Bayyinah: Detecting Concealed Adversarial Content in Digital Documents — A White Paper Applying the Munafiq Protocol to the Input Layer

This white paper presents Bayyinah, a file integrity scanner that applies the Munafiq Protocol's performed-alignment diagnostics (DOI: 10.5281/zenodo.19677111) to the input layer of artificial systems. Where the Munafiq Protocol diagnoses agents, Bayyinah diagnoses their inputs. The paper formalizes the surface-depth gap: a document is Performed with respect to a rendering function and an ingestion function when the machine's ingested content carries a payload the human reader's rendered surface does not reveal. This definition is relational — the same document can be Aligned for one reader and Performed for another — and every Bayyinah finding names the layer in which it was produced. The Munafiq four-process taxonomy is restricted to data: Aligned (surface and depth cohere), Compliant (format-valid without meaningful depth claims), Performed (clean surface with divergent payload), and Misaligned (openly hostile). The paper demonstrates that published adversarial-document classes — indirect prompt injection, polyglot exploits, invisible-text overlays, cross-modal steganography, and stego-embedded jailbreaks — all instantiate the Performed process. The detection problem is formalized as a Generative Adversarial Network: a Performed document is a generator sample trained to match the Aligned manifold on a surface metric while carrying a payload, and layered detection is the architectural response that prevents metric collapse. All nine diagnostic markers from the Munafiq Protocol are mapped to data-layer analogs with specific detector implementations. Twelve document formats are supported across four detection layers (zahir, batin, metadata, media). The Incompleteness Boundary applies: no scanner can flag every concealment. Bayyinah's guarantee is additive only — new detectors extend coverage, never reduce it — enforced through continuous integration against reference modules. Appendix A provides an explicit coverage boundary table for every supported format, naming both what is detected and what is deliberately out of scope. This constitutes the scanner's falsifiability surface. This white paper is a companion to the Bayyinah thesis paper and the fourth publication in a research program comprising the Munafiq Protocol (diagnostic framework), Computational Tawhid (ontological foundation), and Structured Revelation as Prompt Architecture (applied methodology).