{
 "slug": "filing-provenance-model",
 "topic_id": "TOPIC-159",
 "cluster": "Law Firms, Courts & Fiduciary Disbursement Identity",
 "tier": "Tier A",
 "title": "Hidden instructions in court filings: document provenance when the reader is an AI",
 "summary": "Courts have found concealed instructions embedded in filed documents aimed at AI-assisted review. A filing is now read by two audiences, and the record cannot prove what either of them saw.",
 "lede": "A court filing used to have one audience. Now it has two — a judge or clerk, and a model — and a document can present differently to each. The filing record was designed for the first audience and has no concept of the second.",
 "date": "2026-02-11",
 "category": "Compliance",
 "author_id": "priya-venkatraman",
 "tags": [
  "court filings",
  "AI in courts",
  "prompt injection",
  "document provenance",
  "Rule 11",
  "e-filing"
 ],
 "image_title": "Filing Provenance Model",
 "schema": "Article",
 "key_takeaways": [
  "In 2026 courts in more than one country identified concealed instructions in filed documents intended to influence AI-assisted review, and the US judiciary was asked in May 2026 to adopt a rule on AI-generated content in filings.",
  "The e-filing record authenticates an account and stores a document. It does not bind a responsible human to the exact bytes submitted.",
  "This article describes the class of problem and the defence. It deliberately omits any technique that would help produce such a document."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Two readers, one document"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "One document, two readers, two renderings",
   "caption": "The visible text and the extracted text can differ, and nothing records which was which.",
   "nodes": [
    {
     "label": "Document filed",
     "note": "PDF"
    },
    {
     "label": "Human reads the visible text",
     "note": "as rendered"
    },
    {
     "label": "Model reads the extracted text",
     "note": "may include hidden content",
     "bad": true
    },
    {
     "label": "Nothing records either rendering",
     "note": "",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Think about what a PDF actually is. There is what a human sees when it renders, and there is what a machine extracts when it parses. Those are produced by the same file and they are not required to match."
  },
  {
   "type": "p",
   "html": "For thirty years that mismatch was a curiosity — an accessibility problem, a search indexing quirk. It becomes something else when courts, opposing counsel and the filing firm all run documents through models that read the extracted text and summarise it."
  },
  {
   "type": "p",
   "html": "In 2026, courts identified filings containing concealed content directed at those machine readers. The specific mechanisms are not described here, deliberately. What matters for a court technology director is the property, not the recipe: <strong style=\"font-weight:600\">a filing's machine-visible content can diverge from its human-visible content, and nothing in the filing record records which was which.</strong>"
  },
  {
   "type": "h2",
   "text": "What the rules currently address"
  },
  {
   "type": "p",
   "html": "Federal Rule of Civil Procedure 11 requires that an attorney's signature certify that the filing's contentions are warranted and its factual assertions have evidentiary support. Sanctions have followed where AI-fabricated citations appeared in filings, and in May 2026 the judiciary was formally asked to adopt a rule addressing AI-generated content."
  },
  {
   "type": "p",
   "html": "Those developments concern content that is false. The divergence problem is different: the content may be entirely accurate to a human reader while carrying something else to a machine. A rule about AI-generated content does not reach it, and neither does Rule 11 as conventionally applied."
  },
  {
   "type": "h2",
   "text": "A three-class taxonomy"
  },
  {
   "type": "table",
   "caption": "Classes of human/machine divergence in a filed document. Described at the level of category only.",
   "head": [
    "Class",
    "What diverges",
    "Why the record cannot show it"
   ],
   "rows": [
    [
     "Class 1 — Extraction divergence",
     "The text a parser extracts differs from the text that renders",
     "The record stores the file, not either reading of it"
    ],
    [
     "Class 2 — Presentation divergence",
     "Content is present in the file but not visible in normal rendering",
     "Visibility is a rendering property, not a stored one"
    ],
    [
     "Class 3 — Encoding divergence",
     "Characters render as one thing and parse as another",
     "Both readings are technically correct for the file"
    ]
   ]
  },
  {
   "type": "p",
   "html": "All three are old techniques from other contexts. What is new is that a second reader now exists in the legal workflow and makes them consequential."
