There are roughly seven ways to hide text in a PDF, and every one of them is legal as far as the format is concerned. Substitution via /ActualText and /Alt: in a tagged PDF these fields declare the 'real' text in place of the painted glyphs, and extractors take them at face value. Invisible render mode 3: the glyphs exist but carry no paint. White text on a white background. Type smaller than one point – technically present, physically unreadable. Placement outside the page box. A layer (OCG) that is off by default. And text sitting underneath an opaque image.
The practical risk grew alongside automated document processing. Résumés and proposals are read by ATS systems, invoices and contracts by parsers, and increasingly by language models. A hidden layer is aimed squarely at the machine, and it becomes an instruction nobody reviewed by eye. When you hand a third-party PDF to a model, you hand over its invisible half too.
The right order is inspect first, clean second. A scan reports the finding type, the page, the extracted text, and a confidence level without modifying the file. Bear in mind that not every hit is malicious: the text layer of an ordinary scan is technically 'invisible text' as well, which is why those hits are flagged at low confidence. Once the picture is clear, a separate cleaning tool removes what should not be there.