Visual sensitive data is confidential information that lives inside an image or a scanned PDF rather than in machine-readable text: the part numbers annotated on an engineering drawing, the names and figures on a signed contract someone scanned back in, the handwriting on an intake form. It is the material a plain-text pipeline never sees, because there is no text to see, only pixels arranged to look like text.
The scale of the blind spot is not small. Even privacy law is written for text: HIPAA recognizes exactly two de-identification paths, Expert Determination and Safe Harbor, and Safe Harbor works by removing 18 specified identifiers, a mechanism that only helps when the identifiers exist as characters a pipeline can find. Turning those pages into characters is itself lossy: the Donut researchers note that OCR errors propagate downstream and degrade every step that depends on the extracted text. Much of what an enterprise actually holds was never typed into a field. It was scanned, photographed, or drawn. When a team plans for sensitive data, they picture a name in a database column or a figure in a spreadsheet cell. Meanwhile the contract that actually governs the deal is a PDF someone signed and scanned, and the specification that carries the real intellectual property is a drawing with tolerances written in the margins. To a text pipeline those pages read as empty. They are anything but.
Why plain-text handling misses visual sensitive data
A text-based approach works by scanning for character spans and substituting them. Feed it a scanned contract and it finds nothing to substitute, because there are no characters, only an image of them. The page passes straight through. From the pipeline’s point of view the document is clean and ready to send. In reality the most sensitive thing in the building has just left as a picture, and nothing flagged it.
This is the quiet failure mode that makes it dangerous. It does not throw an error or raise a warning; the system did exactly what it was told, which was to look for text. A scanned PDF of a signed agreement, dense with names, prices, and terms, goes to a model verbatim because the scanner looked for characters and saw an image instead. The gap stays invisible right up until the moment it costs something.
Plain masking has the same limitation from a different angle. Even where masking does fire on extracted text, it deletes or blacks out the value and leaves a hole, which is why people reach for it as a safety measure and then find the document no longer works. Neither approach was built for a page where the sensitive content and the structure that gives it meaning are fused into one raster surface.
Where visual sensitive data hides in the enterprise
It turns up in more places than most teams expect, and the pattern is consistent: wherever the authoritative version of a record is a physical artifact, the sensitive content ends up inside an image. Engineering and manufacturing run on drawings whose annotations carry the real value, including tolerances, materials, and supplier part numbers. Legal and finance archives fill up with scanned originals, because the version that counts is the one that was physically signed and stamped. Operations teams photograph forms, meter readings, and handwritten logs as the fastest way to capture what happened on the floor.
Structure matters here as much as the values do. An annotation on a drawing means something because of where it points; a figure on a scanned invoice belongs to the line it sits on. Strip the layout and you inherit the same problem covered in document layout preservation: the arrangement was carrying meaning, and flattening it destroys the meaning along with any privacy you were trying to add. Real confidential business context lives in the relationship between a value and its position, not in the value alone.
How a structure-preserving boundary handles it
The handling principle is the one that runs through this whole approach, applied to a harder surface. Locate the sensitive text inside the image or scanned page, substitute it in place with a stand-in, and leave everything around it, the drawing, the form fields, the layout of the contract, exactly where it was. The model then receives a page that still reads as the document it is, with the confidential values swapped out. When the result comes back, the originals are reconstructed inside your environment, so the workflow closes on real data even though the model never touched it. The approach also lines up with GDPR Article 32, which requires technical and organizational measures appropriate to the risk and names pseudonymization explicitly, alongside the ability to restore access and to test the measures regularly.
Put plainly: send the model the structure of the work, not the raw values, then rebuild the result locally. The rule has to hold for pixels as firmly as it holds for a database row, which is the demanding part. Detecting a name in a text field is one problem; finding the same name handwritten at an angle on a scanned form, substituting it, and keeping the form legible is a different order of difficulty. That cross-format consistency is the job of a Context-Preserving Data Layer for AI, in CUBIG’s case LLM Capsule, which runs on the CUBIG Syntitan platform.
A quick self-diagnostic
Run this test on your own document pipeline before you trust it with a scanned archive. If you answer no to more than one of these, visual sensitive data is probably slipping through:
- If you drop a scanned, image-only PDF into your redaction or masking step, does anything actually get detected, or does the page pass as clean?
- Can your pipeline find sensitive text that is handwritten or set at an angle, not just clean typed characters?
- After handling, does the drawing, form, or contract still read as the same document, with layout intact?
- When the model returns a result, are the real values reconstructed inside your environment rather than left as stand-ins?
- Does the same boundary cover images and scanned pages, or only the plain-text parts of a mixed document?
Text versus visual sensitive data at the boundary
The contrast below shows why a boundary built only for text leaves the riskiest material exposed, and what a structure-preserving boundary does differently.
| At the boundary | Plain-text handling | Structure-preserving boundary |
|---|---|---|
| Scanned, image-only PDF | No | Yes |
| Handwriting and angled text | No | Yes |
| Keeps layout and position | Partial | Yes |
| Document still usable after | Partial | Yes |
| Real values reconstructed locally | No | Yes |
The point is not that text handling is wrong; it works well on text. The point is that a scanned archive is mostly not text, so a boundary that stops at characters covers the easy half and misses the confidential half.
Where visual sensitive data fits
Visual sensitive data is one face of the broader multimodal AI data boundary, which holds the same principle across every format in a mixed document, from a table to an embedded chart to a scanned attachment. Together they extend sensitive AI workflow enablement to the documents your teams actually scan, photograph, and draw, rather than only the ones they type. The goal throughout is the same: let people run confidential work through an AI model in place, reconstruct the result locally, and close the workflow on real data without the raw values ever leaving the boundary.
LLM Capsule extends the same boundary to what a model sees, not only what it reads. The visual structure reaches the model while the sensitive content in the image stays inside your environment.
