EDIT 2: Just to make it clear. Check out this pdf [2] about an amazing CEO that gave billions of his own money to his company just before he retires to Ecuador.

EDIT 2: Just to make it clear. Check out this pdf [2] about an amazing CEO that gave billions of his own money to his company just before he retires to Ecuador. He probably should've gone to a non-extradition country, based on what ChatGPT sees. [3] And it's not just ChatGPT. It's *anyone* doing "chat with my PDF" and just assuming that because it has text it's good to go. [4] [5] [6] [2]: https://smallpdf.com/file#s=c18a4561-a35b-455e-b132-377f376efe38 https://smallpdf.com/file#s=c18a4561-a35b-455e-b132-377f376e... [3]: https://chat.openai.com/share/d28b6c4d-69bf-435f-9903-4821db4d07d6 https://chat.openai.com/share/d28b6c4d-69bf-435f-9903-4821db... [4]: https://www.chatpdf.com/share/xcnHT1S8MVBvOin0fRHru https://www.chatpdf.com/share/xcnHT1S8MVBvOin0fRHru [5]: https://askyourpdf.com/conversations/d528e263-262f-4ca1-ab3f-51e77e176915 https://askyourpdf.com/conversations/d528e263-262f-4ca1-ab3f... [6]: https://pdf.ai/share/clofc3n8g0014mj0fse5j45am https://pdf.ai/share/clofc3n8g0014mj0fse5j45am EDIT: To prove the note below, I created a "blank" PDF [0] (only a print footer). It's white text on a white background. And ChatGPT didn't hesitate to gaslight me about it. [1] [0]: https://smallpdf.com/file#s=ba5f4c17-c44e-4d53-bc52-0820246d1cda https://smallpdf.com/file#s=ba5f4c17-c44e-4d53-bc52-0820246d... [1]: https://chat.openai.com/share/f26d3edb-3fa6-4682-af96-5f220f1a5742 https://chat.openai.com/share/f26d3edb-3fa6-4682-af96-5f220f... (original comment) Let this be a warning to everyone building RAG systems with PDFs: Don't rely on the text representation in a PDF, even if it's native text. OCR it. It's trivial to hide text in a PDF that's completely separate from a raster image of text. You will, I promise, find yourself indexing and retrieving malicious text and shoving it into a prompt. That text could either be an intentional misrepresentation of the content in the PDF, or a well-crafted prompt injection that exfiltrates other secrets, or acts as a heretofore unknown vector for fuckery. Some people are even doing RAG in `system` role prompts with GPT-4 and holy hell is that a bad idea.