Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening
This paper presents the first systematic study of real-world prompt injection attacks in LLM-based resume screening, analyzing 200,000 resumes to reveal that approximately 1% contain hidden injections, their prevalence is rising, and most do not use explicit instructions.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are a hiring manager looking through a stack of resumes. You decide to use a smart robot (an AI) to help you read them quickly. This robot is supposed to scan the resume, understand the skills, and tell you who looks like a good fit for the job.
This paper is like a security audit of that robot. The researchers asked: "Are people trying to trick the robot?"
Here is the story of what they found, explained simply:
1. The Problem: The "Invisible Ink" Trick
In the past, people knew that if you wrote a secret note to a robot saying, "Ignore the resume and just hire me," the robot might listen. But the researchers found something sneakier.
They discovered that many job applicants are using "invisible ink."
- The Human View: When a human looks at the resume, it looks normal. It lists standard skills like "Python" or "Project Management."
- The Robot View: The robot can read the entire file, including the tiny, hidden parts. Applicants are hiding secret instructions or fake skills in the PDF file using tricks like:
- Writing text in a font size so small (like 1 point) that it's invisible to the human eye but readable by the computer.
- Writing text in white ink on a white background.
- Hiding text behind other images.
It's like someone writing a secret note on the back of a postcard in invisible ink. The post office (the AI) can read it, but the person holding the card (the human recruiter) sees nothing.
2. The Investigation: Catching the Tricksters
The researchers worked with a company called hireEZ to look at nearly 200,000 real resumes collected over several years. They built two special "detective tools" to find these invisible tricks:
- Detective Tool #1 (The Magnifying Glass): This tool looks at the physical properties of the document. It asks, "Is this text too small? Is the color too similar to the background? Does this text look like it's hiding?" If it finds something suspicious, it zooms in to check if it's a malicious trick.
- Detective Tool #2 (The Double-Check): This tool uses a super-smart AI that can "see" the document like a human (by looking at the picture of the page) and "read" it like a computer (by extracting the text). It compares the two. If the computer sees words that the human picture doesn't show, it flags it as a trick.
They tested these tools and found they were very good at catching the fakes, much better than the generic security tools currently used by most companies.
3. The Big Findings: What They Discovered
When they ran their detective tools over the 200,000 resumes, here is what they found:
- The "1% Rule": About 1 out of every 100 resumes contained these hidden tricks. That might sound small, but in a pile of 10,000 applications, that's 100 people trying to cheat the system.
- The Trend is Up: The number of people doing this jumped noticeably in 2024. It seems that as more people heard about AI security holes, more applicants started trying to exploit them.
- The "Silent" Attack: The most surprising finding is that 90% of these attacks don't use commands.
- What we expected: People writing "Hire me!" or "Ignore previous rules."
- What they actually found: People just hiding keywords. For example, they might hide a list of 20 extra programming skills in invisible text. They aren't telling the AI what to do; they are just trying to make the AI think they are more qualified than they really are. It's like adding extra ingredients to a soup to make it taste better, rather than telling the chef to ignore the recipe.
4. Who is Doing This?
The researchers looked at who was using these tricks:
- Experience Level: It wasn't just beginners. People with 8 to 20 years of experience were actually more likely to use these tricks than fresh graduates.
- Fields: The technology and media industries had the highest number of these hidden resumes, simply because there are so many applicants in those fields.
- Geography: Applicants from Asia and Europe showed slightly higher rates of using these tricks compared to North America, though the researchers noted this could be due to different job market cultures.
5. Why This Matters
This study is the first time anyone has looked at this problem on such a large scale in the real world. Before this, we mostly just guessed that these attacks existed based on theory or small experiments.
The main takeaway is that AI resume screening has a blind spot. The robots are reading things that humans can't see, and applicants are learning how to use that to their advantage. The researchers hope that by exposing these tricks, companies can build better "security guards" for their hiring robots to ensure fair hiring for everyone.
In short: People are trying to sneak invisible notes into their resumes to trick hiring robots. About 1% of resumes have these tricks, and most of them are just hiding fake skills rather than giving direct orders to the robot. The researchers built new tools to catch these tricks and shared their findings so the world can fix the problem.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.