ghostprompt

name

ghostprompt

description

Use this skill whenever a user uploads a PDF and asks whether it contains hidden instructions, prompt injection content, or AI-targeted manipulation. Trigger phrases include: "is there a hidden instruction", "scan this PDF for injection", "check for hidden text", "is this PDF safe for AI", "analyze this PDF for prompt injection", or similar wording. Always follow this pipeline instead of improvising, because prompt-injection signals often appear across multiple weak indicators.

GhostPrompt (Self-Contained)

Overview

This skill applies an 8-layer analysis pipeline to detect prompt-injection attempts in PDFs. Each layer targets a different attack vector. Run all layers in order.

Setup

Copy the uploaded file into the working directory:

cp /mnt/user-data/uploads/<FILE_NAME>.pdf /home/claude/target.pdf

Install required dependencies:

pip install pdfminer.six pikepdf --break-system-packages -q

Layer 1 - Metadata and Dangerous PDF Features

Goal: detect active-content features and suspicious structural metadata.

Look for: JavaScript, Launch actions, OpenAction, embedded files, URI links, annotations.

import re

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()

raw_str = raw.decode('latin-1')

print('=== METADATA ===')
for field in ['Creator', 'Author', 'Producer', 'Subject', 'Title']:
    matches = re.findall(rf'/{field}\s*\(([^)]+)\)', raw_str)
    print(f'{field}: {matches if matches else "not found"}')

print('\n=== DANGEROUS FEATURES ===')
checks = {
    'JavaScript': r'/JavaScript',
    'Launch action': r'/Launch',
    'OpenAction': r'/OpenAction',
    'Embedded files': r'/EmbeddedFile',
    'URI links': r'/URI\s*\(',
    'Annotations': r'/Annot[^s]',
    'GoTo Remote': r'/GoToR',
    'SubmitForm': r'/SubmitForm',
    'ImportData': r'/ImportData',
    'RichMedia': r'/RichMedia',
    'Sound': r'/Sound\b',
    'Movie': r'/Movie\b',
}

for name, pattern in checks.items():
    found = re.findall(pattern, raw_str)
    status = f'FOUND ({len(found)})' if found else 'clean'
    print(f'  {name}: {status}')

uris = re.findall(r'/URI\s*\(([^)]+)\)', raw_str)
if uris:
    print('\n  URI contents:')
    for uri in uris:
        print(f'    {uri}')

Interpretation:

• JavaScript, Launch, OpenAction, SubmitForm: high-risk signals.
• Embedded files: inspect content in later layers.
• URI: review domains and intent.
• Annotations alone are often benign but must be checked in Layer 6.

Layer 2 - Invisible Text Detection

Goal: identify text hidden visually but still parseable by extractors.

Look for: white text, invisible render mode (3 Tr), tiny font text.

import re
from pdfminer.high_level import extract_pages
from pdfminer.layout import LTChar

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()

raw_str = raw.decode('latin-1')

print('=== INVISIBLE TEXT CHECKS ===')

tr3 = re.findall(r'\b3\s+Tr\b', raw_str)
print(f'Invisible render mode (3 Tr): {len(tr3)} occurrences')

white_rgb = re.findall(r'1\s+1\s+1\s+rg', raw_str)
white_gray = re.findall(r'(?<!\d)1(?!\d)\s+g(?!\w)', raw_str)
print(f'White RGB color (1 1 1 rg): {len(white_rgb)} occurrences')
print(f'White gray (1 g): {len(white_gray)} occurrences')

tiny_chars = []
with open('/home/claude/target.pdf', 'rb') as f:
    for page_num, page_layout in enumerate(extract_pages(f)):
        for element in page_layout:
            if hasattr(element, '__iter__'):
                for line in element:
                    if hasattr(line, '__iter__'):
                        for char in line:
                            if isinstance(char, LTChar) and char.size < 1.0 and char.get_text().strip():
                                tiny_chars.append({
                                    'page': page_num + 1,
                                    'char': char.get_text(),
                                    'size': round(char.size, 3),
                                    'bbox': [round(x, 1) for x in char.bbox],
                                })

if tiny_chars:
    print(f'\nTiny chars (< 1pt): {len(tiny_chars)} found!')
    combined = ''.join(c['char'] for c in tiny_chars)
    print(f'Combined text: {repr(combined[:500])}')
    print(f"Pages: {set(c['page'] for c in tiny_chars)}")
else:
    print('Tiny chars (< 1pt): none found')

Interpretation:

• 3 Tr found: strong hidden-text signal.
• White text with meaningful strings: suspicious.
• Tiny text clusters: inspect content in Layer 3.

