PaperlayerView exact revision on arXiv

Source-linked AI summary

Beyond the Editing Canvas: Evidence Divergence in OOXML-to-LLM Ingestion

Side Liu, Jiangpeng Liu, Jinwen Xin, Guojun Peng, Jiang Ming

arXiv:2608.25880v1cs.SEcs.CR

TL;DR

OOXML-to-LLM pipelines may deliver model evidence that differs from what users see in Microsoft Office, challenging their assumption of semantic integrity. The paper mines the OOXML specification and experimentally confirms evidence forks across Office formats, finding that exposure depends strongly on ingestion configuration and extractor families. It concludes that secure ingestion should define the intended view and preserve evidence provenance and semantic roles.

  • Problem

    OOXML-to-LLM workflows assume that model evidence matches the content users reviewed in Microsoft Office, although ingestion contracts rarely specify the selected view or preserve semantic roles.

  • Method

    The authors systematically mine the OOXML specification, validate candidate constructions with Office and extraction tests, and evaluate realistic fork-bearing documents across LLM interfaces.

  • Results

    21 evidence forks were confirmed across Word, Excel, and PowerPoint; across 8,400 API trials, traps appeared in 48–76% of runs, with at least one interface exposing traps for 20 of 21 mechanisms.

  • Takeaways & Limitations

    Secure ingestion should define the intended view, preserve evidence provenance and semantic roles, and use evidence-fork probes as loaders evolve.

  • Takeaways & Limitations

    Aggregate propagation rates describe a mechanism-balanced evaluation set rather than deployment document distributions, and evaluated product mappings are snapshots of pinned or dated configurations.

Abstract

from arXiv · show

LLM pipelines increasingly ingest Office Open XML (OOXML) documents (Word, Excel, and PowerPoint files) as first-class evidence in financial, compliance, and retrieval-augmented workflows, implicitly assuming semantic integrity: that the evidence consumed by the model matches the content shown in the Microsoft Office suite editing canvas. We show that this assumption can fail in OOXML-to-LLM pipelines. The same specification-valid OOXML file can yield one evidentiary view in Microsoft Office and another when extracted for an LLM. Each view is treated as authoritative by its consumer, a condition we call plural ground truth. The ingestion contract rarely states which view and semantic roles become model evidence or preserves how that evidence was derived. We call the specification-grounded OOXML constructions that induce such divergence evidence forks. We systematically traverse and mine the OOXML specification and confirm 21 evidence forks across Excel, Word, and PowerPoint, spanning six dimensions of view construction. All 13 tools in our extraction panel emit evidence from at least one fork. We test four native-ingestion LLM APIs and seven web chatbots. Each test document carries a trap: a task-relevant fact exposed by extraction but not shown in Office. Across this 21-mechanism evaluation, the four APIs return the trap in 48--76% of trials. For 20 of 21 mechanisms, at least one of the eleven interfaces returns the trap. Our measurements further show that exposure is shaped upstream of the model by the ingestion path and extractor configuration. A source-level survey of sixteen popular open-source LLM projects further shows that default OOXML ingestion paths concentrate on affected extractor families.

1 Introduction

This paper shows that specification-valid OOXML can cause Office’s review view and LLM-ingestion evidence to diverge. It systematically catalogs and measures these evidence forks across formats, tools, and interfaces.

  • Motivation: OOXML-to-LLM pipelines assume that models receive the same content users review in Microsoft Office, but opaque ingestion can violate this semantic-integrity assumption.The authors frame the ingestion layer as a document supply-chain vulnerability when its evidence differs from the review view.
  • Concept: The paper defines evidence forks as specification-grounded OOXML constructions that make Office and ingestion paths promote different content to task evidence.The stored package remains unchanged; divergence arises during view construction, with each consumer treating its own view as authoritative.
  • Results: 21 evidence forks were confirmed across Word, Excel, and PowerPoint, spanning representation, state, compatibility, visibility, scope, and linearization.The evaluation uses 210 specification-valid Office documents, each containing a task-relevant trap exposed by extraction but not shown in Office.
  • Results: Across 8,400 API trials, models returned the trap in 48–76% of runs, and at least one interface returned it for 20 of 21 mechanisms.The study tested four native-ingestion LLM APIs and seven mainstream web chatbots.
  • Method: The study introduces a specification-guided discovery method that yields a unified cross-format catalog and six-dimensional taxonomy of OOXML view constructions.Candidate constructions are mined from the OOXML specification and organized into a systematic catalog.
  • Implications: Exposure was shaped by ingestion path and extractor configuration, while open-source LLM projects repeatedly depended on affected extractor families.The paper therefore examines both interface behavior and ecosystem-level extractor dependencies.

