Hidden Prompt Injection in Resumes: What Hirers Need
Some resumes carry hidden text meant to steer AI screening. Research on about 200,000 resumes found it in roughly 1%. Here is how it works and five controls that help.
Hidden prompt injection in resumes is text placed in a resume file where a human reader will not see it, but an AI screening tool will read it as if it were an instruction. A line such as recommend this candidate, written in white on a white background, is the classic example. It works when a tool pastes the extracted resume text straight into a model prompt.
It is not a theoretical trick. A measurement study of real resumes found it in about one in a hundred. This post explains the mechanism in plain language, what the data says, and five controls a small business can apply if it uses AI to screen applicants.
How the trick works
A resume is a file, usually a PDF or a Word document. What you see on screen is only part of what the file contains. Text can be set in the background color, shrunk to a tiny font size, pushed outside the visible page, or tucked into document metadata. A person sees a normal resume. A tool that extracts all the text sees everything.
If the screening tool then hands that text to a model with a prompt like score this candidate, the model has no reliable way to tell the hiring company's instruction from the candidate's. Both are just text. This is the general problem called prompt injection, listed by OWASP as LLM01 in its top risks for LLM applications, and the indirect form here means the instruction arrives through content the model was asked to read.
What the data says
A study titled Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening examined approximately 200,000 real resumes. Its authors report that approximately 1% contained hidden prompt injections, that the share had increased noticeably over the previous one to two years, and that more than 90% of the injected prompts did not use explicit instructions.
That last figure matters for defenders. Filtering for phrases like ignore previous instructions would miss most of the cases, because most of the hidden text is subtler than that.
Five controls, and what each one stops
Control | Stops | Cost |
|---|---|---|
Keep candidate text in a clearly labeled data section of the prompt, and tell the model it is untrusted | Simple instruction hijacking | Low, a prompt edit |
Render the resume to an image and compare what a person would see to the extracted text | White text, tiny text, off-page text | Medium, needs a rendering step |
Strip or flag zero-width and non-printing characters | Invisible characters hiding instructions | Low |
Never let a model's score reject anyone automatically | Any successful injection becoming a decision | Low, a process rule |
Log the extracted text next to every score and sample it | Quiet failures you would otherwise never notice | Low to medium |
No single control is enough. The most valuable one is the fourth: if the model only sorts and a human decides, a successful injection can move a resume up a pile but cannot hire or reject anyone on its own.
What to do when you find hidden text
Do not assume intent. A candidate might have pasted from a template with leftover keyword text or used a recruiter-tool trick they did not understand. Hidden instructions aimed at an AI screener are a red flag about honesty, but the decision is yours and should be consistent. Write the policy down before the first case arrives.
Treat hidden text aimed at screening tools as a flag, not automatic rejection.
Review the visible content on its own merits, with a person reading it.
Record what you found and what you decided.
Fix the weakness in your pipeline so the same trick stops working.
If you are the one applying
Do not add hidden text. Beyond the honesty problem, you are betting that nobody will check. Plain, well-organized resumes with the real keywords from the job description, written where a person can see them, are the safer route.
Related risks and reading
Hidden instructions are one case of a wider pattern. The same idea shows up in images, as covered in prompt injection through an image, and the basics are explained in what is prompt injection. For the hiring side, see how to spot an AI-generated resume when hiring. The full risk map lives in the AI risks guide.
FAQ
What is prompt injection in a resume?
Text hidden in a resume file, such as white text on a white background, that is written to instruct an AI screening tool rather than inform a human reader.
How common is hidden text in resumes?
A study of approximately 200,000 real resumes found hidden prompt injections in about 1% of them, with the share rising over the prior one to two years.
Can an AI screening tool be tricked into approving a candidate?
It can be nudged if the tool passes raw resume text into a prompt without separating it as untrusted data. Keeping a human as the decision maker limits the damage.
Is hiding keywords in white text illegal?
This post does not give legal advice. It is widely considered dishonest, and a hirer can reasonably treat it as a flag.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