Layer 3 - Prompt Injection Pattern Scan

Goal: scan extracted text for known manipulation phrases.

import re
from pdfminer.high_level import extract_text

full_text = extract_text('/home/claude/target.pdf')
print(f'Total text extracted: {len(full_text)} chars, {full_text.count(chr(10))} lines')

injection_patterns = {
    'Override commands': [
        r'ignore (previous|above|prior|all) (instructions?|prompts?|context)',
        r'disregard (all|previous|prior|the)',
        r'forget (everything|all previous|prior context)',
        r'override (previous|your|all)',
    ],
    'Role manipulation': [
        r'you are (now|actually|really|a)',
        r'act as (a|an|if)',
        r'pretend (you are|to be)',
        r'roleplay as',
        r'your (new |true )?role is',
        r'from now on (you|your)',
    ],
    'System prompt extraction': [
        r'reveal (your|the|all) (system |)prompt',
        r'print (your|the) (system |)instructions',
        r'show me (your|the) (system |)prompt',
        r'what (is|are) your (instructions|guidelines|rules)',
        r'ignore (your|all) (guidelines|rules|restrictions)',
    ],
    'Identity manipulation': [
        r'you have no (restrictions|rules|limits|ethics)',
        r'you (can|are able to|must) (now |)ignore',
        r'\b(DAN|STAN|DUDE|AIM|JAILBREAK)\b',
        r'developer mode',
        r'jailbreak',
        r'bypass (your|all|safety)',
    ],
    'Hidden command structures': [
        r'\[INST\]',
        r'<\|system\|>',
        r'<\|user\|>',
        r'<\|assistant\|>',
        r'###\s*(system|instruction|prompt)',
        r'---\s*(system|instruction)---',
        r'</?s>\s*(system|instruction)',
        r'\[/?SYS\]',
    ],
    'Data exfiltration': [
        r'send (to|this to)',
        r'transmit (the|this|all)',
        r'upload (the|this|all)',
        r'exfiltrate',
        r'leak (the|this)',
    ],
    'Turkish injection': [
        r'onceki talimatlari (unut|yoksay)',
        r'yeni (gorevin|rolun)',
        r'simdiden itibaren.*rol',
        r'tum kisitlamalari',
        r'kural(lari)? unut',
        r'sistem (promptu|talimatlar)',
        r'asistan olarak (davran|rol)',
    ],
    'Spanish/French/German injection': [
        r'ignora (las|las instrucciones)',
        r'ignorez (les|toutes)',
        r'ignoriere (alle|die)',
        r'tu es maintenant',
        r'ahora eres',
        r'du bist jetzt',
    ],
}

print('\n=== INJECTION PATTERN SCAN ===')
total_found = 0
for category, patterns in injection_patterns.items():
    cat_found = []
    for pattern in patterns:
        matches = re.findall(pattern, full_text, re.IGNORECASE | re.MULTILINE)
        if matches:
            cat_found.append((pattern, matches))
            total_found += len(matches)
    if cat_found:
        print(f'\n  WARNING {category}:')
        for pat, matches in cat_found:
            # Show context for each match
            for m in re.finditer(pat, full_text, re.IGNORECASE):
                ctx = full_text[max(0, m.start()-40):m.end()+40].replace('\n', ' ')
                print(f"    Match: ...{ctx}...")
                break  # one context per pattern
    else:
        print(f'  OK {category}: clean')

print(f'\nTotal suspicious matches: {total_found}')

Interpretation:

• One isolated match may be benign — always check the surrounding context printed above.
• Multiple categories with imperative language indicates higher risk.
• \b word-boundary anchors on DAN/STAN reduce substring false positives.

