Measuring Real-World Prompt Injection Attacks in LLM-Based Resume Screening

Core question: How prevalent is prompt injection in real deployed LLM resume screening, how does it evolve over time, and what forms do attackers actually adopt—previously there were only academic proofs of concept and sporadic individual cases, lacking large-scale empirical evidence.

• Scenario and importance: LLMs are used for automated resume screening; resumes are untrusted external data, and malicious job applicants can inject hidden prompts to manipulate screening outcomes; the authors state this is a high-risk real deployment scenario.
• Gaps in existing research: The authors state that existing work is mostly evaluated in controlled academic environments or on synthetic benchmarks; Liu et al. [25] discussed the possibility of injection in resume screening but did not conduct empirical work; real incidents (such as the Bing Chat incident and 2025 peer review manipulation) are only isolated cases.
• Detection difficulty: Resume text is long, injected content is submerged, and the authors' experiments show that general detectors have limited effectiveness on resumes, so detection and localization methods tailored to this domain are needed.
• Paper contributions: Two complementary detectors, HCD and VDA (both integrated into the hireEZ production system), and large-scale measurement based on 196,682 de-identified resumes collected by hireEZ over multiple years.
• Threat model (§3.1):
  • Goal: A malicious job applicant embeds hidden prompts in a resume PDF so that LLM screening favors them, and the prompts are invisible to human readers.
  • Knowledge: Knows that the target organization uses automated screening, but cannot access the specific system architecture, prompts, or parsing logic, and cannot observe or query the target system.
  • Capability: Full control over the PDF document structure, including text position, font properties, color values, and layers.
  • Victim system: The LLM-driven resume screening pipeline; the authors deliberately do not evaluate attack success on the deployed screening pipeline.

LLM resume screening

• Gan et al. [9] proposed a framework using LLM agents to summarize, score, and rank resumes; the authors state it is substantially faster than manual screening.
• Industry systems such as Greenhouse and Lever integrate AI resume analysis for initial screening [10, 21]; the authors use this to argue that resume screening is a high-impact real deployment of LLMs.

Prompt injection attacks (heuristic)

• Naïve Attack [46] directly concatenates injected content; Context Ignoring [34] uses explicit override instructions; Escape Characters [46] uses special tokens; Fake Completion [47] fabricates task completion; Combined Attack [25] combines multiple techniques.
• Liu et al. [25] formalized and benchmarked injection attacks and defenses; the authors note that it discussed the resume screening scenario but did not conduct empirical work.

Prompt injection attacks (optimization-based)

• Classified by degree of access to the target model into four categories: white-box [15,23,32,33,37,45], black-box [12,36], no-box [38], and fine-tuning API access [17]; e.g., NeuralExec [33] jointly optimizes separators and suffixes, and ObliInjection [44] targets multi-source inputs.
• The authors note that the injected content of such attacks is usually semantically meaningless, and overall, like heuristic attacks, lacks measurement in real deployments; Mu et al. [30] applied injection attacks to resume screening but did not conduct large-scale measurement on real data.

Defenses and baselines

• Defenses are divided into three categories: prevention, detection, and localization [25]; prevention methods (StruQ [2], SecAlign [3], Meta-SecAlign [4], SecInfer [27], security policy methods [5,7,16,22,39,48]) are discussed in Appendix A; the authors note that security policy methods are not applicable to resume screening without external action calls.
• Baseline methods: PromptGuard [29] (trained classifier), DataSentinel [26] (game-theoretic fine-tuned detection LLM), PromptArmor [40] (reasoning LLM direct judgment); the localization method PromptLocate [14] is cited but not used as a baseline. Baseline evaluation is conducted on the authors' constructed dataset of 10,000 resumes (1% malicious rate).

Authors' positioning: This paper is a large-scale measurement study for the real resume screening scenario; the detectors leverage PDF visual properties rather than pure text patterns, which the authors state enables them to detect the dominant data injection.

Overall approach: first design hidden injection detection and localization methods for resume PDFs, Hybrid Cascade Detector (HCD) and Visual Discrepancy Analyzer (VDA); after validating accuracy, use HCD to conduct large-scale measurement on two real resume datasets, and use an LLM to classify and profile the injected content.

