In January 2019, Paul Manafort's lawyers filed a document with a US federal court. The sensitive passages were blacked out. Within hours journalists had simply read them: the text was still under the black bars and could be selected and pasted.
That was not a careless lawyer or broken software. It was a misunderstanding about how a PDF is built, and that misunderstanding turns up daily among people who are actively trying to be careful.
A PDF is made of layers
A PDF is not a picture of a page. It is a set of instructions: draw this character here, this line there, this image at that position.
Two things sit in it simultaneously:
- The text layer. Which characters exist, in which font, at which coordinates. This is what you select when you drag your mouse across the page, and it is what search engines and AI tools extract.
- The drawing layer. Shapes, lines, images, boxes. Everything drawn.
Draw a black rectangle over a name in a PDF reader and you have added something to the drawing layer. Nothing was removed. The name sits exactly where it sat, still selectable.
What you did was make the text invisible to the eye. Not to the machine.
The same mistake in other clothes
The pattern repeats in every tool people actually use:
- Black highlighter in Word. Highlighting is formatting. The text remains. Strip the formatting or copy it out and the content is back.
- White text on a white background. Invisible, entirely present.
- Pasting an image over the text. The image sits above, the text below.
- Hiding columns in a spreadsheet. Hidden is not gone. One click restores them.
- A shape over content on a slide. Same story, and it exports to PDF intact.
What these share: the action feels final because the result looks final.
Why this lands harder with AI tools
With a document you email to a colleague, someone has to deliberately select and paste to find the mistake. That rarely happens.
With an AI tool it happens automatically. The tool extracts the text layer in order to summarise or search it. To the extraction process, the black rectangle is a shape to be ignored. The name underneath comes through in full.
And you will not notice, because the answer probably does not mention the name. You asked for a summary, not for names. What you sent is not visible in what you got back. See also what happens when you upload a PDF to a chatbot.
What does work
Three steps, in this order.
Use a real redaction function. PDF editors have a dedicated function that removes the underlying content rather than covering it. Look for "redact", not for the drawing tools.
Flatten the document afterwards. Many editors have a separate step that rebuilds the file without its editing history. Without it, a previous version can sometimes be recovered.
Verify the result. The step everyone skips and the one that decides the outcome. Open the file, select all, copy, paste into an empty text editor. What appears is what the document actually contains. Then search that output for a name or number that should have gone.
Thirty seconds, and it is the only way to know you are not looking at a picture of safety.
There is one more layer no redaction function shows you: the data that is not on the page but is in the file. See what stays in a PDF after you remove the text.
