When a CV or resume is passed into an AI-assisted screening, ranking or summarisation workflow, its content becomes an untrusted external source. If instruction-like text in that document is treated as a directive rather than candidate evidence, the mechanism is indirect prompt injection: a third party controls the content, and the AI system may process it as an instruction. This is a form of prompt injection in documents specific to recruitment. A finding does not establish who placed the content, why it is present, whether a model followed it or whether a person acted on it.
What is CV or resume prompt injection?
Resume prompt injection refers to instruction-like content in a candidate document that, if processed by an AI system as a directive rather than as data, could influence the system's output. The term covers both concealed and visible text; concealment is not required for possible influence, as the OWASP guidance and OpenAI's explanation make clear for document-borne injection generally.
The NIST AI 100-2 taxonomy defines prompt injection around the combination of untrusted input with a prompt created by a higher-trust party. In the recruitment context, the higher-trust party is the recruiter or hiring system that sets the screening task. The untrusted input is the candidate-supplied document. The NIST glossary entry for indirect prompt injection confirms that a third-party document is one possible resource through which this mechanism operates.
A detector flag or an unusual formatting choice does not establish candidate intent, authorship or misconduct. It is a signal that warrants contextual review. For other prompt injection examples across document types, see the cluster's recognition article.
How resume content can reach an AI screening workflow
Document → extraction → model task
A typical path: an externally supplied CV is received, parsed by an applicant-tracking system or a manual extraction step, and the resulting text is passed to a model asked to summarise experience, compare evidence against role criteria or produce a draft ranking. The model receives extracted content, which may differ from what a human sees on screen. The exact content reaching the model depends on the parser, the file format and the system's configuration. A PDF CV, for instance, may contain machine-readable text layers that a simple visual review would not reveal, as research on discrepancies between rendered and extracted PDF content demonstrates.
Where influence could appear
Possible model-level effects include omitting, emphasising or reframing information, or altering a draft score or recommendation. These are possible effects supported by the general attack model described by OWASP and OpenAI's agent-design guidance, not proven outcomes of the observational resume study. Whether a specific model in a specific pipeline would respond to a given instruction depends on the model, the prompt, the surrounding context and the system's permissions.
Why permissions and human use matter
A draft summary reviewed against source evidence has a different consequence from an unreviewed automated ranking or an external action such as sending a rejection. OpenAI's source-to-sink framing explains that untrusted content becomes more consequential when it can influence a sensitive transmission or action. Keeping model access bounded and requiring human review for consequential decisions is the consistent recommendation across OWASP, Microsoft and the UK NCSC.
What the large real-resume study found
Dataset and method
Zhang et al. analysed 196,682 real resumes across two de-identified hireEZ datasets: 83,277 Applicant Match resumes and 113,405 ATS resumes. The study used a hybrid content detector (HCD) and manual review covered a stratified subset rather than the full corpus.
Reported occurrence estimate
In the Zhang et al. study, the HCD flagged 2,030 of 196,682 resumes, or 1.03% raw detector-positive. The authors estimated detector precision at 86.1%; exact recall was unknown. This is one vendor-linked corpus comprising two datasets, not an industry prevalence rate.
Among HCD-positive cases, Zhang et al. report that a separate LLM-based categorisation labelled 90.5% of Applicant Match positives and 95.7% of ATS positives as "data injection": hidden professional content intended to affect matching or qualification scoring rather than explicit model instructions. That category label is not proof of a candidate's intent, authorship or misconduct. It is an LLM-assigned category within detector-positive cases, not a manually verified population rate.
The reported flag rate was not a steady rise. In the ATS dataset it was roughly 0.6–0.8% during 2019–2023, spiked near 1.2% in 2024 and fell to 0.67% by 2025 H2. Applicant Match declined from around 1.5% to roughly 1.0% by late 2025. Rising absolute counts do not equate to a rising flag rate.
Why this is not an industry prevalence rate
One vendor-linked corpus, its customer and geography mix, the tailored detector, threshold choices, estimated precision, unknown recall and limited manual validation all constrain generalisation of the study's result. "About 1% raw detector-positive across these two datasets under this method" is accurate. "One percent of resumes contain prompt injection" is not.
What experimental evidence can and cannot add
A Findings of ACL 2026 paper by Baxi et al. tested short, self-promotional resume injections in a controlled setting. It used synthetic resumes, fixed ten-candidate pools, two models, years of experience as the quality proxy, one fixed IT Support Specialist job description and a fixed ranking pipeline. The effect was greater when candidate quality was similar and fewer synthetic resumes in each pool contained the inserted content; it declined as that content became more widespread. This is a model effect under specific experimental conditions, not a real hiring outcome.
An industry-linked workshop paper by Akdemir and Levy prepared 1,564 real job–job-seeker pairs, then ran 1,200 experiments: ten injection strings × five OpenAI models × 12 prompting strategies × two response formats, on the same 50-pair evaluation sample comprising 485 criteria. Across the 240 experiments per model, 0.8% to 52.1% met the study's jailbreak-success criterion. Under the best prompting strategy, four models had 0 of 10 successful attack-string conditions and one had 2 of 10. Those ten were attack-string conditions evaluated across the sample, not ten CVs or ten isolated attempts. This is a bounded label-extraction experiment using synthetic attack strings added to real pairs, not a production benchmark.