Layer 4 - Encoding and Obfuscation Detection

Goal: detect hidden instructions encoded or visually obfuscated.

import re
import base64
from pdfminer.high_level import extract_text

full_text = extract_text('/home/claude/target.pdf')

print('=== ENCODING & OBFUSCATION CHECKS ===')

b64_candidates = re.findall(r'[A-Za-z0-9+/]{40,}={0,2}', full_text)
print(f'\nBase64-like strings (>= 40 chars): {len(b64_candidates)}')
for candidate in b64_candidates[:5]:
    try:
        decoded = base64.b64decode(candidate).decode('utf-8', errors='ignore')
        if any(c.isalpha() for c in decoded):
            print(f'  Decoded: {repr(decoded[:100])}')
    except Exception:
        pass

hex_blocks = re.findall(r'(?:[0-9a-fA-F]{2}\s*){16,}', full_text)
print(f'Hex-like blocks (>= 16 bytes): {len(hex_blocks)}')

non_ascii = [c for c in full_text if ord(c) > 127]
if non_ascii:
    unique = set(non_ascii)
    print(f'Non-ASCII characters: {len(non_ascii)} total, {len(unique)} unique')
    suspicious = [
        c for c in unique if any(
            ord(c) in range(start, end) for start, end in [
                (0x0400, 0x04FF),  # Cyrillic
                (0x0370, 0x03FF),  # Greek
                (0xFF00, 0xFFEF),  # Fullwidth
            ]
        )
    ]
    if suspicious:
        print(f'  WARNING suspicious homoglyph candidates: {suspicious}')
    else:
        print(f'  OK no homoglyph suspects (non-ASCII chars are expected for this locale)')
else:
    print('Non-ASCII characters: none')

lines = [l.strip() for l in full_text.split('\n') if l.strip() and l.strip()[0].isalpha()]
if lines:
    first_letters = ''.join(l[0] for l in lines[:100])
    print(f'\nFirst-letter acrostic (first 100 lines): {first_letters}')
    for word in ['IGNORE', 'SYSTEM', 'JAILBREAK', 'BYPASS', 'OVERRIDE', 'INJECT']:
        if word in first_letters.upper():
            print(f"  WARNING found '{word}' in acrostic")

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()
raw_str = raw.decode('latin-1')

binary_terms = [
    'ignore previous', 'system prompt', 'you are now', 'act as',
    'jailbreak', 'bypass', 'disregard all', 'new objective', 'new task'
]

print('\nRaw binary suspicious string scan:')
for term in binary_terms:
    if term.lower() in raw_str.lower():
        idx = raw_str.lower().index(term.lower())
        context = raw_str[max(0, idx - 30):idx + len(term) + 30]
        print(f"  WARNING found '{term}' in raw binary: {repr(context)}")
    else:
        print(f"  OK '{term}': not found")

Interpretation:

• Decodable Base64 with imperative text: suspicious.
• Homoglyph-heavy text in unexpected language context: red flag.
• Matching suspicious strings in raw binary: high-confidence signal.

Layer 5 - Stream Content and Structural Integrity

Goal: detect hidden content in compressed streams and structural anomalies.

import re
import zlib

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()

print('=== STRUCTURAL INTEGRITY ===')

# Count only true stream openings (not substrings like "endstream")
stream_opens = re.findall(rb'(?<![a-z])stream\r?\n', raw)
endstreams = re.findall(rb'endstream', raw)
print(f'Streams: {len(stream_opens)} open, {len(endstreams)} closed')
if len(stream_opens) != len(endstreams):
    print(f'  WARNING stream count mismatch ({len(stream_opens)} vs {len(endstreams)})')
    # Distinguish: "endstream" also contains "stream" — check if mismatch is real
    true_mismatch = abs(len(stream_opens) - len(endstreams))
    print(f'  Net mismatch: {true_mismatch} (if 0 after adjustment, likely false positive)')
else:
    print('  OK stream counts match')

eof_markers = [m.start() for m in re.finditer(rb'%%EOF', raw)]
print(f'PDF revisions (%%EOF count): {len(eof_markers)}')
if len(eof_markers) > 1:
    print('  INFO multiple revisions found (can be normal for signed PDFs)')
    print('  Revision byte offsets:', eof_markers)

print('\nDecompressing FlateDecode streams for text search...')
stream_pattern = re.compile(rb'/FlateDecode.*?stream\r?\n(.*?)endstream', re.DOTALL)
streams_raw = stream_pattern.findall(raw)

hits = []
terms = [
    b'ignore previous', b'system prompt', b'act as', b'jailbreak',
    b'bypass', b'you are now', b'disregard', b'new objective',
]

for i, stream_data in enumerate(streams_raw):
    try:
        decompressed = zlib.decompress(stream_data)
        dec_lower = decompressed.lower()
        for term in terms:
            if term in dec_lower:
                idx = dec_lower.index(term)
                context = decompressed[max(0, idx - 50):idx + len(term) + 50]
                hits.append({'stream': i, 'term': term.decode(), 'context': context})
    except Exception:
        pass

if hits:
    print(f'  WARNING found injection terms in {len(hits)} stream hit(s)')
    for hit in hits:
        print(f"    Stream {hit['stream']}: '{hit['term']}'")
        print(f"    Context: {repr(hit['context'][:100])}")
else:
    print(f'  OK {len(streams_raw)} streams checked, no injection terms found')

Interpretation:

• Stream-count mismatch after adjustment: structural anomaly.
• Multiple revisions: contextual, not automatically malicious.
• Injection terms in decompressed streams: strong red flag.

