'Noroboto' Font-Lying Attack Deceives LLM Automated Contract Review

Security researchers have demonstrated a highly novel class of "lexploit" named Noroboto, which exploits the way automated legal-tech pipelines parse document files to trick AI agents while leaving the visual rendering unchanged for human readers. The attack works by embedding a custom, malicious TrueType font (noroboto.ttf) into Word (.docx) or PDF documents. The font manipulates the character map (cmap) to map visually correct glyph outlines to completely different, deceptive Unicode code points or Private Use Areas (PUAs).

In a "Replacement" attack, the researchers caused the human-visible word "Maryland" to render perfectly on screen and in print, while mapping the underlying Unicode values to spell "Delaware". Because automated legal-review agents are "lazy" and parse raw Unicode text rather than executing expensive rasterization and Optical Character Recognition (OCR), every AI platform tested was fooled. As the Tritium Red Team notes: "The Red Team hypothesizes that the agentic harnesses are 'lazy' and prefer to rely on a facially valid Unicode string rather than undertake to render the document and run an expensive OCR computation."

The threat model sparked a heated debate on Hacker News. Skeptics like echoangle questioned the real-world utility of the attack, noting that using it in court would lead to immediate sanctions. However, proponents point out that the attack targets the pre-signature review stage. If a law firm relies on an LLM to review a 100-page contract, the LLM will report that the governing law is Delaware (as desired), but the human will sign a printed page that actually specifies Maryland. As SolarNet summarizes: "The attack is on getting your legal LLM to hallucinate specific things of what you are signing. I doubt a judge will look favorable on people saying 'but my LLM said it was 1k'... cause they are known to hallucinate."

To mitigate this, the researchers published a proof-of-concept tool in Rust. The mitigation isolates the embedded font, renders its alphanumeric ASCII glyphs into a pristine font atlas, runs OCR on the atlas, and calculates the Levenshtein distance to verify that the font's visual outlines match its purported Unicode cmap definitions.