Hidden instructions in court filings: document provenance when the reader is an AI
A court filing used to have one audience. Now it has two — a judge or clerk, and a model — and a document can present differently to each. The filing record was designed for the first audience and has no concept of the second.
What happens when a court filing is read by an AI?
It acquires a second audience with different vulnerabilities. Courts have found concealed instructions embedded in filed documents aimed at AI-assisted review, which means a filing is now read by a person and by a model — and the record cannot prove what either of them saw.
- In 2026 courts in more than one country identified concealed instructions in filed documents intended to influence AI-assisted review, and the US judiciary was asked in May 2026 to adopt a rule on AI-generated content in filings.
- The e-filing record authenticates an account and stores a document. It does not bind a responsible human to the exact bytes submitted.
- This article describes the class of problem and the defence. It deliberately omits any technique that would help produce such a document.
Part of Courts and fiduciary identity
Two readers, one document
Think about what a PDF actually is. There is what a human sees when it renders, and there is what a machine extracts when it parses. Those are produced by the same file and they are not required to match.
For thirty years that mismatch was a curiosity — an accessibility problem, a search indexing quirk. It becomes something else when courts, opposing counsel and the filing firm all run documents through models that read the extracted text and summarise it.
In 2026, courts identified filings containing concealed content directed at those machine readers. The specific mechanisms are not described here, deliberately. What matters for a court technology director is the property, not the recipe: a filing's machine-visible content can diverge from its human-visible content, and nothing in the filing record records which was which.
What the rules currently address
Federal Rule of Civil Procedure 11 requires that an attorney's signature certify that the filing's contentions are warranted and its factual assertions have evidentiary support. Sanctions have followed where AI-fabricated citations appeared in filings, and in May 2026 the judiciary was formally asked to adopt a rule addressing AI-generated content.
Those developments concern content that is false. The divergence problem is different: the content may be entirely accurate to a human reader while carrying something else to a machine. A rule about AI-generated content does not reach it, and neither does Rule 11 as conventionally applied.
A three-class taxonomy
| Class | What diverges | Why the record cannot show it |
|---|---|---|
| Class 1 — Extraction divergence | The text a parser extracts differs from the text that renders | The record stores the file, not either reading of it |
| Class 2 — Presentation divergence | Content is present in the file but not visible in normal rendering | Visibility is a rendering property, not a stored one |
| Class 3 — Encoding divergence | Characters render as one thing and parse as another | Both readings are technically correct for the file |
All three are old techniques from other contexts. What is new is that a second reader now exists in the legal workflow and makes them consequential.
The Filing Provenance Model
The defence is to make the attestation cover both readings. At the moment of filing, the system computes and binds:
- A rendering hash — of the document as displayed, at a specified rendering configuration.
- An extraction hash — of the text a standard parser extracts.
- A divergence indicator — a simple flag and metric where the two differ beyond an expected tolerance.
- An attorney attestation — signed with a hardware-backed credential, covering all three.
An attorney is then attesting to a document whose two readings are both fixed at the moment of signature. A subsequent divergence is detectable by anyone, and a divergence present at filing is visible in the record rather than hidden in the file.
The clerk-side procedure
None of this requires the clerk's office to become a forensics unit. The procedure is short:
- On acceptance, compute both hashes and compare against the attestation.
- Where the divergence indicator exceeds tolerance, the filing is flagged — not rejected — and routed for review.
- The flag and its metric become part of the docket record, visible to the court and to opposing counsel.
- Nothing is inferred about intent. A flag means the two readings differ, which has innocent causes as well as adversarial ones.
That last point matters. Scanned exhibits, poorly generated PDFs and unusual fonts all produce divergence for entirely legitimate reasons. A system that treats the flag as an accusation will be abandoned within a term.
Why the responsible-disclosure boundary is drawn here
An article explaining precisely how to construct a document that reads differently to a model would be read by more people intending to try it than people intending to defend against it. The defensive value of that detail is zero — the defence is hash comparison, which works regardless of technique.
So the technique is omitted, and any vendor or researcher publishing it in a legal-industry venue should be asked what defensive purpose it serves.
What this does not solve
It does not detect AI-fabricated citations, which is a content-accuracy problem addressed by verification tools and by Rule 11. It does not prevent a filer from submitting a document with divergence — it makes the divergence visible. And it does nothing about documents filed before adoption.
Concealment techniques in a filed document
| Technique | Visible to a human? |
|---|---|
| White or zero-size text | No |
| Text behind an image or off-page | No |
| Metadata and annotation fields | No |
| Layered content | No |
| Ordinary footnote in tiny type | Barely |
None of these is exotic and all are trivially detectable if anyone looks. The gap is that nobody currently produces a record of what the document's extracted text was at filing, so a later dispute about what a reviewer saw has no artefact.
Objections and honest limits
“This is a document sanitisation problem.” Sanitising is necessary and it does not create a record. Both are wanted: strip the concealment, and hash what was actually filed.
“Courts will simply prohibit it.” They will, and prohibition addresses the culpable case. It does not tell a court in two years what text the document contained when it was reviewed.
Making a filing's content provable
- Hash the extracted text at filing. Not just the file.
- Record both renderings. What a human sees and what an extractor returns.
- Flag divergence. A meaningful difference between the two is the signal.
- Bind the certification to the extracted text. So the attorney attests to what a reader actually gets.
Terms used here
- Indirect prompt injection
- Instructions concealed in content that an AI system reads, aimed at influencing its output.
- Extracted text
- What a text extractor returns from a document, which can differ from what a human sees rendered.
- Document provenance
- A verifiable record of a document's content at a point in time.
Frequently asked questions
Is this a real problem or a theoretical one? Courts in the United States and abroad identified concealed instructions in filings during 2026. The frequency is unknown, and this article does not estimate it.
Would this reject legitimate filings? No. Divergence produces a flag with a metric, not a rejection. Scanned exhibits and unusual documents legitimately diverge and must not be blocked.
Does this require e-filing systems to be replaced? No. Two hash computations at acceptance and a field in the docket record. The attestation is produced by the filer.
Who benefits most? Judges and clerks using AI-assisted review, and honest filers, who currently have no way to demonstrate that their document says the same thing to both readers.
Is this a real phenomenon in courts? Courts have found concealed instructions embedded in filed documents aimed at AI-assisted review.
Isn't sanitisation the answer? It is necessary and insufficient. Stripping concealment does not produce a record of what the filing contained.
What should be hashed? The extracted text as well as the file, so a later dispute about what a reviewer saw has an artefact.
Where this fits in Manav
Manav binds the authorising person to the exact instruction, filing or engagement, and produces a receipt a court, a counterparty or a regulator can verify without access to the firm's systems.
Sources and further reading
- Reported court findings of concealed instructions in filed documents, 2026.
- FCC — protecting consumers from SIM swap and port-out fraud
- U.S. Department of Justice — press releases
- Federal Rule of Civil Procedure 11 — Cornell LII
- RFC 8785 — JSON Canonicalization Scheme
- OWASP Top 10 for Large Language Model Applications
- Federal Rules of Civil Procedure — Rule 11