Do Arbitrators and Their AI Read the Same Record? Poisoned Fonts, Prompt Injections, and the Arbitral Record

The current debate on artificial intelligence (“AI”) risks in international arbitration has focused mostly on the good-faith use of AI and its human, technical and legal limitations. Much of that debate has concerned well-explored topics such as confidentiality or award enforceability. The rising threat of adversarial techniques by a bad-faith actor in the proceedings remains comparatively underexplored.

On Distinguishing Adjudicative and Ancillary AI Use

There is a trend to distinguish between high-risk adjudicative (or adjudicative-adjacent) AI use and lower-risk administrative or “ancillary” AI use. The Ciarb Guideline on the Use of AI in Arbitration explicitly states that “using an AI Tool to search for evidence on an issue within the case documents submitted by parties carries a different (and likely far lower) risk than use of an AI Tool to decide an issue in dispute”. Similar distinctions also appear in the CIETAC Provisional Guidelines, the AAA-ICDR Guidance on Arbitrators’ Use of AI Tools and the Draft High Risk Guidelines for the EU AI Act. The distinction has also begun to appear in tribunal decision-making; one ICSID tribunal proactively disclosed that it will use AI tools for (among other things) “searching and organizing the record” (but not for decision-making). More practically, in the 2025 Survey conducted by QMUL and White & Case (the “2025 Survey”), a 66% majority approved the use of AI to summarize submissions or evidence, contrasted with only a 23% minority approving the use of AI for drafting legal reasoning portions of awards. Taken together, search, organization and summarization of the record are treated as relatively low-risk because they are considered preparatory rather than decisional tasks. Non-delegation of the decision-making mandate remains a key principle in all guidance, but this alone cannot answer whether corrupted AI output has influenced the arbitrator’s understanding of the record from which they decide.

The distinction between “high-risk” and “ancillary” AI use may not sufficiently capture the real risks of the second category, which can threaten the integrity of a final award even if an AI system was used without itself deciding any issue: Distorted retrieval or synthesis may shape how evidence reaches the arbitrator and how salient it appears, affecting the arbitrator’s understanding of the factual record and, ultimately, the conclusions reached by the arbitrator. An arbitrator may well review AI output critically or verify key information retrieved or synthesized by an AI system. But reviewing every single AI query on evidentiary material defeats the benefit of such a system, and as a result, is unlikely to occur. The category of “ancillary” AI may therefore describe its use case but cannot predetermine the level of procedural risk.

Three questions follow from this tension: First, to what extent can an arbitrator rely on AI output without additional verification? Second, how should arbitrators conduct such verification? Third, how far removed from the decision-making process can an AI system be before its influence can no longer be considered adjudicative in substance? Crucially, all questions become considerably harder once one drops a comfortable assumption: that the record itself is clean.

Contaminated Records Create Real Risks for Arbitral Decision-Making

Traditional falsification deceives the arbitrator or opposing counsel. But manipulation of the machine-readable record can leave the visible exhibit unchanged while altering what their AI system retrieves. To illustrate the risk adversarial action poses where counsel and arbitrators use AI tools, one need only look to the "Noroboto" font. Simplified, this custom font creates a divide between how letters are displayed for humans and how they are read by a machine when parsed electronically. This may allow the “replacement” of key terms in critical documents. For example, a contract clause may read as choosing the applicable law of Country A for a human, but a different applicable law for an AI tool. Depending on their reliance on AI, the parties and the arbitrator may reason from different versions of the same clause.

A less sophisticated variant of this strategy is the use of homoglyphs. These are characters that appear like Latin letters to a human reader, but are different symbols entirely, e.g., look-alike characters from the Cyrillic alphabet. While this strategy does not replace content, it may obfuscate key information to an AI tool by resisting retrieval. This information will still be formally in the record but may disappear from AI-generated summaries, issue lists or chronologies relied on by the arbitrator or counsel.

