ZharfAI Team
A procurement analyst covers a supplier's bank details with a black rectangle, saves the contract and uploads it for an AI summary. The page looks clean. The account number, however, might still exist as selectable text underneath the rectangle. The upload has already disclosed the file; a polite instruction asking the model to ignore bank details cannot undo that transfer.
This is a hypothetical example, not a reported ZharfAI incident. It frames a practical decision for document owners and engineering teams: should an AI service receive a reduced extract, a properly redacted derivative, the original under separately approved controls, or nothing? The answer depends on the actual file and recipient, not how reassuring its preview looks.
Start with the requested task. Comparing delivery obligations may require selected clauses, not signatures, contacts, payment instructions and the entire contract history. A carefully prepared extract can have a smaller disclosure surface than a twenty-page document with dozens of attempted redactions. The extract must still preserve qualifications, exceptions and references needed to understand those clauses.
Define both the allowed information and the recipient. An internal system approved for confidential contracts is not interchangeable with a public upload tool. Nor does removing personal identifiers necessarily make commercially sensitive prices shareable. Permission, retention and onward processing remain separate decisions after editing.
The UK's ICO describes hidden information risks extending beyond what a reader immediately sees, including metadata and embedded material. Its guidance is a useful technical starting point, not a finding that UK law governs every reader's workflow. ICO guidance on hidden information.
ZharfAI's recommendation is to record a short release purpose and an allowlist: for example, delivery dates, quantities and warranty clauses, with supplier identity excluded. Our AI output-release guide covers the broader authorization question. Here, the narrower question is whether the PDF transformation actually implements that decision.
For review purposes, treat the PDF as several surfaces: visible text and drawings; scanned pixels and any OCR text; annotations and form values; metadata and attachments; and the saved file's object structure. This is a working inspection model, not a complete description of the PDF specification. A sensitive value may occur on more than one surface.
A scanned signature can remain in an image even when a text search returns no match. Conversely, masking the pixels of an OCR-processed scan does not establish that its text representation was removed. A file attached inside the PDF may contain a full unredacted spreadsheet while every visible contract page passes inspection.
Cropping is another trap. Adobe documents that page cropping hides content rather than discarding it, and that resetting page boundaries can restore the view. Adobe's crop documentation. Treat an account number moved outside the visible page as still in scope until actual removal is established.
Inventory these surfaces before choosing a transformation. If the file cannot be opened reliably, has unexplained embedded content or uses features the approved tool does not handle, route it for specialist preparation. A processing error should not silently trigger upload of the original as a fallback.
The ICO explicitly warns that ordinary rectangles can leave underlying text available through copying and pasting. Changing a background or text color is not secure removal either. ICO redaction guidance.
Use an actual redaction function and understand its stages. Adobe's current workflow distinguishes selecting material, applying redactions and sanitizing hidden information before saving a new file. A marked-up document awaiting application is an intermediate artifact, not the deliverable. Adobe's redaction tutorial.
Build that distinction into naming and handoff. Keep the source in its authorized location. Store work in progress separately from the candidate for release. The uploader should accept only the approved derivative, not whatever document an analyst most recently opened. Avoid filenames that themselves contain the sensitive person or project name.
An AI detector can suggest spans to remove, but those suggestions need review against the disclosure policy. Finding common names is different from finding a confidential codename, a handwritten account reference or an identity implied by context. Do not send the unredacted original to an unapproved detector merely to prepare it for another unapproved service.
Text-based search and coordinate-based removal solve different problems. Search helps locate known values; coordinates define the material the editing engine removes. Rotated pages, scanned pages, split lines and different page sizes make a reused rectangle unreliable unless its transformation is checked.
For Persian documents, include Persian and Arabic letter forms, mixed digit scripts, spacing variants and line breaks in search tests. Inspect the complete identifier, not merely one matched fragment. A number repeated as an image or written differently elsewhere needs a separate detection path. These are proposed test cases, not a claim that one normalizer catches every Persian variant.
PyMuPDF documents separate redaction behavior for text, images and vector graphics. It also warns that modifying an image on one page can leave the original available through another reference. Settings and object reuse therefore matter. PyMuPDF page redaction documentation.
Pin the engine version and select behavior explicitly for the supported document types. Test both under-removal and over-removal: a rectangle that misses a digit is unsafe, while one that removes a neighboring negation can change the contract's meaning. Generic defaults and a successful return value do not settle either question.
The save operation is part of the security design. PyMuPDF describes incremental saving as storing changes, and its garbage-collection options remove unreferenced objects; those options exclude incremental saving. Its documentation also notes that saving a new file can invalidate verified signatures. PyMuPDF saving documentation.
For this workflow, prefer a separately generated release file with explicit cleanup, not an incremental edit of the original. Removing unused objects is still not a universal sanitizer: an object that remains referenced is not unused. Metadata, attachments, forms and annotations need deliberate handling under the chosen policy.
Do not promise to preserve the original signature's assurance after changing its contents. Keep the signed source under the appropriate records policy and identify the derivative as edited. If a process requires an intact signed original, reconsider the recipient or processing environment rather than presenting a modified copy as equivalent evidence.
Bind approval to the candidate's cryptographic hash and record its source identifier, transformation version and reviewer. A hash identifies bytes; it does not certify redaction quality. Its value is preventing the approved copy from being silently replaced by a similarly named file before upload.