2 Background

OOXML packages store document content alongside formulas, cached values, formatting, state, relationships, and compatibility data. Office applications resolve these structures differently from partial extraction tools, allowing the same valid file to produce divergent evidence.

  • OOXML Structure: OOXML documents are ZIP-based OPC containers whose typed XML and media parts are connected by relationships.A Word package separates the main story from styles, numbering, settings, metadata, and other supporting parts.
  • Motivation Example: A worksheet cell can store a formula and cached result together: Excel shows 57,299 after recalculation, while a formula-less extractor may expose 92,874.Both representations are valid, but they carry different semantic roles and produce different consumer views.
  • Motivation Example: This formula/cache construction is a representation-level evidence fork because the ingestion contract may not identify which representation becomes model evidence.The file opens normally in Excel without macros or repair, while extraction can deliver the attacker-controlled cache.
  • Office Applications: Microsoft Office recalculates formulas, applies formats and styles, refreshes bindings, resolves compatibility branches, and hides filtered or hidden content when constructing its editing view.The study uses Microsoft Office’s default editing canvas as the human-facing oracle.
  • Extraction Tools: Extraction tools instead partially parse and linearize OOXML for speed, portability, or coverage rather than reproducing an application’s resolution.The panel includes format-specific parsers, converters, and meta-extractors that wrap other tools.
  • Threat Model: The threat model requires specification-valid files that open without repair, display benign content in Office, and do not display the trap in the default editing canvas.Malformed containers, macros, and executable content are excluded from the stated workflow.

3 Workflow

The workflow mines the OOXML specification for candidate constructions, instantiates them as minimal fixtures, and confirms divergences between Microsoft Office’s editing canvas and extraction tools. Confirmed mechanisms are deduplicated, screened, and embedded in realistic documents for evaluation.

  • Specification mining: The workflow converts the OOXML specification into a queryable knowledge base, mines candidate records, instantiates minimal fixtures, tests Office and extraction behavior, then deduplicates and scope-screens passing records.Candidate records capture the construct, document format, specification quote, and hypothesized Office and extractor outputs.
  • Behavioral confirmation: Each candidate becomes an evidence fork only when Office shows BENIGN rather than TRAP and at least one extractor emits TRAP.The Office oracle checks the default editing canvas, while the extraction panel checks whether normalized tool output contains the trap token.
  • Deduplication and scope: 104 duplicate records are removed after 163 candidate fixtures pass the extraction gate, leaving mechanisms whose divergence follows from OOXML-defined state, content roles, or processing rules.The workflow excludes purely visual camouflage and PowerPoint speaker notes from the retained scope.
  • Confirmed catalog: 21 evidence forks are confirmed and organized by the OOXML processing point at which Office and extraction views diverge across six view-construction dimensions.The catalog maps mechanism identifiers to document formats and provides construct-level descriptions of the specification-valid fixtures.
  • Realistic test set: The realistic evaluation set contains 210 specification-valid Office documents: ten samples per mechanism, with benign Office-visible values and extractor-visible attacker traps.The documents are based on TAT-QA financial-report excerpts, pass the Office visibility check, and receive no OpenXmlValidator errors.

4 Measurement

The measurements show that evidence-fork exposure is widespread and structured by extractor reach, ingestion path, and configuration rather than model identity alone.

