I may be naive here but can the hidden text not be flagged or outright removed before being passed to copilot? Why would there not be consideration for what a human user can see, especially if the hidden text was added by copilot in the first place?
I may be naive here but can the hidden text not be flagged or outright removed before being passed to copilot? Why would there not be consideration for what a human user can see, especially if the hidden text was added by copilot in the first place?
There are many ways to hide text. Low contrast, small font size, image covering part of the text, too-small box cutting off some parts, custom font making certain words look like other ones... Alerting the user about such formatting issues would be helpful (e.g. also when you try to redact something by drawing a black rectangle over it without removing the text underneath) but you probably shouldn't rely on it for security.
As long as Copilot can't be prevented from acting on instructions in its input, it would be safer to not make untrusted document content part of the input, similar to how macros in untrusted documents aren't executed by default.
Hide your prompt injection in terms & conditions, plain sight but totally invisible.
[dead]
> Why would there not be consideration for what a human user can see,
How would a machine actually know which part of a document a human can see unless they print it to PDF, scan the rasterised PDF and compare the result from the OCR with text in the document?
I mean, I dunno how Word would decide that the following can't be seen by a user: white-on-white text, rendering off-page, embedded font with no lines, text covered by an image, etc.
That's not an unsolvable problem. Checking visibility is easy, computer graphics have been doing this since forever. Fonts that are too small, ditto. Contrast is well understood.
If you do want to render, you don't have to do the convoluted PDF route. That's what the user would do, the software would just use its normal drawing code. OCR is neither needed nor desirable. OCR errors would erroneously flag perfectly normal text, and it can be fooled just like a human can. You can detect whether or not there's any rendering with the bounding box of whatever text section you are looking for (something Word already has to calculate if it wants to render correctly on screen).
I'm only talking about checking for visible text. This will not solve the larger problem of malicious AI instructions.
Embed text in an image, a human will read it just fine. Perfectly visible but opaque to AI. It'd be obnoxious to turn it into an attack, but you can replace letters with images in phrases so that humans read "she believed" while AI reads "he lied."