Threat Model and Hiding Techniques

• The attacker controls the PDF structure; the paper lists four types of hiding techniques: color matching (e.g., white text on a white background), extremely small font size (e.g., 1pt or smaller), positional hiding (outside page boundaries or occluded), and layer hiding (extractable by parsers but not displayed when rendered).

HCD: Two-Stage Cascade (Figure 2)

• Stage 1 Rule-based Visual Analysis: four checks are performed on each text element in the PDF—font size (flagged below 4pt), color distance (flagged when RGB Euclidean distance is below a threshold of 15), visual variance (flagged when pixel intensity standard deviation is below 3.0), and ink density (flagged as phantom text when the proportion of non-background pixels is below 1.5%).
• Stage 2 LLM Semantic Review: the LLM binary-classifies each candidate excerpt as malicious or benign; if any excerpt is judged malicious, the entire resume is judged malicious.
• Localization capability: HCD also outputs the specific content that triggered detection, for manual review and subsequent measurement.

VDA: Visual Discrepancy Analysis (Figure 3)

• Each resume PDF is constructed into two representations: a rendered page image (what humans see) and machine-extracted text (including hidden content).
• A VLM is instructed to compare the two representations, find content that exists in the extracted text but is not visible in the rendered image, and determine whether the discrepancy is intentional hiding or a benign rendering artifact; it returns a judgment, suspicious excerpts, and an explanation.

Comparison of the Two Methods and Deployment

• The authors state that VDA perceives the document as a whole, can reason based on semantics, and may capture new techniques that evade rules; however, long documents create large contexts, it may hallucinate nonexistent discrepancies, and it has higher latency and cost.
• Due to their complementarity, both methods have been integrated into the hireEZ production system.

Data and Measurement Pipeline

• Datasets: Applicant Match dataset 83,277 resumes (July 2024 to November 2025, 17 months, monthly timestamps); ATS dataset 113,405 resumes (July 2019 to December 2025, 6.5 years, half-year granularity); 196,682 in total, all de-identified.
• Measurement: HCD is used as the primary detector to run on the full data; injection strategy classification uses a two-stage LLM pipeline—first classifying into instruction injection/data injection and assigning data injection subtypes, then classifying instruction injection into subtypes (Naive Attack, Context Ignoring, Fake Completion, Combined).
• Profiling analysis: demographic dimensions (education, years of experience, job level, region) are extracted from resumes; industry and function are assigned by an LLM according to the LinkedIn taxonomy (20 industries, 26 functions), using asymmetric sampling of all malicious resumes plus 5,000 random benign resumes per dataset, with weighted calculations and bootstrap (1,000 iterations) to estimate confidence intervals.

Experimental Setup

• Detector base model: both HCD and VDA use GPT-5 as the base model (§5.1); due to production environment timeout limits, only 62,029 Applicant Match resumes were successfully processed by both methods.
• Manual validation: 100 sampled from Both-Malicious (517), 100 sampled from HCD-only (276), all 85 VDA-only reviewed, 100 sampled from Both-Benign (61,151); a true positive requires all three criteria (content exists, visually invisible, semantically intentional manipulation).
• Baseline comparison dataset: 10,000 resumes, 1% malicious rate; malicious samples (n=100) were flagged by both detectors and manually confirmed, benign samples (n=9,900) were drawn from the Both-Benign pool.
• Measurement metrics: malicious rate, precision/recall/F1; 95% Wilson confidence intervals for demographics, 95% bootstrap confidence intervals (1,000 iterations) for industry and function.
• Profiling classification: 20 industries, 26 functions (LinkedIn taxonomy), LLM classification; all malicious resumes plus 5,000 random benign resumes per dataset, weighted calculation; categories with fewer than 5 malicious samples in either dataset were excluded.
• The paper does not report accuracy validation of the LLM classification, nor the number of repetitions of the measurement experiments.

