Text below readable size
Text set at a font size too small for a person to read at any zoom, while the characters remain in the document.
How the text is hidden
A font-size declaration resolves to a length, the length is converted to points, and the point size is compared against the published sub-readable threshold. The unit table beneath that comparison is where this technique actually lives: px, pt, pc, in, cm, mm, q, em and rem are read as absolute lengths, and %, vw, vh, vmin and vmax are resolved on font-size specifically, because the same token means something different on width.
Why a model still reads it
Size is a rendering property. The glyphs are laid out and painted; a text extractor returns the characters with no size attached, so a model reads a sentence a reviewer sees as a smudge or nothing at all.
What we do about it
reasonFor converts the resolved pixel size to points and returns sub-readable when it is at or below limits.subReadableMaxFontSizePt, read from the rule pack — the comparison is in points and the threshold is never a literal in this file, after a divergence that once had HTML comparing pixels against a literal while every other format applied the published threshold, so HTML returned text as clean and certified that another format called hostile.
How often it fires
0.75% of 400 real pages from 400 distinct hosts (Common Crawl) — pages, not documents, measured 2026-08-21.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A phishing campaign hid a block of text in an invoice email telling the recipient's AI summariser to add a fake priority action changing vendor payment details; Barracuda names four ways such instructions are hidden — HTML comments, CSS-invisible text, Base64 inside an image data string, and zero-width characters — but does not say which one this email used.
In a lab test, an email carried instructions in HTML styled font-size:0px, white and zero line height — invisible to the reader in Outlook — and a summarizer running Claude Haiku 4.5 reported EUR 46,200 and a 3 September date in place of the real 21 August deadline in all ten runs.
Over a million phishing emails padded their HTML with filler text hidden three ways at once — zero font size, a container with zero height and width, and overflow pushed off-screen — so filters reading the markup saw harmless words while the reader saw the lure.
Twenty-two distinct payload techniques found on real malicious sites — zero font size, elements pushed 9,999 pixels off screen, display:none, attribute cloaking and prompts tucked inside SVG — aimed at everything from ad-review evasion to forced transactions. The SVG case reached us as `clean` until engine 0.263.0.
A web page posing as an Oracle ERP integration guide carried the attack in 1-point font, and Gemini running inside Google’s Antigravity editor collected AWS credentials and private code from the developer’s workspace and sent them to an attacker’s endpoint.
An email hid instructions in tiny fonts, white-on-white text and layout tricks, and ChatGPT’s Deep Research agent obeyed them, sending personal information from the inbox to an attacker’s server from OpenAI’s own infrastructure rather than the user’s machine.
An email hid an instruction inside a zero-size white span, and Gemini's "summarise this email" obediently appended a fabricated Google security warning telling the reader to call an attacker's phone number.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API