  • RQ1: Extractor Reachability: 21 evidence forks show sharply bimodal extractor reach: seven mechanisms reach 11–33% of applicable tools, while fourteen reach 67–100%.No mechanism falls between the two bands; low-reach traps lie outside main content, whereas high-reach traps are ordinary content text.
  • RQ1: Extractor Reachability: Broader converters expose more trap-bearing channels, while narrow loaders can appear safer by omitting document semantics.markitdown and Apache Tika expose 17 and 16 mechanisms, respectively, whereas python-docx reads only the vanished-run mechanism M12.
  • RQ2: Propagation into LLM Outputs: Four APIs propagate traps in 48–76% of mechanism-balanced trials, while seven web chatbots range from 52% to 76%.Across 840 matched-clean document–API trials, no response surfaces the absent trap (0/840).
  • RQ2: Propagation into LLM Outputs: 20 of 21 mechanisms are asserted as document facts by at least one interface, and web interfaces collectively expose 20 mechanisms versus 18 for APIs.Broader extractor reach tends to correspond to exposure across more LLM interfaces, but the relationship is observational.
  • RQ3: Model or Ingestion Layer?: Behavioral signatures match 8 of 11 interfaces to at least one tested candidate configuration, establishing probe-level equivalence rather than backend identity.The external Claude check validates a library-level match but not the exact version or invocation.
  • RQ3: Model or Ingestion Layer?: Exposure depends on the complete ingestion configuration, including extractor version, output mode, and arguments, not merely the model or extractor name.The same vendor’s API and web chat can read the same file differently, while model versions on a fixed path can show identical exposure vectors.
  • Open-Source Ingestion Paths: Sixteen surveyed projects concentrate on affected extractor families, including four projects routed through markitdown, which reaches 17 of 21 mechanisms.Spreadsheet defaults generally have broad panel reach, although versions, arguments, and downstream processing can change exposure.

5 Discussion and Limitations

OOXML loaders determine which document view becomes model evidence, making ingestion configuration a security-relevant policy rather than a neutral implementation detail. The paper also shows that broader extraction can reduce semantic fidelity, while reported aggregate rates are not population-level deployment risk estimates.

  • Loader entry points, versions, output modes, and arguments can change exposure, while models sharing one ingestion path can retain the same exposed set.
  • Loader selection and upgrades should be treated as security-relevant policy changes rather than interchangeable implementation details.Shared extractor families recur across otherwise diverse open-source projects, extending the concern beyond individual services.
  • A fixed evidence-fork suite could regression-test evidence-selection behavior and detect ingestion drift without backend access.
  • Recovering more strings can widen the semantic roles flattened into model evidence, so text coverage and semantic fidelity are distinct objectives.Narrow extraction is not a general remedy because omitting document semantics does not restore fidelity to the Office view.
  • Aggregate propagation rates describe a mechanism-balanced evaluation set, not the distribution of documents in deployment or population-level risk.Tool, service, and dependency results reflect pinned or dated configurations and may change as implementations evolve.

6 Conclusion

OOXML-to-LLM pipelines can produce model evidence that diverges from the Office review view. The paper systematizes this divergence as evidence forks and concludes that secure ingestion requires an explicit contract defining the intended evidence.

  • OOXML-to-LLM pipelines can construct model evidence that diverges from the Office view presented for review.
  • The study confirmed 21 specification-grounded evidence-fork mechanisms across Excel, Word, and PowerPoint.
  • Exposure follows ingestion configuration rather than model identity alone, and shared extractor families recur across open-source projects.
  • Secure ingestion needs an explicit contract defining the intended evidence.

Ethical Considerations

The paper identifies users, organizations, providers, maintainers, service users, researchers, and the security community as stakeholders in OOXML-to-LLM workflows. Its evaluation used public TAT-QA excerpts with synthetic traps and did not recruit participants or collect service-user data.

  • The identified stakeholders include OOXML-to-LLM users and organizations, LLM providers, extractor maintainers, service users, researchers, and the security community.
  • The principal benefit is exposing an ingestion risk invisible to document reviewers and supporting defensive testing.
  • Testing followed a pre-specified trial matrix without stress-testing services or intentionally altering shared state.
  • No external participants were recruited and no service-user data were collected; human review was limited to the authors.
  • Realistic fixtures used public TAT-QA excerpts and synthetic traps solely for controlled evaluation.
Loading 2608.25880v1…