Main Results

Detector evaluation (based on Table 1, Table 2, Figure 4):

Item	HCD	VDA
Flagged resumes (of 62,029)	793	602
Weighted overall precision	86.1%	92.7%
Average latency	1.35s	24.82s
Average cost/resume	$0.0001	$0.0134
Average tokens	∼850	∼4,500

• The two methods agreed on 98.6% of benign classifications (61,151 resumes); manual validation precision was 100% for Both-Malicious, 60.0% for HCD-only, 48.2% for VDA-only, and no hidden injections were found in the 100 sampled Both-Benign resumes (Table 1).
• The authors state that HCD has higher sensitivity but more false positives (mostly decorative text, watermarks, headers and footers), while VDA is more conservative but misses long documents and produces false positives due to VLM hallucination; the two exhibit different precision-recall trade-offs.
• The authors state that HCD achieves an 18× speedup and 134× cost reduction relative to VDA; for the full 200,000 resumes, HCD requires about 75 hours and $20, while VDA requires about 1,380 hours and $2,680.

Baseline Comparison

• On 10,000 resumes (1% malicious rate) (Table 3): PromptArmor precision 0.583, recall 0.070, F1 0.125; PromptGuard precision 0.455, recall 0.050, F1 0.090; DataSentinel precision 0.009, recall 0.870, F1 0.018.
• Authors' interpretation: DataSentinel judges almost all inputs as malicious; PromptArmor and PromptGuard have low recall because they are designed for explicit instruction injection, whereas over 90% of real resume injections are data injections, which text-only methods struggle to identify.

Large-Scale Measurement Results

• Prevalence (§6.1): HCD detected 2,030 malicious resumes among 196,682: 993 in Applicant Match (1.19%), 1,037 in ATS (0.91%); the authors state this should be regarded as a conservative lower bound.
• Temporal trends (§6.2, Figure 5, 6): ATS was stable at 0.6%–0.8% from 2019-H2 to 2023-H2, rose to about 1.2% in 2024 H1 and H2, and fell to 0.67% in 2025-H2; Applicant Match fell from about 1.5% to about 1.0% by the end of 2025, fluctuating monthly between 0.8% and 1.6%; however, the absolute monthly number of malicious resumes in Applicant Match continued to rise (Figure 6). The authors hypothesize that the 2024 rise is related to increased public awareness of prompt injection, and the recent decline may be due to job seekers being more cautious.
• Injection strategies (§6.3, Figure 7–9): data injections account for 90.5% in Applicant Match and 95.7% in ATS; among instruction injections, Combined is about 60%, Naïve Attack about 28%, and Context Ignoring and Fake Completion each below 10%; among data injections, Skills is the most common (Applicant Match 56.5%, ATS 42.3%). No optimization-based attacks were observed; all were readable heuristic injections.

Profiling Analysis

• Demographics (Figure 10): master's degree holders have a higher proportion than bachelor's degree holders (1.26% vs. 1.07%, AppMatch; 1.14% vs. 0.95%, ATS); PhD is the lowest (0.56%, n=7; 0.57%, n=5), and the authors caution that the sample size is small. entry and executive job levels are above average, while manager is the lowest. Asia and Europe are higher than North America (e.g., AppMatch 1.29%, 1.23% vs. 1.01%); the authors state this may reflect job market dynamics, cultural differences, or self-selection, and should be interpreted with caution.
• Industry and function (Figure 11, 12): Technology, Information and Media has the largest absolute numbers (n=279, n=180) but proportions close to average (about 1.26%, about 1.04%); Engineering and Information Technology have the largest absolute numbers; Marketing and Program/Project Management have elevated proportions consistent across both datasets; industries with the nominally highest proportions (e.g., Entertainment Providers 1.92%) have small sample sizes (n≤13) and wide confidence intervals.

Other Ablations and Analyses

• Figure 13: HCD processes 89.6% of resumes within 2 seconds and 98.4% within 5 seconds; VDA is concentrated at 10–30 seconds.
• VDA failures mainly occur with very long resumes (e.g., over 20 pages) or those containing many small text regions, tables, and multi-column layouts (§5.1).
• Negative result: VDA-only precision is only 48.2%, which the authors attribute to the VLM hallucinating nonexistent discrepancies when comparing long documents.
• The authors report that early injections in 2019 were already mainly data injections, and argue that job seekers were using hidden content to manipulate traditional parsing and keyword matching before LLM screening became widespread.

