Prompt injection in eDiscovery AI — Relativity, DISCO, Everlaw, and the adversarial opposing-party document risk

Four multimodal injection surfaces in eDiscovery AI

1. Opposing-party produced scanned documents with adversarial OCR overlays. When opposing counsel produces a document set in response to a discovery request, the production set routinely includes scanned physical documents: printed emails, fax transmissions, physical correspondence, executed contract originals, and paper exhibits that have been digitised at the producing party’s direction. The producing party controls these document images before they are delivered to the receiving party’s counsel and loaded into the eDiscovery review platform. An adversarially crafted scanned document contains invisible typographic injection text — embedded at low opacity or in a colour channel imperceptible to human reviewers but detectable by the VLM performing AI-assisted coding — that instructs the AI to classify the document as non-responsive or as outside the privilege waiver scope. Because the producing party controls the physical document scanning process, they control the image content of every scanned page in the production set. This is not a hypothetical attack requiring sophisticated technical resources: it requires only that the producing party add an adversarial layer to the document image before scanning, a process that can be automated across an entire production set. The receiving party’s counsel loads the production set into Relativity or DISCO, runs AI-assisted first-pass coding, and receives privilege and responsiveness designations that have been influenced by the producing party before a single human reviewer examines the document. Text-only prompt injection scanners do not detect this class of attack; the payload is in the image pixel layer, invisible to OCR text extraction.

2. AI-assisted privilege review manipulation via watermark and letterhead injection. Law firm letterhead and company watermarks appear as image elements on a large proportion of produced documents: engagement letters, advice memoranda, executed agreements, and formal correspondence. These image elements are present on documents that are otherwise highly sensitive for privilege review — a legal opinion letter on firm letterhead is exactly the category of document most likely to be reviewed by AI privilege classification. An adversarial payload embedded in the law firm letterhead graphic or the company watermark on a produced document can cause the VLM performing AI-assisted privilege review to misclassify the document: marking a genuinely privileged communication as non-privileged (expanding the producing party’s disclosure obligations) or, more strategically, marking a non-privileged document as privileged (withholding it from production). Privilege determinations made by AI review platforms carry significant legal weight in large-scale litigation — a privilege log generated by AI-assisted review is regularly used as a basis for clawback assertions and contested privilege challenges. Adversarial manipulation of privilege AI through letterhead pixel payloads is invisible to the human privilege reviewer examining the document; they see the letterhead as expected and have no signal that the AI’s coding decision was influenced by a pixel-level payload in the image element.

3. Third-party data room documents in M&A due diligence eDiscovery. M&A transactions increasingly use AI-assisted due diligence platforms — Kira, Luminance, and eDiscovery tools adapted for deal review — to analyse the target company’s document production in a virtual data room. The target company (seller) loads the data room documents and therefore controls the content of every document before the buyer’s counsel accesses the data room. The seller has a direct financial incentive to influence what risks and liabilities the buyer’s AI due diligence analysis extracts from the data room. Adversarial payloads in scanned exhibits, PDF appendices, and image-heavy diligence documents — board presentations in image format, scanned regulatory filings, photo-scanned executed agreements — can cause the due diligence AI to underreport identified contractual risks, omit flagged litigation exposure, or generate more favourable summaries of regulatory compliance status than the document content warrants. Unlike litigation document review where a human reviewing team examines a statistically significant sample of AI-coded documents, M&A due diligence AI review is often run on tight deal timelines with compressed human review capacity; the AI output carries proportionally more weight in the buyer’s risk assessment. Adversarial manipulation of due diligence AI through document image payloads targets the highest-stakes document review context in transactional practice.

4. Expert witness image exhibits and demonstrative evidence. Expert witnesses in technical and scientific litigation submit PDF exhibits containing charts, diagrams, schematic images, and demonstrative figures as part of their expert reports. Opposing expert witnesses — whose exhibits will be reviewed by the receiving party’s AI-assisted document review platform — control the content of every diagram and chart image in their submitted PDF exhibits before those exhibits enter the opposing party’s review platform. An adversarial payload embedded in a technical diagram or graph image in an expert exhibit can cause the AI reviewing that exhibit to generate a summary, extract findings, or classify the exhibit content in ways that misrepresent what the chart or diagram actually shows. In technical patent litigation, product liability cases, and regulatory enforcement actions, expert exhibit AI review is used to rapidly classify and summarise large volumes of technical evidence; adversarial manipulation of the AI’s reading of a key technical diagram in an expert report is an attack on the evidentiary record itself. The Glyphward pre-scan applied to every page image extracted from produced expert PDFs detects adversarial payloads in diagram and chart images before they reach the AI review layer.