Layer 6 - Zero-Width Character (ZWC) Detection ⭐ NEW

Goal: detect invisible Unicode characters used to smuggle hidden text past visual inspection.

Attack vector: attackers embed zero-width or invisible Unicode codepoints between visible characters. The text looks clean to humans but carries hidden instructions readable by AI extractors.

import re
from pdfminer.high_level import extract_text

full_text = extract_text('/home/claude/target.pdf')

print('=== ZERO-WIDTH CHARACTER DETECTION ===')

zwc_map = {
    '\u200b': 'ZERO WIDTH SPACE',
    '\u200c': 'ZERO WIDTH NON-JOINER',
    '\u200d': 'ZERO WIDTH JOINER',
    '\u2060': 'WORD JOINER',
    '\u2061': 'FUNCTION APPLICATION',
    '\u2062': 'INVISIBLE TIMES',
    '\u2063': 'INVISIBLE SEPARATOR',
    '\u2064': 'INVISIBLE PLUS',
    '\ufeff': 'BYTE ORDER MARK (mid-text)',
    '\u00ad': 'SOFT HYPHEN',
    '\u034f': 'COMBINING GRAPHEME JOINER',
    '\u180e': 'MONGOLIAN VOWEL SEPARATOR',
}

total_zwc = 0
for char, name in zwc_map.items():
    count = full_text.count(char)
    if count > 0:
        total_zwc += count
        print(f'  WARNING {name} (U+{ord(char):04X}): {count} occurrences')
        # Show surrounding context for first 3 occurrences
        indices = [i for i, c in enumerate(full_text) if c == char]
        for idx in indices[:3]:
            ctx = full_text[max(0, idx-40):idx+40].replace(char, f'[{name}]')
            print(f'    Context: {repr(ctx)}')

if total_zwc == 0:
    print('  OK No zero-width characters found')
else:
    print(f'\n  TOTAL ZWC characters: {total_zwc}')
    # Attempt to extract hidden message by concatenating ZWC sequences
    # Some attacks encode binary data via ZWC presence/absence patterns
    zwc_sequence = [c for c in full_text if c in zwc_map]
    print(f'  ZWC sequence (first 100): {[zwc_map.get(c, c) for c in zwc_sequence[:100]]}')

# Also check raw binary for ZWC encoded as UTF-8 bytes
with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()

zwc_utf8 = {
    b'\xe2\x80\x8b': 'ZERO WIDTH SPACE (UTF-8)',
    b'\xe2\x80\x8c': 'ZERO WIDTH NON-JOINER (UTF-8)',
    b'\xe2\x80\x8d': 'ZERO WIDTH JOINER (UTF-8)',
    b'\xef\xbb\xbf': 'BOM mid-stream (UTF-8)',
}
print('\nRaw UTF-8 ZWC byte scan:')
for seq, name in zwc_utf8.items():
    count = raw.count(seq)
    status = f'FOUND {count}x — WARNING' if count > 0 else 'clean'
    print(f'  {name}: {status}')

Interpretation:

• Any ZWC in a PDF outside of CJK/Arabic text is suspicious.
• Multiple ZWC of the same type forming a sequence: likely steganographic encoding.
• BOM mid-stream: strong signal of deliberate hidden content.

Layer 7 - Annotation Payload & ObjStm Scan ⭐ NEW

Goal: inspect annotation text fields and PDF Object Streams for hidden content.