  },
  {
   "type": "h2",
   "text": "The Filing Provenance Model"
  },
  {
   "type": "p",
   "html": "The defence is to make the attestation cover both readings. At the moment of filing, the system computes and binds:"
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">A rendering hash</strong> — of the document as displayed, at a specified rendering configuration.",
    "<strong style=\"font-weight:600\">An extraction hash</strong> — of the text a standard parser extracts.",
    "<strong style=\"font-weight:600\">A divergence indicator</strong> — a simple flag and metric where the two differ beyond an expected tolerance.",
    "<strong style=\"font-weight:600\">An attorney attestation</strong> — signed with a hardware-backed credential, covering all three."
   ]
  },
  {
   "type": "p",
   "html": "An attorney is then attesting to a document whose two readings are both fixed at the moment of signature. A subsequent divergence is detectable by anyone, and a divergence present at filing is visible in the record rather than hidden in the file."
  },
  {
   "type": "h2",
   "text": "The clerk-side procedure"
  },
  {
   "type": "p",
   "html": "None of this requires the clerk's office to become a forensics unit. The procedure is short:"
  },
  {
   "type": "ol",
   "items": [
    "On acceptance, compute both hashes and compare against the attestation.",
    "Where the divergence indicator exceeds tolerance, the filing is flagged — not rejected — and routed for review.",
    "The flag and its metric become part of the docket record, visible to the court and to opposing counsel.",
    "Nothing is inferred about intent. A flag means the two readings differ, which has innocent causes as well as adversarial ones."
   ]
  },
  {
   "type": "p",
   "html": "That last point matters. Scanned exhibits, poorly generated PDFs and unusual fonts all produce divergence for entirely legitimate reasons. A system that treats the flag as an accusation will be abandoned within a term."
  },
  {
   "type": "h2",
   "text": "Why the responsible-disclosure boundary is drawn here"
  },
  {
   "type": "p",
   "html": "An article explaining precisely how to construct a document that reads differently to a model would be read by more people intending to try it than people intending to defend against it. The defensive value of that detail is zero — the defence is hash comparison, which works regardless of technique."
  },
  {
   "type": "p",
   "html": "So the technique is omitted, and any vendor or researcher publishing it in a legal-industry venue should be asked what defensive purpose it serves."
  },
  {
   "type": "h2",
   "text": "What this does not solve"
  },
  {
   "type": "p",
   "html": "It does not detect AI-fabricated citations, which is a content-accuracy problem addressed by verification tools and by Rule 11. It does not prevent a filer from submitting a document with divergence — it makes the divergence visible. And it does nothing about documents filed before adoption."
  },
  {
   "type": "h2",
   "text": "Concealment techniques in a filed document"
  },
  {
   "type": "table",
   "caption": "How content can be present and invisible",
   "head": [
    "Technique",
    "Visible to a human?"
   ],
   "rows": [
    [
     "White or zero-size text",
     "No"
    ],
    [
     "Text behind an image or off-page",
     "No"
    ],
    [
     "Metadata and annotation fields",
     "No"
    ],
    [
     "Layered content",
     "No"
    ],
    [
     "Ordinary footnote in tiny type",
     "Barely"
    ]
   ]
  },
  {
   "type": "p",
   "html": "None of these is exotic and all are trivially detectable if anyone looks. The gap is that nobody currently produces a record of what the document's extracted text was at filing, so a later dispute about what a reviewer saw has no artefact."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“This is a document sanitisation problem.”</strong> Sanitising is necessary and it does not create a record. Both are wanted: strip the concealment, and hash what was actually filed."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Courts will simply prohibit it.”</strong> They will, and prohibition addresses the culpable case. It does not tell a court in two years what text the document contained when it was reviewed."
  }
 ],
 "faq": [
  {
   "q": "Is this a real problem or a theoretical one?",
   "a": "Courts in the United States and abroad identified concealed instructions in filings during 2026. The frequency is unknown, and this article does not estimate it."