Integration: eDiscovery document ingestion with Glyphward pre-scan

import base64
import hashlib
import io
import requests
from datetime import datetime, timezone

import fitz  # PyMuPDF

GLYPHWARD_KEY = "<your-glyphward-api-key>"
GLYPHWARD_THRESHOLD = 65


def scan_produced_document(
    pdf_bytes: bytes,
    bates_number: str,
    producing_party: str,
    matter_id: str,
) -> dict:
    """
    Scan all page images extracted from a produced document PDF before the
    document enters the eDiscovery AI review platform (Relativity, DISCO,
    Everlaw, etc.).

    Returns a per-document audit log entry linking each page scan_id to the
    document Bates number. Raises on adversarial detection so the document
    is quarantined before ingestion.
    """
    doc = fitz.open(stream=pdf_bytes, filetype="pdf")
    doc_hash = hashlib.sha256(pdf_bytes).hexdigest()

    audit_entry = {
        "bates_number": bates_number,
        "producing_party": producing_party,
        "matter_id": matter_id,
        "document_sha256": doc_hash,
        "page_count": len(doc),
        "scanned_at": datetime.now(timezone.utc).isoformat(),
        "pages": [],
        "document_status": "clean_passed",
    }

    for page_index, page in enumerate(doc):
        # Render page to a PNG image at 150 DPI — sufficient for adversarial detection
        pix = page.get_pixmap(dpi=150)
        page_bytes = pix.tobytes("png")
        encoded = base64.b64encode(page_bytes).decode()
        page_hash = hashlib.sha256(page_bytes).hexdigest()

        scan_resp = requests.post(
            "https://glyphward.com/v1/scan",
            headers={"Authorization": f"Bearer {GLYPHWARD_KEY}"},
            json={"image": encoded},
            timeout=8,
        )

        page_record = {
            "page_number": page_index + 1,
            "page_sha256": page_hash,
            "scan_id": None,
            "scan_score": None,
            "page_status": None,
        }

        if scan_resp.status_code != 200:
            # Fail-closed: scan unavailability -> quarantine document, do not ingest
            page_record["page_status"] = "scan_error_quarantined"
            audit_entry["pages"].append(page_record)
            audit_entry["document_status"] = "quarantined_scan_error"
            persist_ediscovery_audit(audit_entry)
            raise RuntimeError(
                f"Glyphward scan unavailable — document {bates_number} page "
                f"{page_index + 1} quarantined; do not ingest into review platform"
            )

        scan = scan_resp.json()
        page_record["scan_id"] = scan["scan_id"]
        page_record["scan_score"] = scan["score"]

        if scan["score"] >= GLYPHWARD_THRESHOLD:
            page_record["page_status"] = "adversarial_blocked"
            audit_entry["pages"].append(page_record)
            audit_entry["document_status"] = "adversarial_blocked"
            persist_ediscovery_audit(audit_entry)
            # Flag for litigation hold and notify review supervisor
            trigger_ediscovery_alert(
                bates_number=bates_number,
                producing_party=producing_party,
                matter_id=matter_id,
                page_number=page_index + 1,
                scan_id=scan["scan_id"],
                score=scan["score"],
            )
            raise ValueError(
                f"Adversarial payload detected in produced document {bates_number} "
                f"page {page_index + 1}: producing_party={producing_party} "
                f"score={scan['score']} scan_id={scan['scan_id']} — "
                f"document quarantined; do not ingest"
            )

        page_record["page_status"] = "clean_passed"
        audit_entry["pages"].append(page_record)

    doc.close()
    persist_ediscovery_audit(audit_entry)
    return audit_entry


def persist_ediscovery_audit(entry: dict):
    # Write to append-only audit table; link scan_id to Bates number for
    # chain-of-custody records and potential motion practice evidence
    pass


def trigger_ediscovery_alert(
    bates_number: str,
    producing_party: str,
    matter_id: str,
    page_number: int,
    scan_id: str,
    score: float,
):
    # Notify review supervisor and outside counsel; consider sanctions motion
    pass

Persist every audit_entry to an append-only audit table, linking each page’s scan_id to its Bates number. This creates a chain-of-custody record establishing that every produced document was adversarial-content-checked before it entered the AI review layer — an important record if adversarial manipulation is later alleged in motion practice or sanctions proceedings. For Relativity deployments, integrate the pre-scan gate into the document ingestion processing set before the AI-assisted coding job runs. For DISCO and Everlaw, apply the scan at the bulk upload step using the platform’s pre-processing API hooks. Get early access

Coverage matrix

Related questions

Further reading

• Prompt injection scanner for legal AI — broad coverage of adversarial document risks across contract review, eDiscovery, and M&A due diligence
• PDF prompt injection detection — how adversarial payloads are embedded in PDF image pages and how to scan them
• OWASP LLM01 Prompt Injection — multimodal dimension — the base injection mechanism as it applies to document image pipelines
• Unstructured.io prompt injection detection — adversarial document image risks in Unstructured.io document parsing pipelines
• Glyphward API free tier — scan produced document images today at no cost, 10 scans per day with no card required