Adversarial PDFs that break AI document readers.

How it's generated

An invoice with realistic line items and totals. The visible TOTAL DUE is set by the seed. A second copy of the total — with a different amount — is written into the PDF's text content stream using PDF render mode 3 (placed in the text stream but never rasterised). A human sees one amount; a text-extraction pipeline sees another.

What it detects

Vision models that trust the page (correct) vs. agents that fuse a text-extraction layer with vision output and silently prefer the layer (incorrect). The most common silent failure in scanned-then-OCR'd document pipelines in production.

Expected failure mode

Model answers the hidden amount instead of the visible amount — diagnosable from the recorded forbidden-answer match.

How it's generated

An invoice with a large, prominent decoy total and a 3.5pt footnote naming the real binding amount (1.5–3× the decoy). The question explicitly instructs the model to read all small print, so it can't claim the prompt was ambiguous: either the footnote survived the provider's PDF-ingestion pipeline or it didn't.

What it detects

Provider PDF-ingestion pipelines that lose the sub-threshold footnote before the model ever sees it. Opus 4-7 and Sonnet 4-6 both score 0/10 on PDF-modality input — but rasterise the same cases locally at 150 dpi (--pixels) and Opus passes 100%. The 2026-06-12 cross-modality run pins the failure on PDF ingestion, not on a vision legibility threshold. Haiku 4-5 passes 90% and GPT-5 100% on PDF input.

Expected failure mode

Model returns the large decoy total instead of the footnote's binding amount — diagnosable from the recorded forbidden-answer match.

How it's generated

A single-page invoice with two candidate totals: one in upright glyphs (the visible decoy) and one with horizontally-mirrored glyphs (each character flipped left-to-right). A printed rule on the same page names the mirrored amount as binding. Each mirrored character is drawn from a flipped glyph path, so the mirror is intrinsic to the PDF — not a layer transform a smart OCR pipeline could detect and unmirror.

What it detects

Vision pipelines that don't normalise glyph orientation, or that treat mirrored glyphs as noise and fall back to the upright decoy. Five of eight panel models score 0/10; only OpenAI's family reads the mirrored amount cleanly. Strongest single replication signal in mini-v4 — the trap catches three different frontier providers.

Expected failure mode

Model returns the upright decoy amount, or returns the visually-similar but semantically-wrong character from a literal OCR of the mirrored glyph (e.g. b vs d).