  },
  {
   "q": "Would this reject legitimate filings?",
   "a": "No. Divergence produces a flag with a metric, not a rejection. Scanned exhibits and unusual documents legitimately diverge and must not be blocked."
  },
  {
   "q": "Does this require e-filing systems to be replaced?",
   "a": "No. Two hash computations at acceptance and a field in the docket record. The attestation is produced by the filer."
  },
  {
   "q": "Who benefits most?",
   "a": "Judges and clerks using AI-assisted review, and honest filers, who currently have no way to demonstrate that their document says the same thing to both readers."
  },
  {
   "q": "Is this a real phenomenon in courts?",
   "a": "Courts have found concealed instructions embedded in filed documents aimed at AI-assisted review."
  },
  {
   "q": "Isn't sanitisation the answer?",
   "a": "It is necessary and insufficient. Stripping concealment does not produce a record of what the filing contained."
  },
  {
   "q": "What should be hashed?",
   "a": "The extracted text as well as the file, so a later dispute about what a reviewer saw has an artefact."
  }
 ],
 "sources": [
  {
   "t": "Reported court findings of concealed instructions in filed documents, 2026."
  },
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  },
  {
   "t": "U.S. Department of Justice — press releases",
   "u": "https://www.justice.gov/news"
  },
  {
   "t": "Federal Rule of Civil Procedure 11 — Cornell LII",
   "u": "https://www.law.cornell.edu/rules/frcp/rule_11"
  },
  {
   "t": "RFC 8785 — JSON Canonicalization Scheme",
   "u": "https://www.rfc-editor.org/rfc/rfc8785"
  },
  {
   "t": "OWASP Top 10 for Large Language Model Applications",
   "u": "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
  },
  {
   "t": "Federal Rules of Civil Procedure — Rule 11",
   "u": "https://www.law.cornell.edu/rules/frcp/rule_11"
  }
 ],
 "related": [
  {
   "slug": "filing-delegation-pattern",
   "title": "Filed under your bar number",
   "category": "Compliance"
  },
  {
   "slug": "order-verification-model",
   "title": "The fake court order",
   "category": "Compliance"
  },
  {
   "slug": "collection-attestation-receipt",
   "title": "Chain of custody for electronic evidence",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Filing%20Provenance%20Model/1200_630/blog.jpg",
 "wordcount": 1076,
 "url": "/blog/filing-provenance-model.html",
 "reading_time": "5 min read",
 "seo_title": "Hidden instructions in court filings read by AI",
 "meta_description": "Courts have found concealed instructions in filed documents aimed at AI-assisted review. A filing is now read by two audiences.",
 "hub": {
  "slug": "topics/fiduciary-identity",
  "title": "Courts and fiduciary identity"
 },
 "answer": "It acquires a second audience with different vulnerabilities. Courts have found concealed instructions embedded in filed documents aimed at AI-assisted review, which means a filing is now read by a person and by a model — and the record cannot prove what either of them saw.",
 "answer_q": "What happens when a court filing is read by an AI?",
 "glossary": [
  {
   "term": "Indirect prompt injection",
   "def": "Instructions concealed in content that an AI system reads, aimed at influencing its output."
  },
  {
   "term": "Extracted text",
   "def": "What a text extractor returns from a document, which can differ from what a human sees rendered."
  },
  {
   "term": "Document provenance",
   "def": "A verifiable record of a document's content at a point in time."
  }
 ],
 "checklist": {
  "title": "Making a filing's content provable",
  "id": "provenance",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Hash the extracted text at filing.",
    "text": "Not just the file."
   },
   {
    "name": "Record both renderings.",
    "text": "What a human sees and what an extractor returns."
   },
   {
    "name": "Flag divergence.",
    "text": "A meaningful difference between the two is the signal."
   },
   {
    "name": "Bind the certification to the extracted text.",
    "text": "So the attorney attests to what a reader actually gets."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising person to the exact instruction, filing or engagement, and produces a receipt a court, a counterparty or a regulator can verify without access to the firm's systems.",
  "href": "../docs.html",
  "label": "See legal receipts"
 }
}