One PDF, two readers: humans see pages, machines get clean Markdown
Most PDFs are a coordinate soup that LLMs have to reverse-engineer into headings and tables. Sarthak Gaud's trick hides Markdown inside a 20-year-old PDF feature: the page looks identical to you, but an extractor pulls out clean structure. The thread immediately asked what an attacker could hide there too.
Adaptive PDFs attach Markdown-formatted replacement text to a PDF's content via marked-content sequences — a feature in the spec since PDF 1.4. Renderers ignore it and show the normal page; extractors like PyMuPDF get clean headings, lists and tables instead, with under ~10% file-size overhead.
One Rust dev flipped it instantly: the same layer that feeds an LLM clean structure can feed it a malicious instruction a human would never see — invisible prompt injection in your electricity-bill PDF.
A PDF that reads one way to you and another to a machine
Sarthak Gaud's post starts from a familiar pain: standard PDFs carry no structure. An extractor has to reconstruct hierarchy from raw coordinates and font sizes, and LLMs fed that soup guess at what's a heading, a table, a list. Gaud's fix is to stop making them guess.
The trick: replacement text from a 2001-era spec corner
The method leans on an underused PDF feature available since PDF 1.4 — replacement text for marked content. Gaud attaches Markdown-formatted replacement text to the content stream via marked-content sequences. Standard readers ignore that layer and render the page exactly as before; a compatible extractor (the post demos PyMuPDF) pulls the structured Markdown version instead. One file, two outputs, with size overhead typically under 10%. Code is at github.com/iminoaru/adaptivepdf.
The community's resident pedant offered the correction that actually sharpens the idea:
"the PDF will not actually look different to me than to anyone else looking at it… It is just that text extraction… will now return structured (Markdown) text. (One might say the PDF changes based on how you are reading it.)" — a commenter who reframed what 'adaptive' means here
The obvious abuse the thread found in minutes
Where there's an invisible layer, there's an injection vector. A Rust developer drew the line straight to it:
"doesn't this also mean you could easily put AI specific malicious instructions into the PDF that the regular human would never notice?… Just thinking of a electricity bill pdf you provide as proof of address to some company that uses an LLM to extract that address." — a Rust developer on the hidden-instruction risk
Readers also disputed the premise that this is new ground. Tagged PDFs already exist and are legally required for U.S. publicly funded documents under Section 508 — adherence is just poor. And one correction landed on a factual claim:
"LaTeX is actually one of the best ways to create tagged PDF." — a commenter linking the LaTeX tagging project
"It mattered before AI, too"
The framing that PDFs only needed to be machine-readable now drew a pointed rebuttal:
"it did matter, a lot. the PDF format was originally proprietary and was designed… to disallow casual text extraction." — fsckboy
The idea is genuinely clever — a backward-compatible structure layer riding a 20-year-old spec feature. The two open questions the thread surfaced are whether extractors will honor it consistently (Gaud admits support is hit-or-miss) and whether an invisible machine-only channel is a feature or a fresh attack surface.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Renault's CEO says EV orders jumped 50% in France and Germany since the Iran war
A geopolitical shock at the pump is doing what years of climate messaging couldn't: Renault says electric-vehicle orders surged in its two biggest markets once fuel prices spiked.