"provider":"typesafe","model":"jev-1.13.0","inputHash":"332eac51cb5d726d51c6bf8a4f71850cc2f0cafb289a4199bd11819fa8450b87","decidedAt":"2026-11-09T06:05:19.938Z"},"provenance":{"textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observationId":"79b5e843e87aa9a19e77e7119557cd6ffab0273f095042495bf74d384b11ff26","retrievedAt":"2026-11-09T06:05:16.554Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"de31b28f-e54b-41e7-852c-17f92f78540f"},"reviewer":{"model":"gpt-6-luna","runId":"32bec4a2-43b7-44db-85b5-36f93a4935e6"}},"audit":{"status":"passed","reviewedAt":"2026-11-09T06:08:18.323Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Li, Penghui","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Li, Penghui","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Penghui","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05806","locator":"head/meta[name=author|citation_author]"},"assertionId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T06:40:09.475Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95","sourceUrl":"https://arxiv.org/abs/2611.05806","contentSha256":"ef63c0e58e3f99cdcb7fcfffcd17b4bc12ae2848941e448e72fcedd26379c6a6","textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observedAt":"2026-11-09T06:40:09.475Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.05806","snapshotId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95","contentSha256":"ef63c0e58e3f99cdcb7fcfffcd17b4bc12ae2848941e448e72fcedd26379c6a6","textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observedAt":"2026-11-09T06:40:09.475Z","basis":"publisher-page-metadata","sourceLinks":40,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9","formats":{"html":"/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9","markdown":"/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9.md","json":"/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592","revision":"770d0b6b-355e-4ed8-8cc0-92f943b60b6c","revisionKind":"publication-id","title":"arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","url":"https://escapemeridian.com/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.05806","revision":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","revisionKind":"sha256-source-text","title":"When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","url":"https://arxiv.org/abs/2611.05806"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592","title":"arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","argument":"Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims.","speaker":{"name":"Li, Penghui","roleAtSource":"Article author"},"source":{"title":"When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.05806","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"Li argues that extractors can produce text for language models that differs from what Office applications display.","excerpt":"their output can differ from what Office applications display.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order.","excerpt":"we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction.","excerpt":"we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Every tested chat assistant and coding agent was misled by at least one attack.","excerpt":"every one of them is misled by at least one attack.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"},{"text":"Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads.","excerpt":"Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads.","url":"https://arxiv.org/abs/2611.05806","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05806","checkedAt":"2026-11-09T06:40:09.475Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How does Prism perform against unseen attack payloads in the paper’s evaluation?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","summary":"Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests.","question":"How does Prism perform against unseen attack payloads in the paper’s evaluation?","claims":[{"text":"Li argues that extractors can produce text for language models that differs from what Office applications display.","excerpt":"their output can differ from what Office applications display.","support":"source-stated"},{"text":"The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order.","excerpt":"we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can.","support":"source-stated"},{"text":"Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction.","excerpt":"we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction.","support":"source-stated"},{"text":"Every tested chat assistant and coding agent was misled by at least one attack.","excerpt":"every one of them is misled by at least one attack.","support":"source-stated"},{"text":"Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads.","excerpt":"Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads.","support":"source-stated"}],"limitations":["The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims."],"mediaId":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","correctionReason":null,"id":"77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592","publicationId":"770d0b6b-355e-4ed8-8cc0-92f943b60b6c","version":1,"sourceUrl":"https://arxiv.org/abs/2611.05806","sourceTitle":"When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:06:26.154Z","createdAt":"2026-11-09T06:08:18.323Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","kind":"article","url":"https://arxiv.org/abs/2611.05806","sourceUrl":"https://arxiv.org/abs/2611.05806","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T06:05:17.061Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.05806","checkedAt":"2026-11-09T06:40:09.475Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"c220ee595abfaf1a657ef27a3c6a7f27fa731029c9410c769a73d47ebca4b99b","confidence":0.9,"provider":"typesafe","model":"jev-1.13.0","inputHash":"332eac51cb5d726d51c6bf8a4f71850cc2f0cafb289a4199bd11819fa8450b87","decidedAt":"2026-11-09T06:05:19.938Z"},"provenance":{"textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observationId":"79b5e843e87aa9a19e77e7119557cd6ffab0273f095042495bf74d384b11ff26","retrievedAt":"2026-11-09T06:05:16.554Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"de31b28f-e54b-41e7-852c-17f92f78540f"},"reviewer":{"model":"gpt-6-luna","runId":"32bec4a2-43b7-44db-85b5-36f93a4935e6"}},"audit":{"status":"passed","reviewedAt":"2026-11-09T06:08:18.323Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Li, Penghui","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Li, Penghui","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Li, Penghui","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.05806","locator":"head/meta[name=author|citation_author]"},"assertionId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T06:40:09.475Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95","sourceUrl":"https://arxiv.org/abs/2611.05806","contentSha256":"ef63c0e58e3f99cdcb7fcfffcd17b4bc12ae2848941e448e72fcedd26379c6a6","textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observedAt":"2026-11-09T06:40:09.475Z"}}],"participationCoverage":{"total":1,"returned":1,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.05806","snapshotId":"aee12babd26fb0658f363ce08ce15e9e48db20734ccd213f5891d26cdd7f0b95","contentSha256":"ef63c0e58e3f99cdcb7fcfffcd17b4bc12ae2848941e448e72fcedd26379c6a6","textHash":"cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f","observedAt":"2026-11-09T06:40:09.475Z","basis":"publisher-page-metadata","sourceLinks":40,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592/source"}}}],"audits":[{"publicationId":"770d0b6b-355e-4ed8-8cc0-92f943b60b6c","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft attributes the paper and its claims to Penghui Li, the sole listed author, and uses verbs such as argues, reports, frames and says. Findings and the Prism generalization claim stay attributed rather than presented as established fact.","excerpt":"Authors:Penghui Li"},{"dimension":"summary","status":"pass","explanation":"The summary leads with the author's argument, explains extractors as the text-producing step, gives the text-box example, and covers the five attacks, eight tested systems and the Prism defense. OOXML is used once without expansion. It could be glossed as the underlying Office Open XML file format, and naming the tested products (ChatGPT, Claude, Gemini, Microsoft 365 Copilot and others) would add reader context. Neither gap blocks understanding. The question follows directly from the abstract's untested-in-detail generalization claim.","excerpt":"it typically reads the text that an extractor produces from the document's underlying Office Open XML (OOXML) files"},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-04 matches the v1 submission date shown on the arXiv page. The feed date of 2026-11-05 is later and was correctly not used.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Every claim matches the abstract: invisible and dropped content channels, ignored formatting and reading order, five attacks without injected instructions, all eight tested systems misled by at least one attack, and Prism's reported generalization. The significance sentence restates the abstract's own human-versus-model view mismatch. The limitation correctly notes that only the abstract is available.","excerpt":"We test the attacks on four major chat assistants (ChatGPT, Claude, Gemini, and Microsoft 365 Copilot) and four coding agents (Codex, Claude Code, Antigravity, and GitHub Copilot CLI), and every one of them is misled by at least one attack."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper. It matches the source URL and is the most direct way to reach the source.","excerpt":null}],"createdAt":"2026-11-09T06:08:18.323Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}