ocr

The instinct is to blame the vision encoder. It is a token-budget problem, and the fix is to retrieve pages before you look at them. What separates a strong answer is knowing which question types page retrieval quietly cannot answer.

Most RAG projects do not die at the retriever, they die at ingestion. Naive PDF extraction interleaves columns into nonsense, shreds tables, and stamps the footer into all 4,000 chunks. Here is the parser that survives real documents.

Document extraction (IDP) is a massive enterprise use case with a steep correctness bar: a wrong extracted number beats having none. The signal is the parse, extract, validate, human-review pipeline plus confidence-based routing. Here is the design.

Your guardrail reads text. The attack is not in the text. That single sentence is the whole vulnerability, and the red team you build from it looks nothing like the one you already have.