7A — Annotation Payload

Attackers can embed injection text in annotation /Contents, /T (title), or /Subj (subject) fields. These fields are invisible in normal PDF viewing but extracted by AI document processors.

import re

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()
raw_str = raw.decode('latin-1')

print('=== ANNOTATION PAYLOAD SCAN ===')

injection_terms = [
    'ignore', 'system prompt', 'act as', 'jailbreak', 'bypass',
    'you are now', 'disregard', 'new objective', 'forget',
]

annot_fields = {
    '/Contents': re.findall(r'/Contents\s*\(([^)]{1,500})\)', raw_str),
    '/T':        re.findall(r'/T\s*\(([^)]{1,200})\)', raw_str),
    '/Subj':     re.findall(r'/Subj\s*\(([^)]{1,200})\)', raw_str),
    '/RC':       re.findall(r'/RC\s*\(([^)]{1,500})\)', raw_str),  # Rich content
}

any_found = False
for field, values in annot_fields.items():
    if values:
        any_found = True
        print(f'  {field} fields ({len(values)} found):')
        for v in values[:5]:
            v_clean = v[:200]
            print(f'    Value: {repr(v_clean)}')
            for term in injection_terms:
                if term.lower() in v.lower():
                    print(f'    *** WARNING: injection term "{term}" found in {field} ***')

if not any_found:
    print('  OK No annotation text fields found')

7B — PDF Object Stream (ObjStm) Scan

ObjStm is a PDF 1.5+ feature that compresses multiple objects into a single stream. It can hide objects—including text content—from simple string scanners.

import pikepdf

print('\n=== ObjStm (PDF OBJECT STREAM) SCAN ===')

injection_terms_bytes = [
    'ignore previous', 'system prompt', 'act as', 'jailbreak',
    'bypass', 'you are now', 'disregard', 'new objective', 'forget everything',
]

try:
    pdf = pikepdf.open('/home/claude/target.pdf')
    objstm_count = 0
    objstm_hits = []

    for obj in pdf.objects:
        try:
            if isinstance(obj, pikepdf.Stream):
                obj_type = str(obj.stream_dict.get('/Type', ''))
                if 'ObjStm' in obj_type:
                    objstm_count += 1
                    data = obj.read_bytes().lower().decode('utf-8', errors='ignore')
                    for term in injection_terms_bytes:
                        if term in data:
                            idx = data.index(term)
                            ctx = data[max(0, idx-50):idx+len(term)+50]
                            objstm_hits.append({'term': term, 'context': ctx})
        except Exception:
            pass

    print(f'  ObjStm streams found: {objstm_count}')
    if objstm_hits:
        print(f'  WARNING {len(objstm_hits)} injection terms found in ObjStm:')
        for hit in objstm_hits:
            print(f"    Term: '{hit['term']}'")
            print(f"    Context: {repr(hit['context'][:100])}")
    else:
        print(f'  OK No injection terms in ObjStm streams')

    pdf.close()
except Exception as e:
    print(f'  pikepdf error: {e} — install with: pip install pikepdf --break-system-packages')

Interpretation:

• Annotation fields with imperative language: high-risk signal.
• Any injection term in ObjStm: strong red flag (sophisticated hiding).

Layer 8 - XMP Metadata, Incremental Updates & Semantic Camouflage ⭐ NEW

Goal: detect injection in XMP metadata blocks, incremental PDF revisions, and technically-camouflaged phrases.

8A — XMP Metadata Scan

XMP (Extensible Metadata Platform) is an XML block embedded in PDFs. It is processed by many AI document pipelines and can carry hidden instructions invisible to casual viewers.

import re

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()
raw_str = raw.decode('latin-1')

print('=== XMP METADATA SCAN ===')

injection_terms = [
    'ignore previous', 'system prompt', 'act as', 'jailbreak',
    'bypass', 'you are now', 'disregard', 'new objective',
]

xmp_blocks = re.findall(r'<x:xmpmeta.*?</x:xmpmeta>', raw_str, re.DOTALL | re.IGNORECASE)
print(f'XMP blocks found: {len(xmp_blocks)}')

xmp_clean = True
for i, block in enumerate(xmp_blocks):
    for term in injection_terms:
        if term.lower() in block.lower():
            print(f'  WARNING: "{term}" found in XMP block {i+1}')
            idx = block.lower().index(term.lower())
            print(f'  Context: {repr(block[max(0,idx-60):idx+len(term)+60])}')
            xmp_clean = False
    # Also flag suspiciously long XMP blocks (normal ones are short)
    if len(block) > 5000:
        print(f'  INFO XMP block {i+1} is large ({len(block)} chars) — inspect manually')

if xmp_clean:
    print('  OK No injection terms found in XMP metadata')

