AI Adversarial Document Lab: Crafted Markdown Defeats the Summariser

This article describes adversarial document upload, a form of indirect prompt injection where attackers craft Markdown documents with specific structural elements (blockquotes, headings, bold text) to force AI summarisers to produce attacker-chosen output. The lab demonstrates how SummariseBot's parser treats certain document structures as signals of importance, allowing an attacker to place a target phrase in a blockquote and have it reproduced verbatim in the summary. The vulnerability matters because as more AI pipelines ingest rich documents through RAG systems and other parsers, structure-aware parsing becomes an exploitable surface that conflates document formatting with user intent.

• Parser structural assumptions enable injectionSummariseBot's parser assumes that blockquotes, headings, and bold text signal importance and therefore deserves verbatim reproduction or prominence in summaries. An attacker exploits this assumption by embedding a target phrase inside a blockquote; the parser then echoes that quoted structure directly into the summary, placing the attacker's words in the output without any model reasoning or filtering.
• Attack requires minimal document visibilityThe attacker surrounds the injected phrase with ordinary, benign-looking content so that a human reviewer examining the document sees nothing suspicious. This camouflage is essential to the attack's success because it prevents detection at the document level while the injection still reaches the summariser.
• Structure is an attacker-controlled input channelThe core insight is that document structure (formatting, layout, markup) is not neutral metadata—it is user-supplied input that the model weights according to its parser logic. By controlling the structure, the attacker controls which content the summariser privileges, effectively using formatting as an indirect prompt injection lever.
• Classified as OWASP LLM01 prompt injectionThe article identifies adversarial document upload as indirect prompt injection under OWASP LLM01 in the 2025 Top 10 for LLM Applications. It is indirect because the injection does not come through a direct user query but through a secondary input channel—the document structure itself—that the summariser trusts.
• Defense requires content normalisationThe recommended defense is to treat all document content as inert data and normalise or flatten structure before the model processes it, so that quotes and headings carry no special authority. Additionally, defenders should delimit retrieved content from instructions in the prompt, review outputs for injected literals, and constrain summary format to limit what can surface.
• Affects RAG pipelines and rich document processingAs more AI systems parse rich documents through retrieval-augmented generation (RAG) and other ingestion pipelines, structure-aware parsing becomes a practical attack surface. The article notes that adversarial documents are especially relevant to summarisers and RAG systems where structural assumptions go unexamined.

Bottom line: Document structure is not a neutral signal—it is attacker-controlled input that AI parsers should treat as data, not intent. Any system that privileges certain formatting (quotes, headings, bold) without normalising it first becomes vulnerable to indirect prompt injection through carefully crafted adversarial documents.