Even a repeatable ranking or label-extraction change is a model effect. Neither study shows that a real employer hired or rejected someone because of it.
Occurrence, model effect and hiring outcome are different claims
| Layer | Question | Evidence needed |
|---|---|---|
| Occurrence | Does a CV contain relevant instruction-like content? | Extracted excerpt, location, provenance, detector method and coverage |
| Effect | Did that content alter a particular AI output? | Controlled comparison in the same model, prompt and pipeline |
| Outcome | Did a person or system change a real hiring decision? | Auditable workflow and decision evidence, with other causes considered |
The observational paper provides evidence at the occurrence layer. The Baxi et al. experiment and Akdemir and Levy workshop paper provide evidence at the effect layer under their specific conditions. None of these studies directly measures a population-level hiring outcome attributable to resume prompt injection.
How recruiters can check CVs before AI-assisted review
The following seven-step sequence is an operational synthesis from NIST, OWASP, Microsoft, the UK NCSC and OpenAI, not a legal or employment-compliance standard. For the full document-checking procedure, see check a CV before using it with AI.
- Record the document source, role, version and intended AI task.
- Understand which parts of the CV the pipeline extracts and what it cannot inspect.
- Scan supported machine-readable and hidden surfaces, retaining the finding, location, coverage and limits.
- Treat suspicious or ambiguous content as a review trigger, not proof of candidate intent.
- Compare AI-produced summaries or scores with source evidence and role criteria.
- Keep permissions and automated actions narrow; require human judgement before consequential decisions.
- Follow established recruitment, privacy and escalation procedures.
Indeed's operational account illustrates that a hiring platform treats manipulation as an operational issue. It is a first-party company account, not independent prevalence evidence. For AI document checks for recruitment workflows, the same layered approach applies.
What to do after a suspicious finding
- Pause or narrow AI use where the decision consequence is material.
- Preserve the original document and the evidence needed for review.
- Consider benign production, template, accessibility or extraction explanations.
- Obtain technical and hiring-process review under existing policy.
- Do not reject a candidate or make a public accusation solely because a detector flagged a pattern.
- Document the decision and the limits of the evidence.
A signal requires contextual review. It does not establish who placed the content, why it is present, or whether a model followed it.
Where .mdSiren fits, and where it stops
For recruitment documents, .mdSiren's currently verified scope covers PDF and DOCX up to 25 MiB, and TXT and Markdown up to 5 MiB. Its bounded deterministic checks look for supported instruction-like, hidden, sensitive, remote-link and active-feature patterns and return Ready or Held with findings, coverage, limits and a recommended next action.
Ready means all required supported checks completed without a supported reason to hold. It does not certify that a CV is safe, authentic or trustworthy. Held means review is needed because a supported signal was found or a required check could not be completed. It does not prove manipulation or candidate intent.
.mdSiren does not inspect text embedded only in images, perform OCR, execute document content or provide comprehensive malware detection. Scan-derived data stays in the browser, while the web host may still receive ordinary request metadata such as IP address, time and browser headers while serving the application.
.mdSiren is in development as a browser-local checkpoint for supported documents before they enter AI projects. It is designed to surface supported findings and coverage limits for a Ready or Held decision. It does not judge a candidate or automate a hiring decision.
A proportionate conclusion
The evidence supports a consistent, fair document-intake control for every candidate file. It does not support accusing a candidate from a signal alone, silently discarding a CV, or representing a detector as a hiring-integrity verdict. Verify what the AI received, compare its output with source evidence, preserve human responsibility and make claims no stronger than the evidence.
Frequently asked questions
What is resume prompt injection?
Resume prompt injection is a form of indirect prompt injection in which instruction-like content in a candidate document may be processed by an AI system as a directive rather than as data. Whether it actually influences a model depends on the AI workflow: the parser, the model, the prompt and the system's permissions all determine whether and how the content takes effect.
How common is prompt injection in CVs?
There is no credible industry-wide prevalence figure. The strongest current observational evidence is a 1.03% raw detector-positive estimate across two de-identified datasets in one 196,682-resume hireEZ corpus, with the detector's estimated precision at 86.1% and unknown recall. This is a method-specific result in one vendor-linked corpus, not a rate that applies to all CVs or all platforms.
Does hidden text prove a candidate is trying to manipulate AI?
No. A signal requires contextual review and does not establish who placed it or why. Benign production, template, accessibility or extraction choices can produce non-obvious content. A detector flag is a reason to review, not proof of intent or misconduct.
Can prompt injection change a hiring decision?
A model-output change and a real hiring outcome are different claims. The Baxi et al. and Akdemir and Levy experiments show that model rankings or label extraction can shift under specific test conditions. No current evidence establishes a population-level hiring effect. A consequential real-world decision requires auditable workflow and decision evidence with other causes considered.
Can .mdSiren check a CV or resume?
.mdSiren's marketing website is live, but the scanner application is still in development and is not publicly available. Its current implementation supports PDF and DOCX up to 25 MiB and TXT and Markdown up to 5 MiB, applying bounded deterministic checks in the browser. Supported checks can inform a Ready or Held decision but cannot certify safety, intent, authenticity or fairness.
