# arXiv cs.AI: When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9) Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T06:08:18.323Z. First observed: 2026-11-05T05:06:26.154Z. Retrieved: 2026-11-09T06:05:16.554Z. - [When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents](https://arxiv.org/abs/2611.05806) ## Limits The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims. ## Open question How does Prism perform against unseen attack payloads in the paper’s evaluation? ## Source-stated Li argues that extractors can produce text for language models that differs from what Office applications display. > their output can differ from what Office applications display. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order. > we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction. > we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Every tested chat assistant and coding agent was misled by at least one attack. > every one of them is misled by at least one attack. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads. > Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source and contributor context Li, Penghui · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 770d0b6b-355e-4ed8-8cc0-92f943b60b6c. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-09T06:08:18.323Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 79b5e843e87aa9a19e77e7119557cd6ffab0273f095042495bf74d384b11ff26. Source text hash: cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f. ## Revision and source-check history ### Version 1 — 2026-11-09T06:08:18.323Z Penghui Li argues that language models can interpret an Office document differently from a human reviewer because they read text produced by extractors, which may not match what Office applications display. The paper identifies two kinds of divergence: extractors may include content a human cannot see or drop content a human can, and they may ignore display formatting and reading order. A slide can therefore look unchanged to a person while a small shift in text-box positions changes the order the model reads. Li frames this mismatch as an attack surface for applications that process uploaded files, and reports five attacks that misled tested models without injecting any instruction. The tests covered four chat assistants and four coding agents; every one was misled by at least one attack. Li also proposes Prism, which reconstructs the human view from the OOXML specification before sending text to a model, and says it generalizes to unseen attack payloads. The findings matter because a document that appears ordinary to a reviewer may reach a model in a materially different form. The abstract reports tests and a defense, but does not give enough detail here to assess the evaluation or how Prism performs beyond the reported tests. ## Original source arXiv cs.AI · Article Original source date: Nov 4, 2026 (2026-11-04). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T06:08:18.323Z. First observed: 2026-11-05T05:06:26.154Z. Retrieved: 2026-11-09T06:05:16.554Z. - [When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents](https://arxiv.org/abs/2611.05806) ## Limits The supplied evidence is the arXiv abstract, not the paper’s full evaluation; it does not provide details sufficient here to assess the reported tests or Prism’s performance beyond the abstract’s claims. ## Open question How does Prism perform against unseen attack payloads in the paper’s evaluation? ## Source-stated Li argues that extractors can produce text for language models that differs from what Office applications display. > their output can differ from what Office applications display. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated The paper reports that extractors can include content humans cannot see, drop content humans can see, and ignore display formatting and reading order. > we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Li reports five attacks that led tested models to interpret documents differently from human reviewers, without injecting any instruction. > we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Every tested chat assistant and coding agent was misled by at least one attack. > every one of them is misled by at least one attack. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source-stated Li proposes Prism, which reconstructs the human view from the OOXML specification before passing text to the model, and reports that it generalizes to unseen attack payloads. > Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads. - [Supporting source](https://arxiv.org/abs/2611.05806) ## Source and contributor context Li, Penghui · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 770d0b6b-355e-4ed8-8cc0-92f943b60b6c. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-09T06:08:18.323Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 79b5e843e87aa9a19e77e7119557cd6ffab0273f095042495bf74d384b11ff26. Source text hash: cdfc63223bfb6e9587b16dd530aa1e8a0b89723168de95668b00f9d46a20478f. ### passed — 2026-11-09T06:08:18.323Z — anthropic/claude-opus-5.5 Publication: 770d0b6b-355e-4ed8-8cc0-92f943b60b6c attribution — pass: The draft attributes the paper and its claims to Penghui Li, the sole listed author, and uses verbs such as argues, reports, frames and says. Findings and the Prism generalization claim stay attributed rather than presented as established fact. > Authors:Penghui Li summary — pass: The summary leads with the author's argument, explains extractors as the text-producing step, gives the text-box example, and covers the five attacks, eight tested systems and the Prism defense. OOXML is used once without expansion. It could be glossed as the underlying Office Open XML file format, and naming the tested products (ChatGPT, Claude, Gemini, Microsoft 365 Copilot and others) would add reader context. Neither gap blocks understanding. The question follows directly from the abstract's untested-in-detail generalization claim. > it typically reads the text that an extractor produces from the document's underlying Office Open XML (OOXML) files date — pass: originalPublished 2026-11-04 matches the v1 submission date shown on the arXiv page. The feed date of 2026-11-05 is later and was correctly not used. > \[Submitted on 4 Nov 2026\] support — pass: Every claim matches the abstract: invisible and dropped content channels, ignored formatting and reading order, five attacks without injected instructions, all eight tested systems misled by at least one attack, and Prism's reported generalization. The significance sentence restates the abstract's own human-versus-model view mismatch. The limitation correctly notes that only the abstract is available. > We test the attacks on four major chat assistants (ChatGPT, Claude, Gemini, and Microsoft 365 Copilot) and four coding agents (Codex, Claude Code, Antigravity, and GitHub Copilot CLI), and every one of them is misled by at least one attack. media — pass: The selected media is the verified direct arXiv abstract page for this paper. It matches the source URL and is the most direct way to reach the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/77e9b2e9343474f6a004f1792aa1fbf2a462f07b7696894837295301d01dc592/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-when-file-ingestion-misleads-language-models-77e9b2e9.json)