arXiv 论文揭示 Office 文档抽取偏差可误导大语言模型，并提出 Prism 防御
When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents
AI 导读
arXiv 论文（arXiv:2611.05806）研究 LLM 读取 Office 文档时的抽取偏差：分析常用抽取器，发现 19 类 OOXML 通道会读取人眼看不到的内容、12 类会丢失人可见的内容，且常忽略显示格式和阅读顺序。
推荐理由
论文量化了 Office 文档抽取偏差对大语言模型的攻击面，并给出可复用的防御思路，适合关注文档处理安全的读者。
正文 · 原文
Abstract:Office documents are now routinely uploaded to large language models (LLMs) for processing. However, an LLM does not always see what a human sees, because it typically reads the text that an extractor produces from the document's underlying Office Open XML (OOXML) files. Depending on the implementation, extractors differ in which OOXML parts they read and how they interpret them, so their output can differ from what Office applications display. For example, by slightly shifting the positions of text boxes on a slide, an adversary can swap the order in which the model reads them while the slide looks unchanged. We show that this extraction divergence is an attack surface for LLM applications.
In this work, we first measure what an adversary can exploit by analyzing the widely used extractors that LLM applications rely on. By combining static source code analysis with dynamic analysis, we identify 19 OOXML channels where extractors read content a human cannot see and 12 where they drop content a human can. We also find that widely used extractors ignore display formatting and reading order, so even visible content reaches the model in a different form. Building on these findings, we construct five attacks that lead the model to interpret a document differently from a human reviewer, without injecting any instruction. We test the attacks on four major chat assistants (ChatGPT, Claude, Gemini, and Microsoft 365 Copilot) and four coding agents (Codex, Claude Code, Antigravity, and GitHub Copilot CLI), and every one of them is misled by at least one attack. Finally, we propose Prism, a lightweight defense that reconstructs the human view from the OOXML specification before passing the text to the model. Prism also generalizes to unseen attack payloads.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2611.05806 [cs.CR] |
| (or arXiv:2611.05806v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2611.05806 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Penghui Li [view email]
[v1]
Wed, 4 Nov 2026 01:32:31 UTC (244 KB)
来源：arXiv cs.AI · arxiv.org