A redacted PDF can still carry the original text as an attachment

That result exposes a practical gap in a redaction check: searching the page answers a page question. It cannot establish that the same information has disappeared from the rest of the delivered file. Our controlled test used one harmless identifier in three places, then compared an opaque rectangle, applied redaction and applied redaction with explicit cleanup.

The three exported pages looked the same. Their contents were different.

Three places for the same demonstration reference

On 7 October 2026, we created a one-page, text-based PDF with ReportLab 4.4.9. The page displayed PUBLIC-DEMO-CUSTOMER-48271 under a customer-reference label. This is conspicuous synthetic data, not a customer record. We also put that exact reference into the PDF's Subject metadata and an embedded file called original-note.txt. Those extra copies were deliberate positive controls, so we could tell whether each operation reached them.

We used PyMuPDF 1.28.2 on Python 3.12.14 for Windows to create three exports. The first drew a black rectangle over the reference. The second added a redaction annotation and applied it. The third applied the same redaction, cleared the ordinary metadata dictionary, deleted XML metadata and removed the embedded file. Every export was written to a new filename with garbage=4 and deflate=True; none used an incremental save.

Fresh readers then examined each saved file. We extracted page text with both PyMuPDF and pypdf 6.10.0, read the Subject field and retrieved the embedded attachment's contents. Both extraction libraries agreed on all four page results, including the untouched original. Eight assertions checked that agreement and the expected three-location outcomes.

The rectangle left the reference recoverable from the page. Applied redaction removed it from both libraries' extracted page text, while the metadata and attachment still exposed it. Only the export with explicit cleanup lacked the reference in all three checked locations.

We rendered and inspected all four pages as well. Each modified version showed a solid black bar in the reference's place, with the surrounding page intact. That visual agreement is useful evidence about layout. It cannot distinguish the three disclosure outcomes.

The attachment is outside the redaction rectangle

The redaction-only result is not evidence that PyMuPDF failed to remove the selected page text. Its documentation describes apply_redactions as removing overlapping text from the page, subject to suitable garbage collection when saving. That is exactly the page result we observed. The embedded original-note.txt was a separate object, not text inside the marked rectangle.

This distinction matters when the recipient receives an entire PDF rather than a picture of one page. A source spreadsheet, an earlier draft or a note can carry the information you removed from the visible document. Our fixture demonstrates that possibility with a deliberately planted text attachment; it does not establish how often real documents contain such copies.

Adobe's current Acrobat Pro instructions also separate applying redactions from a choice to sanitize and remove hidden information. In the documented workflow, Apply is followed by that cleanup choice before saving. We checked those instructions, but did not test Acrobat's interface. Our measured results belong to the named Python libraries and our own files.

A copying restriction is a separate operation again. Our earlier PDF permissions test recovered text from an AES-256 file that opened freely despite having copying disabled. That experiment concerned access and application-enforced permissions. This one concerns whether a release copy still contains particular information. A disabled copy menu supplies no evidence about either the Subject field or an attached original.

Inspect the saved copy you are about to send

Start with an approved copy of the document and identify the information that must be removed. In the real redaction tool, mark and apply the removals; drawing shapes with a markup tool is a different operation. Review the resulting pages for both surviving sensitive content and accidental removal of text the recipient needs.

Then examine the document beyond its page text. Look at document properties, comments, layers and attachments, using the tool's hidden-information or sanitization controls where appropriate. Decide which embedded files the release actually needs. If a source attachment must remain, review its contents as a separate release item rather than assuming the page's rectangle covers it.

Save the release as a new file, close it and reopen that exact output. Search for known words, try selecting and copying around the redacted region, and inspect properties and attachments again. A positive match is a reason to investigate. An empty search result is only evidence about the search you performed.

For an ordinary text-based PDF, the following PyMuPDF check can help make three of those observations explicit. It prints extracted page text, the metadata dictionary and attachment names. It does not remove anything, open the attached files for you or certify a PDF as safe.

import pymupdf

with pymupdf.open("release-copy.pdf") as doc:
    for number, page in enumerate(doc, 1):
        print("PAGE", number)
        print(page.get_text())
    print("METADATA", doc.metadata)
    print("ATTACHMENTS", doc.embfile_names())

The attachment list is a prompt to inspect each retained file with the appropriate software. Searching the page cannot search an attached spreadsheet on your behalf. Keep real confidential documents in a trusted environment; there is no need to upload them to an unfamiliar online checker for this exercise.

Invisible content can survive in other formats too. In our transparent PNG test, making pixels invisible left their underlying color values in the delivered image. If an illustration containing private information is included in your PDF, check how that image was actually prepared. The analogy identifies another place to inspect; our present fixture contains no raster images or OCR layer.

What this test cannot clear for release

This was a small, text-only fixture. We did not test scanned pages, invisible OCR text, optional-content layers, comments, forms, signatures, encrypted documents or earlier revisions left by incremental updates. The cleanup variant removed the copies we planted and checked. It is not an exhaustive sanitization recipe for arbitrary PDFs.

Even a file with no extractable secret can reveal more than expected through context. The 2022 research paper Story Beyond the Eye: Glyph Positions Break PDF Text Redaction demonstrated inference attacks using the positions of surrounding glyphs. Our two extraction checks do not assess that problem, and our synthetic identifier does not model it. Where inference from surrounding text is a concern, the release review must also consider how much context remains.

The same care applies before deleting attachments wholesale. Some PDFs need them for the recipient's task, and document workflows may depend on signatures or other structures. Use the relevant release policy and a tool suited to that document. Removing every object in a tiny fixture says nothing about preserving a complex signed record correctly.

Encryption may control who can open a file without removing its contents. Our encrypted ZIP filename experiment shows another limit of treating protection as a single setting: encrypted contents and a hidden file list are separate requirements. For this PDF, the useful release question is equally specific: where can the removed information still be recovered in the copy the recipient will receive?

In our test, the page passed a text check while the embedded note still contained the reference. The file needed another operation and another check. Reopening the exact release copy and examining those separate locations caught a disclosure that the identical-looking black bars could not show.