Limitations and future directions noted by the authors

• Recall unknown, prevalence is a lower bound (§5.2, §7): Exact recall would require exhaustive manual review of 61,151 Both-Benign resumes; the authors do not claim zero false negatives, and HCD-based prevalence should be interpreted as a conservative lower bound.
• Whether attacks affect screening outcomes was not evaluated (§7): The dataset has no downstream decision labels, and to avoid harming job applicants and interfering with the production system, the authors deliberately do not evaluate attack success rates on the deployed screening pipeline; the authors state that evaluating end-to-end attack effectiveness is an important but orthogonal question, left for future work.
• Data come from a single platform (§7): The authors state that two independent datasets with different time spans and sources yielded consistent conclusions, increasing confidence in the conclusions.
• Data cannot be made public (Open Science): Resumes cannot be released due to privacy and contractual restrictions; the authors acknowledge this affects direct reproducibility of the measurement results, but state that the detection methods themselves are reproducible and applicable to other datasets.
• Limited interpretation of small-sample categories (§6.4): Categories such as PhD (n=7, n=5) and some industries (n≤13) have small sample sizes and wide confidence intervals; the authors state statistical reliability is limited.
• Known limitations of VDA (§3.4): Large context for long documents, possible hallucinated differences, high latency and cost; the authors state that paginated or chunked comparison can replace full-text comparison.

Scope of experiments

• The only underlying model for the detectors is GPT-5 (§5.1); the paper does not report experiments using other models as detection LLMs or VLMs.
• Manual verification sample sizes: Both-Malicious 100/517, HCD-only 100/276, VDA-only 85/85, Both-Benign 100/61,151 (Table 1).
• Baseline comparison covers three detectors: PromptGuard, DataSentinel, and PromptArmor, with an evaluation set of 10,000 resumes and a 1% malicious rate (Table 3).
• Measurement covers 196,682 resumes: Applicant Match 83,277 (17 months), ATS 113,405 (6.5 years) (§4).
• The paper does not report accuracy validation of the LLM classifiers used for injection strategies and profiles, nor the number of repetitions of the measurement experiments; the authors discussed security policy defenses and noted they are not applicable to resume screening without external action calls (Appendix A).

A prompt injection measurement study for real deployment: the authors collaborated with hireEZ to study the phenomenon of malicious job applicants embedding hidden prompts in LLM resume screening.

• Problem: Prompt injection was previously studied mainly in controlled academic environments or individual cases; empirical evidence on prevalence, evolution, and forms in real applications is lacking; general detectors have limited effectiveness on long resume text.
• Method: Two complementary detectors were designed—HCD (rule-based visual analysis plus LLM semantic review, which can localize injected content) and VDA (VLM comparing rendered images with extracted text), both using GPT-5 as the underlying model and both integrated into the hireEZ production system; HCD was then used to measure 196,682 de-identified resumes.
• Detector performance: Under manual verification, HCD overall precision is 86.1% and VDA 92.7%; HCD takes 1.35 seconds and $0.0001 per resume, VDA 24.82 seconds and $0.0134 (Table 2). Baseline detectors PromptArmor and PromptGuard achieve recall of only 7.0% and 5.0%, and DataSentinel precision of only 0.9% (Table 3).
• Main findings: About 1% of resumes contain hidden injection (Applicant Match 1.19%, ATS 0.91%); in ATS, the proportion was stable at 0.6%–0.8% from 2019–2023, rose to about 1.2% in 2024 and then declined, but the absolute number continued to rise; over 90% of injections are data injection without explicit instructions (AppMatch 90.5%, ATS 95.7%), with Skills injection being the most common; no optimization-based attacks were observed.
• Authors' conclusion: The authors state this provides evidence of large-scale prompt injection in real LLM applications, that pure text detection approaches struggle to handle the dominant data injection, and that cross-modal verification should be a core defense capability; prevalence estimates are lower bounds, and whether attacks actually affect screening outcomes is left for future work.