You just use a font that maps characters to random other ones.

So the actual source content of the doc is gibberish, but visually it looks like the correct words.

Of course a vision model could decipher it by rendering the doc, but maybe that's where this technology comes in, if you built a custom PDF renderer.

Then you'd have both obfuscated source content and rendered output.