We audited 72 "redacted" PDFs. 17% still leak text — and 31% of federal ones do.

Essex Software research · 2026-06-07 · updated 2026-06-08

PDF redaction has been a solved problem for two decades. Acrobat has a true-removal redact tool. So does every serious legal-tech vendor. So does the open-source MuPDF stack we used for this study. And yet, in 2019 Paul Manafort's sealed court filing leaked because someone drew black rectangles instead of redacting. In 2021 the EU Commission's AstraZeneca contract leaked because someone left the document bookmarks intact. The pattern keeps happening because looking redacted and being redacted are two different things — and almost nobody verifies the difference.

The headline numbers

What "leaked" actually means here

We bucketed findings into three severities. Critical is "selectable text is physically present under a visible opaque rectangle, and an attacker can recover it by selecting and copying." Warning is "identifying metadata that the redactor probably didn't realize was there" — author name in the /Info dictionary, software trail in the Producer field, full XMP metadata streams, bookmark titles that quote the redacted section. Info is "structural features that could carry data but rarely do in the wild" — optional content groups, AcroForm field placeholders.

The critical leaks are concentrated at federal agencies

Splitting the 63 audited documents by publisher category, the rate of "selectable text under a redaction rectangle" leaks is sharply uneven:

The sample is too small to make confident inferences below ~25 documents per category, but the federal-agency numbers are large enough to flag. Nearly one in three US federal agency documents in our sample had text physically recoverable under the visible redaction rectangles. The federal-leak set spanned the FTC (three separate complaints), DOJ (Office of the Inspector General, Antitrust Division, and Civil settlements), DNI, and one EPA action memo. Court filings (US and international) fared notably better.

Why this keeps happening

A PDF isn't a flat image. It's a structured document with separate layers for text content, graphics, fonts, annotations, metadata, and outlines. When a user draws an opaque rectangle in Preview, Acrobat's annotation tool, or any markup app, that rectangle goes on top — the text layer is untouched. Anyone who opens the file can select the redacted region, copy it, and paste readable text.

The fix is straightforward in theory: every modern PDF library has a "true redaction" operation that physically deletes the text from the content stream. The barrier is mostly that:

• The true redaction tool in Acrobat is in a different menu from the annotation tool, and the icons look similar enough that the wrong one gets used.
• Many free PDF tools advertise "redaction" but only draw a black rectangle.
• Cheap third-party SaaS redactors do the same overlay trick, then upload to a server, which compounds the privacy problem.
• Most workflows ship the PDF straight out without verifying. No "did the redaction actually work?" check happens.

The metadata leaks are even simpler — the redactor stripped the body but forgot the document properties dialog. Title, Author, Subject, and Keywords frequently survive because they're a separate dictionary the editing tool doesn't touch.

The pattern across the eleven critical leaks

Across the 11 documents with text recoverable under redaction rectangles, we found that:

• The leaks cluster on a small number of documents. Four of the eleven had 5 or more independent rectangle-text leaks; one had 8, another had 7, another had 6. The other seven had 1–2 each. Multi-page filings that messed up redaction usually messed it up many times.
• The Producer field consistently exposed the software stack. Every document in the critical-leak set named the PDF generator — usually a specific Acrobat or alternative library version. Useful for an attacker fingerprinting the upstream workflow.
• XMP metadata was almost universal. 89% of all audited documents carry an XMP stream. Of those, many include identifying strings well beyond what Acrobat's "Document Properties" dialog displays.
• Bookmark titles repeatedly quoted redacted section headings. 35% of audited docs had a non-empty document outline. The outline survives even when the body text is genuinely redacted, and bookmark titles often summarize the very content the redactor was trying to hide.

We aren't naming any of the eleven documents. The point of the study isn't to embarrass specific publishers — it's to make clear that the failure rate, on a population of documents whose publishers explicitly believed they had redacted them, is meaningfully nonzero across every category we sampled with enough volume to measure.

How to actually redact

If you're producing redacted PDFs and you're not 100% sure your tool is doing content-stream removal vs. drawing rectangles, three things to do right now:

1. Test the basic case. Open your "redacted" output, hit Cmd-A / Ctrl-A to select all, copy, and paste into a plain text editor. If you see the text you thought you redacted, your tool failed.
2. Strip metadata as a separate step. Even with a true content-stream redaction, the /Info dictionary and XMP stream survive unless you explicitly clear them. A metadata scrub takes seconds.
3. Flatten through a "print to PDF" pass for high-stakes documents. If you're publishing a redacted court filing, FOIA release, or regulatory disclosure, the safest belt-and-suspenders is a rasterize-and-re-OCR pass that destroys any latent text layer. Some legal-tech tooling does this automatically; most consumer PDF tools don't.