But where close human review is not expected, perhaps due to the sheer size of the underlying corpus, such trickery may not even be necessary. Hidden insertions of context (e.g., as white-on-white text or as metadata) can redirect the analytical conclusion of an AI system by polluting the material the AI trusts. This threatens the integrity of the proceedings if the AI output informs the structural steps and procedural directions taken by the arbitrator, particularly where subtle manipulation introduced early in the case can steer later decisions.

“Prompt injection” is a more direct variant of manipulation. In its simplest form, such an injection may instruct an AI tool to disregard certain elements of a document or prescribe a specific analytical conclusion to be reported back. As recently explored by Ben Ammar and Shearman, it has already found unfortunate use in litigation, and poses a risk to arbitration proceedings as well. Manipulated fonts and character substitutions, by contrast, contain no instructions and may therefore evade safeguards aimed primarily at identifying prompt injection.

Such adversarial techniques can blur the line between low-risk and high-risk uses of AI by an unsuspecting arbitrator. If an AI system is misled by such a technique even in an ancillary function and a party or arbitrator relies on its output without verification, the effect can reverberate through all subsequent analysis and affect the final decision all the same. This also highlights the inadequacy of the “low-risk” category as a sole criterion for disclosure of AI use by an arbitrator. Corrupted inputs may be outcome-significant, but meaningful scrutiny by the parties and subsequent challenge are only possible if the parties understand that AI was used, for what purpose and which materials informed the relevant output.

Countermeasures: Models, Harnesses, and Procedural Responsibility

As leading AI system providers admit, complete elimination of such exploits is likely impossible. Model-level safeguards are imperfect and cannot be relied on for complete protection against corrupted documents in the arbitral record. A more robust model harness (perhaps provided by an arbitral institution or a specialized technology provider) can govern how the model is instructed, and which inputs it may trust. But technical resilience cannot fully eliminate adversarial manipulation, and procedural safeguards remain necessary to determine how adversarial material is detected and addressed. Key safeguards are the pre-processing of documents and discrepancy checks between their visible and machine-readable form prior to their ingestion into AI systems. Such reviews may compare machine-readable text against visually extracted text, flagging anomalous font mappings and visually confusable character substitutions automatically. Once used within an AI system, document content should be treated as untrusted data. Such safeguards will generally fall outside the technical competence of individual arbitrators and therefore depend largely on institutions and technology providers.

Naturally, primary responsibility lies with the party that introduces contaminated documents in the first place, and the arbitrator can address such conduct through case-management, evidentiary and costs powers. Subsequent detection may provide the party affected by the manipulation with grounds for setting aside the award or raising public policy objections during enforcement, serving as a further deterrent against such conduct.

But the arbitrator retains a distinct responsibility where they rely on AI in a way that materially structures their access to the record. Technically, as with matters of cybersecurity, arbitrators themselves do not need to design technical safeguards like the ones mentioned above, but they should take reasonable measures to ensure those safeguards are in place when AI is used. Procedurally, where AI output, be it a search result, an issue list or a chronology, shapes the arbitrator’s view of the evidence, only sufficient transparency allows the parties to scrutinize the effect of the system. Finally, human review is necessary: the arbitrator should verify all dispositive quotations, unexpected omissions and other outputs that shape their reasoning.

Technical safeguards do not displace the need for a well-informed arbitrator or practitioner. Hence, the main risk lies in the wide area between arbitrators who do not utilize AI at all on one side, and highly informed, technically savvy arbitrators with a firm understanding of the capabilities and limits of AI on the other side. This middle ground may be uncomfortably wide and growing. In a 2023 survey by BCLP, nearly three-quarters of surveyed arbitrators rated their confidence in their technical capabilities relating to the use of AI as middling at best. In the 2025 Survey, 91% of respondents expected to use AI for research and data analytics within five years, while 44% simultaneously identified a lack of knowledge and experience as a principal obstacle.

“Ancillary” or “administrative” AI cannot be presumed low-risk solely because of the function assigned to it. When technology structures access the record, risk also depends on the integrity of the underlying documents, the sufficiency of transparency and the potential for verification. With all of these safeguards fallible, the arbitrator and their AI may not always read the same record. A vigilant attitude toward AI in the proceedings thus remains paramount, and arbitral procedure must account for this risk.