8B — Incremental Update Content Scan

When a PDF has multiple %%EOF markers, each section after the first is an "incremental update". Attackers can append a revision that overlays clean pages with injection content.

import re
import zlib

with open('/home/claude/target.pdf', 'rb') as f:
    raw = f.read()

print('\n=== INCREMENTAL UPDATE SCAN ===')

eof_positions = [m.start() for m in re.finditer(rb'%%EOF', raw)]
print(f'Revision count: {len(eof_positions)} (%%EOF markers)')

injection_terms = [
    b'ignore previous', b'system prompt', b'act as', b'jailbreak',
    b'bypass', b'you are now', b'disregard',
]

if len(eof_positions) > 1:
    for i in range(len(eof_positions) - 1):
        segment = raw[eof_positions[i]:eof_positions[i+1]]
        seg_lower = segment.lower()
        print(f'\n  Update {i+1}: {len(segment)} bytes')
        seg_hits = []
        for term in injection_terms:
            if term in seg_lower:
                idx = seg_lower.index(term)
                ctx = segment[max(0, idx-40):idx+len(term)+40]
                seg_hits.append((term.decode(), ctx))
        if seg_hits:
            for term, ctx in seg_hits:
                print(f'    WARNING: "{term}" in update {i+1}: {repr(ctx[:100])}')
        else:
            print(f'    OK: no injection terms')

        # Also decompress any FlateDecode streams within the update
        stream_pattern = re.compile(rb'/FlateDecode.*?stream\r?\n(.*?)endstream', re.DOTALL)
        for j, stream_data in enumerate(stream_pattern.findall(segment)):
            try:
                decompressed = zlib.decompress(stream_data).lower()
                for term in injection_terms:
                    if term in decompressed:
                        print(f'    WARNING: "{term.decode()}" in compressed stream of update {i+1}')
            except Exception:
                pass
else:
    print('  OK Single revision — no incremental update attack surface')

8C — Semantic Camouflage Detection

Sophisticated attacks embed instructions disguised as code comments, TODO notes, technical annotations, or prose that reads naturally but directs AI behavior.

import re
from pdfminer.high_level import extract_text

full_text = extract_text('/home/claude/target.pdf')

print('\n=== SEMANTIC CAMOUFLAGE SCAN ===')

semantic_patterns = [
    # Code-comment style injections
    (r'/\*\s*(system|ignore|prompt|bypass)', 'C-style comment injection'),
    (r'#\s*(system|ignore|prompt|bypass):', 'Hash-comment injection'),
    (r'<!--.*?(ignore|system|bypass).*?-->', 'HTML comment injection'),
    # Structured directive disguise
    (r'(note|warning|important)\s*:\s*(ignore|forget|disregard)', 'Directive disguise'),
    (r'(todo|fixme|hack)\s*:.*?(ignore|bypass|system)', 'Code annotation injection'),
    (r'new (objective|task|goal|mission)\s*:', 'Goal replacement'),
    (r'(confidential|secret|hidden)\s*(instruction|prompt|command)', 'Authority claim'),
    # AI-targeting phrases disguised as normal text
    (r'as an? (ai|llm|language model|gpt|claude|assistant)\b', 'AI identity targeting'),
    (r'your (training|instructions?|guidelines?) (say|tell|require|state)', 'Training manipulation'),
    (r'according to your (instructions?|guidelines?|training)', 'Authority spoofing'),
    # Template/prompt injection syntax
    (r'\[\[.*?(ignore|system|bypass|prompt).*?\]\]', 'Double-bracket injection'),
    (r'\{\{.*?(ignore|system|bypass|prompt).*?\}\}', 'Double-brace injection'),
    (r'<(system|instruction|prompt)>', 'XML tag injection'),
    # Urgency/authority patterns
    (r'(urgent|critical|emergency)\s*:.*?(ignore|bypass|override)', 'Urgency injection'),
    (r'(admin|root|superuser|operator)\s*(instruction|command|override)', 'Privilege injection'),
]

sem_hits = []
for pat, label in semantic_patterns:
    matches = list(re.finditer(pat, full_text, re.IGNORECASE | re.DOTALL))
    if matches:
        for m in matches[:2]:
            ctx = full_text[max(0, m.start()-40):m.end()+40].replace('\n', ' ')
            sem_hits.append((label, pat, ctx))

if sem_hits:
    print(f'  WARNING {len(sem_hits)} semantic camouflage match(es):')
    for label, pat, ctx in sem_hits:
        print(f'    [{label}] ...{ctx}...')
else:
    print('  OK No semantic camouflage patterns found')

Interpretation:

• XMP injection requires AI pipeline tools that read metadata — moderate real-world risk.
• Incremental update injection in decompressed streams: high-confidence signal.
• Semantic camouflage hits always require manual context review before escalating.