Use complementary checks on the exact saved candidate. First, inspect every released page and compare it with the approved removal plan. Second, extract text independently and search for protected values and reasonable variants. Third, inventory remaining images, attachments, annotations, metadata and other supported objects. Inspect extracted images when the document contains scans or reused graphics.
The qpdf command-line interface provides structural inspection, attachment listing and page/image-object information. Its --check result concerns syntax and structure; success is not a privacy certificate. qpdf inspection options.
Use a different extraction path where practical, so the checker is less likely to repeat the editing engine's blind spot. Keep inspection outputs inside the same restricted environment: extracted text and images can be more exposed than the source if they land in shared logs or temporary folders with broad access.
An empty search result has limited meaning. It may show absence, but it may also show extraction failure, a changed encoding or a sensitive value stored as pixels. A useful test report records which surfaces were inspected, which could not be inspected and what remains uncertain. Missing coverage calls for review, not an automatic pass.
Consider a hypothetical eight-page bilingual contract. The task is to summarize delivery deadlines and warranty exclusions. The same supplier account appears as text on page two, in a scanned annex and in an embedded payment-instructions file. A project manager's name also appears in a comment. These are invented details for the example.
The document owner first decides that the AI recipient does not need payment or identity information. The preparer then chooses between a checked clause extract and a redacted PDF. If preserving the annex's layout adds no value to the summary, excluding it entirely may be simpler than editing it.
| Finding in the candidate | What it establishes | Next action |
|---|---|---|
| Account text is still extractable under a black box | Visual masking did not remove the value | Reject this candidate and redo removal |
| Text search is clean, but the scanned annex still shows the account | Text-only checking missed an image surface | Redact the pixels or exclude the annex |
| Visible pages are clean, but a payment file remains embedded | The release contains an additional disclosure surface | Remove or separately approve the attachment |
| Required clauses disappeared along with sensitive material | Confidentiality work damaged usefulness | Rebuild the minimum useful extract |
| Planned checks pass and an authorized reviewer approves the exact file | Evidence supports release within the stated scope | Upload only that derivative to the approved recipient |
Do not count black rectangles as a success metric. Count protected occurrences found and removed, unsupported surfaces, review exceptions and whether the resulting document still answers the permitted question. The general document-intelligence guide explains why extraction quality must be assessed separately from downstream summarization quality.
A 2023 paper by Bland, Iyer and Levchenko demonstrated that character-position information could leak clues about redacted text even after its removal. The research also found that rasterization reduced some leakage without eliminating all inference. These are historical findings about studied tools and documents, not a benchmark of every current product. PoPETs research paper.
The practical lesson is to separate two claims: “the prohibited content is no longer recoverable through the tested file surfaces” and “the recipient cannot infer the identity.” The latter is much stronger. A unique job title, branch, date or surrounding narrative can identify someone without recovering the removed name.
When that inference matters, consider removing a larger passage or creating a purpose-built extract that does not preserve the original layout. Assess whether a standardized omission marker or broader generalization helps without distorting meaning. Sometimes the useful context and the sensitive identity cannot be separated; the right outcome is restricted processing or no disclosure.
Do not describe a document as anonymous merely because direct identifiers are absent. Redaction, pseudonymization and an assessment of re-identification risk answer different questions. Seek appropriate legal and records-management advice for consequential disclosures; this guide is an engineering method, not legal clearance.
Rasterizing a reviewed document into a fresh file can reduce some structural complexity, but it trades away selectable text, accessibility and extraction accuracy. It also cannot fix sensitive content that remains visible. If OCR is added afterward, generate it from the sanitized pixels and inspect the new result; do not carry over the original OCR text.
Check what the AI task loses. An unreadable footnote, a clipped table header or a missing exception can produce a confident but wrong summary. Prepare a small task-specific checklist: required clauses present, table units legible, references interpretable, and omission markers clearly distinguished from original wording.
Treat every later transformation as another candidate when it can change content: recompression, merging attachments, translation, OCR or conversion to a searchable PDF. An approval of one byte sequence does not automatically approve another. Our data-deletion and derivative-lineage guide is relevant if an earlier version has already entered indexes, caches or downstream stores. Cleaning a new copy does not recall an old upload.
For each release, retain the purpose, authorized recipient, source reference, derivative hash, tool version, approved removals, inspected surfaces, unresolved limitations and approval identity. Keep the record access-controlled and avoid reproducing the sensitive values in an unrestricted audit log.
Report failures by type: missed occurrence, residual object, wrong derivative uploaded, unsupported document, excessive deletion or inference risk. Review representative outputs after changes to the PDF engine, OCR, detection rules or incoming document templates. Include deliberately difficult synthetic fixtures in regression tests, never real secrets copied into a public test repository.
The decision is not “does this PDF look redacted?” It is whether the minimum useful information has been prepared for this recipient, whether the exact candidate has evidence of appropriate removal, and whether remaining uncertainty is acceptable to its accountable owner. A clean page is helpful evidence. It is not the whole file.
The operating method and contract example are ZharfAI analysis. No production redaction tool or customer document was tested for this article.
A release guide for defining who is protected, bounding contributions, accounting for repeated use, testing utility, and deciding whether a differentially private output is fit to publish.
Read More
A practical method for tracing personal data through AI pipelines, choosing deletion, rebuild, retraining, or unlearning, and proving that derived artifacts stay clean.
Read More
A fluent transcript can contain words nobody said. Preserve the recording, inspect silent spans and separate draft text from statements that become meeting evidence.
Read MoreIf this note maps to a real system in your organisation, start with the services page or a shipped case study.