Document layout preservation is the practice of keeping a document’s visual structure, its tables, headings, indentation, and the row-and-column relationships between fields, intact when sensitive values are substituted, so an AI model reads the same meaning it would read from the original.
The stakes here are not academic. Samsung temporarily banned generative AI tools on company devices in 2023 after employees leaked sensitive internal data to ChatGPT, and in an enterprise that sensitive data arrives as documents: contracts, statements, forms, scanned pages. When a preprocessing step flattens those documents to strip sensitive values, it quietly destroys the thing the model was supposed to read.
Most people picture a document as the words inside it. A model does not read it that way. When it processes a contract or a financial statement, a large part of what it understands comes from where things sit: which cell lines up under which header, which clause is nested under which section, what the indentation says about precedence. Strip that arrangement away and you have not just hidden the sensitive parts, you have changed what the document means.
Why visual structure is meaning, not decoration
Take a payment schedule. A table with three columns, milestone, due date, and amount, tells the model that each row is one obligation, and that the number on the right belongs to the date in the middle and the event on the left. The relationship lives in the layout. Flatten that table into a paragraph of comma-separated values and the model has to guess which number pairs with which date. Sometimes it guesses wrong. Benchmarks bear this out: on DocVQA, models still fall short precisely on the questions where understanding a document’s structure is crucial.
The same thing happens with hierarchy. A clause indented under “Termination” is governed by that heading. Move it, or drop the indentation, and a model can read it as a standalone term. Indentation is not styling here; it is the document telling you what depends on what.
This is why a naive redaction step so often breaks the work. It treats the page as text with some words blacked out. But the moment you remove a value and leave a gap, you disturb the grid the value was sitting in. The model now reads a table with a hole in it, and a table with a hole in it is a different table. Recovering that grid is a research problem in itself: TableBank exists because identifying the row-and-column structure of tables, especially in scanned images, is hard enough to need dedicated models.
What breaks when document layout is lost
Consider a review task on a renewal contract where the counterparty’s pricing has been blacked out. The reviewer wants the model to flag whether the new terms are worse than last year’s. If the redaction collapsed the pricing table into loose text, the model can no longer line up this year’s figures against last year’s. It will still produce an answer, and the answer will be confident and wrong, because the spatial cue that told it “these two numbers are comparable” is gone.
Financial statements fail the same way. A balance sheet means what it means because assets sit above liabilities and the subtotals roll up in a fixed order. Lose the order and a model can misattribute a figure to the wrong line. The output looks plausible, and it is the kind of error nobody catches until an auditor does. EU AI Act Article 10 sets the expectation in law, requiring data for high-risk AI systems to be relevant, sufficiently representative, and as error-free and complete as possible under documented data-governance practices.
How structure-preserving substitution keeps document layout intact
The alternative separates two things that redaction lumps together: the sensitive value, and the slot it occupies. You can replace the value and keep the slot. A real dollar amount becomes a substitute amount, but it stays in the same cell, under the same header, in the same row. The model sees a complete, coherent table where every relationship it relies on is still present. Only the underlying numbers have changed, and those get restored once the work comes back.
This is the core idea behind moving from PII masking to workflow enablement. Plain masking asks “what can we remove and still feel safe.” Layout preservation asks a better question: what does the model actually need to read, and how do we keep that readable while the real values stay home. Send the model the structure of the work, not the raw values, then reconstruct the result inside your own systems. The privacy side of that balance is now formally cataloged: NIST’s Generative AI Profile lists data privacy and information security among twelve risks it treats as unique to or amplified by generative AI.
A quick test for your own documents
Before you send a redacted document to a model, run it through this short check. If you answer “no” to any item, the layout is likely doing work that your preprocessing step is about to break.
- Do the tables still have every row and column they started with, including the ones with substituted values?
- Does each figure still sit under its correct header and in its correct row?
- Is the section and clause nesting (what is indented under what) unchanged?
- Can a person read the document and tell it apart from the original only by the swapped values, not by a broken shape?
- When the result comes back, can you restore the real values into the exact slots they came from?
Where it fits
Layout preservation is one piece of a larger boundary. The mechanics follow a simple loop: substitute the sensitive values, let the model execute on the structure, then reconstruct the real result locally. In CUBIG’s stack that work is done by a context-preserving data layer, in CUBIG’s case LLM Capsule, which performs the substitution so the document’s shape survives the trip to the model and rebuilds the original values when the result returns.
When a document is not plain text but a mix of tables, scanned pages, and images, the same principle has to hold across all of them, which is the subject of the multimodal AI data boundary. And it is a building block of sensitive AI workflow enablement, the practice of running AI on confidential data without that data leaving your environment. All of this runs on the CUBIG Syntitan platform.
This is what LLM Capsule does in practice. It substitutes the sensitive values while the tables, headers, and nesting stay exactly where they were, so the model reads the real structure and the originals never leave your environment.
