One PDF, Two Readers: Embedding Hidden Markdown for LLMs in Ordinary Files

A developer has built a way to make a single PDF present entirely different content to humans and machines. The trick uses an obscure property in the PDF spec — replacement text for marked-content sequences, present since PDF 1.4 in 2001 and originally intended for ligature handling — to attach structured markdown to the document’s content stream. Viewers like Preview and Adobe render the visual layout as normal, but extractors such as PyMuPDF and Poppler return the embedded markdown instead of reconstructed visual text.

The motivation is that most PDFs are untagged piles of draw commands, and the LLM tools now consuming them must guess where headings end, which lines are bullets, and how wrapped sentences rejoin. The author’s ‘smart PDFs’ make that structure explicit: extraction yields proper # headings, markdown tables, and lists rather than flattened, mid-word-broken text. Token counts stay roughly flat and file size overhead is single-digit percent, so the gain is information density per token rather than compression. Tests uploading the files to ChatGPT and Claude showed both models receiving the embedded markdown layer verbatim.

The dual-read property cuts both ways. A file whose machine-extracted text can diverge completely from what a human reviewer sees is also a ready-made vector for content spoofing and prompt injection — a contract could render one set of terms while an LLM summarizer ingests another. The author frames this as an accessibility-for-machines feature and is iterating toward a Google Docs extension, with code published on GitHub, but anyone building PDF ingestion pipelines should note that extracted text and rendered text are no longer guaranteed to match.