Redaction failures are among the most reliably recurring document mistakes there are — court filings, government releases and corporate disclosures have all shipped documents where the covered text was one copy-and-paste away. Sending a document to an AI makes the failure mode worse rather than better, because the model reads the text layer directly and never looks at the page you were editing.
The core mistake
A PDF stores text and graphics as separate objects. Drawing a black rectangle adds a graphic on top; the text underneath is untouched and fully extractable.
An AI pipeline reads the text layer, not the rendered image. Your black box is invisible to it — and the text is not.
Where content actually hides
Visible text is the layer people redact. It is rarely the only one carrying the information.
| Layer | Found in | Survives visual redaction? |
|---|---|---|
| Text under a drawn shape | Yes | |
| OCR text layer beneath a scan | Yes | |
| Previous versions (incremental saves) | Yes | |
| Annotations and form field values | Yes | |
| Tracked changes, comments | Office | Yes |
| Hidden rows, columns, sheets | Spreadsheets | Yes |
| Speaker notes | Slides | Yes |
| Cropped-away image areas | Both | Yes |
| Document properties, author, path | Both | Yes |
| Embedded thumbnails | Both | Yes |
Three of these deserve individual attention because they are the ones that catch careful people.
PDF incremental updates. PDFs can be saved by appending changes rather than rewriting the file. The earlier version remains in the bytes — so a document edited to remove a paragraph may still contain that paragraph in a prior revision inside the same file.
Image cropping. In most editors, cropping adjusts what is displayed and retains the full original image data. The part you cropped out is still there and can be recovered by resetting the crop. People crop faces and identifying details out of screenshots constantly.
Hidden spreadsheet content. A column with width zero, a row hidden by filter, or a sheet marked hidden all extract as ordinary data. Spreadsheets are the worst offender here because hiding is a routine formatting operation rather than a concealment one.
🚨 Flattening protects against extraction, not against reading
Converting pages to images removes the text layer, and copy-paste finds nothing. That defeats text extraction — and does nothing against a vision model or OCR, both of which read what is visibly on the page.
Modern AI pipelines increasingly send page images to a vision model when there is no useful text layer, so flattening can convert an extraction problem into a reading problem without solving anything. If content must not be disclosed, it has to be gone, not un-selectable.
Extract rather than redact
The most useful shift in approach, and it is a change in default rather than a technique.
The security properties are opposite. Redaction requires you to think of every hiding place; extraction requires you to think of what the task needs. The second is a much shorter list, and getting it wrong fails safe.
It is also usually better for the AI task itself. A model given three relevant clauses performs better than one given a sixty-page contract with black boxes, and it costs a fraction as much in tokens. This is the same reasoning as sending fewer columns in a data pipeline — precision beats volume in both directions.
Pseudonymisation keeps the utility
Sometimes the structure matters and only the identities are sensitive. Replace rather than remove:
The model can still reason about relationships, sequence and structure — which is usually what you wanted it for — without receiving anything identifying. Two cautions: keep the mapping table on your machine and never send it, and be aware that consistent tokens across many documents can themselves become linkable if the corpus is large enough.
Doing it properly
If you must redact rather than extract, the operation has to remove content from the file:
- Use a genuine redaction function — one that deletes the underlying objects, not a drawing tool. If the feature is in the same menu as shapes and highlights, it is not redaction.
- Sanitise the document afterwards to remove metadata, annotations, prior revisions and embedded thumbnails. This is normally a separate command from redaction.
- Re-export to a fresh file rather than saving over the original, which avoids incremental-update residue entirely.
- Check hidden structure explicitly — unhide all rows, columns and sheets; show all tracked changes and comments; reset image crops. Look at what appears.
- Strip metadata last, including on any images embedded in the document, which carry their own EXIF.
Verify — the step that catches the failures
Every published redaction failure shares one property: nobody checked the output the way an adversary would.
Step 1 is the important one because it puts you in the same position as the AI pipeline. What the extractor sees is what the model gets, and that is the only view that matters for this purpose. Verifying by looking at the page tells you about a layer nobody downstream is reading.
💡 Do the whole thing locally
There is an obvious problem with uploading a sensitive document to an online redaction service in order to make it safe to upload. The preprocessing step should not itself be a disclosure.
Splitting out the pages you need, extracting text and stripping metadata are all operations that can happen entirely in the browser — our PDF splitter and EXIF remover run on your device with nothing transmitted. That keeps the sanitising step from becoming the leak.
Pulling out just the pages you need?
Split, merge and rotate PDFs entirely in your browser — nothing is uploaded to a server.
Open PDF Splitter →Summary
- A black box is a graphic drawn over text. The text remains and extracts cleanly.
- AI reads the text layer, not the page you were looking at.
- Content hides in prior revisions, crops, hidden rows, comments and properties.
- Flattening defeats extraction, not vision models or OCR.
- Extract rather than redact. Additive fails safe; subtractive fails open.
- Pseudonymise when structure matters and keep the mapping local.
- Verify by extracting text and searching it — the adversary's view, not yours.
- Sanitise locally, so the preprocessing is not itself a disclosure.
Frequently Asked Questions
Why doesn't drawing a black box redact a PDF?
Because a PDF holds text and graphics as separate objects. A filled rectangle is drawn on top of the text, and the text remains in the content stream underneath — fully recoverable by copy and paste, text extraction, or any AI pipeline, which reads the text layer rather than the rendered page.
What is the safest way to redact a document for AI?
Extract only the parts you need into a new plain-text document rather than removing parts of the original. Redaction is a subtractive process where anything you miss remains; extraction is additive, so the default is that nothing travels unless you deliberately included it.
Where does hidden content live in Office documents?
Tracked changes, comments, document properties like author and company, hidden rows columns and worksheets, speaker notes, embedded objects, and the cropped-away parts of images which are usually retained in full. All of it survives into text extraction even though none of it appears on screen.
Does flattening a PDF to images make it safe?
It removes the text layer, so copy and paste and simple extraction find nothing. It does not remove metadata, and it does not stop a vision model or OCR from reading whatever is still visible in the image — so it protects against text extraction but not against reading.
How do I verify that redaction worked?
Extract the text from the finished file and search it for the terms you removed. If a name or number you redacted still appears in the extracted text, the redaction failed regardless of how the page looks. Also check document metadata separately, since it is not part of the visible content.