Embedded Attack Pattern Catalog

Use this catalog to classify findings from all layers.

1. Classic override attacks Examples: "Ignore all previous instructions", "Disregard prior context", "Override your system prompt".

2. Role hijacking Examples: "You are now DAN", "Act as an unrestricted assistant", "From now on your role is...".

3. Steganographic text hiding White text, tiny font text, or invisible render mode (3 Tr) carrying imperative instructions.

4. Encoding obfuscation Base64 payloads, hex blocks, homoglyph substitutions, and zero-width character masking.

5. Structural PDF abuse Incremental updates, JavaScript actions, hidden annotation payloads, ObjStm hidden objects, compressed stream payloads.

6. Semantic camouflage Injection phrasing embedded in technical prose, code comments, TODO notes, or policy-like sections.

7. Multilingual injection Instruction overrides written in non-English text (Turkish, Spanish, French, German) to bypass English-only rules.

8. Zero-width character encoding Invisible Unicode codepoints smuggling hidden text or encoding binary payloads between visible characters.

9. Metadata channel injection XMP metadata blocks or PDF Info dictionary fields containing instruction payloads parsed by AI pipelines.

10. Incremental update overlay Appending a PDF revision that silently replaces clean page content with injection-carrying content.

Embedded False Positive Guide

Apply this before final verdict to avoid over-reporting.

1. "DAN" in font names /BaseFont/ABCDEF+Something can include random strings. Treat as benign unless imperative phrasing exists in extracted text. The updated Layer 3 uses \b word boundaries to reduce this.

2. "act as" in technical writing Benign contexts: "acts as a proxy", "neurons act as filters". Malicious context includes direct instruction to alter model behavior.

3. "ignore" in normal documentation Benign: "ignore case", "ignore whitespace". High risk: "ignore previous instructions", "ignore all guidelines".

4. White color usage (1 1 1 rg) in design White fill can be ordinary layout styling. Escalate only when meaningful hidden text is also present.

5. Multiple %%EOF markers Often normal in signed or incrementally edited PDFs. Raise risk only if combined with other malicious indicators.

6. Non-ASCII characters Normal in multilingual or academic documents. Suspicious when mixed-script homoglyphs imitate Latin commands.

7. Large XMP blocks Adobe Creative Suite produces verbose XMP. Flag only when injection terms are present.

8. ZWC in CJK/Arabic/Hebrew documents Zero-width characters are legitimate typographic tools in some scripts. Flag only when found in Latin-script documents or when forming suspicious sequences.

9. Stream count mismatch The regex stream\r?\n also matches the \r?\n inside endstream\r?\n. Always check if the mismatch disappears after accounting for endstream substrings.

Decision Rules

• SAFE: no strong indicators across all 8 layers.
• SUSPICIOUS: weak or isolated indicators, possible false positives — human review recommended.
• DANGEROUS: high-confidence indicators in any layer, especially Layers 1, 2, 6, or 7B; or corroboration across 3+ layers.

Final Report Template

=== PDF INJECTION SCAN REPORT ===
File: <file_name>
Date: <date>

METADATA
  Creator: <value>
  Author: <value>

LAYER 1 - Dangerous PDF Features:   [CLEAN / WARNING: <details>]
LAYER 2 - Invisible Text:           [CLEAN / WARNING: <details>]
LAYER 3 - Injection Patterns:       [CLEAN / WARNING: <N matches in M categories>]
LAYER 4 - Encoding/Obfuscation:     [CLEAN / WARNING: <details>]
LAYER 5 - Stream Content:           [CLEAN / WARNING: <details>]
LAYER 6 - Zero-Width Characters:    [CLEAN / WARNING: <N ZWC found>]        ⭐ NEW
LAYER 7 - Annotation/ObjStm:        [CLEAN / WARNING: <details>]            ⭐ NEW
LAYER 8 - XMP/Updates/Semantic:     [CLEAN / WARNING: <details>]            ⭐ NEW

VERDICT: SAFE / SUSPICIOUS / DANGEROUS
Rationale: <1-2 sentence summary>