A permitting pipeline must reduce injection risk from uploaded PDFs before Claude reads them. Which mitigation fits?

Stripping steganographic instruction attempts from PDFs before Claude sees them reduces injection risk in permitting pipelines. That mitigation works because uploaded plans and supporting documents can carry hidden text, metadata, or obfuscated instruction payloads aimed at the model rather than at human plan reviewers. Sanitizing documents keeps Claude focused on permit-relevant content under city policy instead of attacker-supplied directives.

Scanning uploaded PDFs for malware signatures before passing content to Claude fails because it targets known malicious files rather than hidden instruction payloads or steganographic prompts; it does not stop attacker-supplied directives from reaching Claude's context.

Encrypting stored PDFs at rest and decrypting during Claude retrieval fails because it protects data confidentiality in storage, not model input safety; hidden instructions still reach Claude after decryption.

Logging PDF metadata and access events for post-processing audit review fails because it is detective and after the fact; it does not sanitize uploads before Claude ingestion and therefore does not reduce injection risk.

Exam caveat: stripping hidden instructions reduces one class of risk; malicious but readable "please ignore zoning" prose may still appear as ordinary text and needs policy and reviewer controls. Operational check: run PDF sanitization (metadata scrub, hidden-text detection, allowlisted extractors) before Claude ingestion, quarantine failed cleans, and sample extracts for residual instruction-like content in the permitting queue.