Imagine you email a Word document to a colleague, and they open it in Microsoft Word and see one thing — but when they feed the same file into an AI assistant to summarize it, the AI sees something completely different. Not a formatting quirk. Actually different content. That's the vulnerability this paper exposes, and it turns out to be a pretty big deal for anyone using LLMs to process Office documents.

Here's the setup. Modern AI pipelines increasingly ingest Word, Excel, and PowerPoint files — collectively called OOXML (Office Open XML) — for things like financial analysis, compliance review, and retrieval-augmented generation (RAG). The implicit assumption is that what a human sees in the Office editing canvas is what the LLM will consume. The authors show this assumption breaks in ways that matter.

Why does this happen? OOXML files are basically zipped bundles of XML. The Microsoft Office suite renders them using a specific interpretation of the spec, but LLM ingestion pipelines (parsers like python-docx, openpyxl, or custom extractors) walk the XML differently. A single specification-valid file can therefore produce two legitimate but conflicting "views":

• What the analyst sees when they open the file in Word/Excel/PowerPoint
• What the LLM's text extractor pulls out and feeds to the model

The authors call this evidence divergence. And crucially, it's not always accidental. An attacker can craft an OOXML file where the human-visible content looks benign — say, a normal contract or invoice — while the LLM-ingested content contains completely different text: hidden instructions, altered numbers, injected prompts, or contradicting claims. The reviewer signs off after reading the Word canvas; the automated pipeline processes something else entirely.

This is essentially a new class of prompt injection and evidence tampering, but one that lives in the parser layer rather than in visible content. It sidesteps standard defenses because the malicious payload isn't hidden in white text or tiny fonts — it's in XML structures that Office chooses not to render but that parsers happily emit.

The practical implications are uncomfortable. Any workflow where an LLM ingests documents that a human is expected to have vetted — legal review pipelines, financial audits, KYC checks, compliance reports, RAG systems over corporate document stores — is potentially exposed. And because both views are "spec-valid," it's not clear whose job it is to fix.