T rap D oc: Deceiving LLM Users by Injecting Imperceptible Phantom Tokens into Documents (2025)

Abstract: The reasoning, writing, text-editing, and retrieval capabilities of proprietary large language models (LLMs) have advanced rapidly, providing users with an ever-expanding set of functionalities. However, this growing utility has also led to a serious societal concern: the over-reliance on LLMs. In particular, users increasingly delegate tasks such as homework, assignments, or the processing of sensitive documents to LLMs without meaningful engagement. This form of over-reliance and misuse is emerging as a significant social issue. In order to mitigate these issues, we propose a method injecting imperceptible phantom tokens into documents, which causes LLMs to generate outputs that appear plausible to users but are in fact incorrect. Based on this technique, we introduce TrapDoc, a framework designed to deceive over-reliant LLM users. Through empirical evaluation, we demonstrate the effectiveness of our framework on proprietary LLMs, comparing its impact against several baselines. TrapDoc serves as a strong foundation for promoting more responsible and thoughtful engagement with language models.

## introduction large language models (llms) have recently excelled in a wide range of tasks, including text editing, summarizing, searching, and reasoning. yet the rising adoption of llms is not without downsides. as more users turn to these models, instances of llm misuse and negative side effects are increasingly reported: accessing harmful information @xcite @xcite , generating fake facts @xcite , leaking personally ⋆ corresponding author. ## trapdoc framework in this section, we present trapdoc, a document perturbation framework designed to corrupt the outputs of llms. figure 2 provides an overview of the trapdoc framework. our approach consists of two main components: (1) perturbing the contents of a given document to generate adversarial texts, and (2) injecting the resulting adversarial texts into the document to distract llms from correctly understand the original contents. ## experimental setup we conduct experiments under realistic usage scenarios to evaluate the practical effectiveness of trapdoc. the target llm must satisfy two conditions: (1) it must accept pdf files as input and (2) it must be capable of reading text rendered invisible to human readers. based on these criteria, we select two publicly accessible models: gpt-4.1, openai's long-context flagship model, and o4-mini, a lightweight but strong reasoning model. ## conclusion through our experiments, we gained insights into how proprietary llms perceive pdfs and proposed a problem definition, methodology, evaluation metrics, and the framework aimed at deceiving users who are over-reliant to llms. we conducted evaluations on three diverse tasks that reflect real-world llm misuse scenarios, demonstrating the significance and effectiveness of our framework. additionally, we performed both quan-titative and qualitative analyses on relatively large, paper-length documents, and further validated our framework's effectiveness in mitigating llm abuse through human evaluation. our findings reveal weaknesses in how llms are currently employed for document-related tasks. by identifying these vulnerabilities, we offer methods that can be leveraged to detect and mitigate potential misuse of llms in both academic and professional contexts. our approach will encourage a critical reassessment of prevailing practices, applied to address academic misuse and to hinder unauthorized data collection by llms. these directions will contribute to the development of more responsible and ethical applications of large language models.