This review uses primary research and first-party operational reports, with the population, method and limitations kept beside each figure.
The sources reviewed here do not establish a global prevalence rate for prompt injection. Some studies count documents a detector flagged; others measure whether a model followed an inserted instruction or whether a detector performed well on a test set. Those are different questions. A flagged document is not proof that a model followed the content, and a changed test answer is not proof that a real hiring, publishing or business decision changed.
For the underlying concept, start with what prompt injection is and how it reaches AI through documents.
Key prompt injection statistics for 2026
The table separates what each figure measures from what it cannot establish. These are source-specific results, not a league table of products or a prediction of your project's exposure.
| Source and setting | Reported figure | What was measured | Main limitation |
|---|---|---|---|
| Torrielli et al., Scientometrics 2026: paper-review experiment | 98.34% for ChatGPT; 94.02% for Gemini | Pooled success across review-steering attempts and integrity probes; 42,000 outputs from 100 papers | Specific interfaces, prompts and success criteria; not real publication decisions |
| ICML 2026: conference review policy | 795 reviews, about 1% of all reviews | Reviews identified as violating the applicable no-LLM policy through an organiser-created control | Not the prevalence of author-planted prompt injection |
| Zhang et al., 2026: resume corpus | 2,030 of 196,682 files, or 1.03% | Detector-positive resumes across two de-identified, vendor-linked datasets | Unknown recall; not the share of all resumes containing prompt injection |
| Thienpreecha and Subramanian, CrackedPDFs 2026: generated PDF benchmark | F1 0.960 on 2,919 held-out files | A detector's balance of precision and recall on a defined test set | Not universal PDF detection accuracy or real-world prevalence |
| Murray, PhantomLint 2025: accepted-paper PDF subset | Three false positives among 3,257 PDFs, approximately 0.092% | False alarms on accepted ICML 2025 papers using the default configuration | One corpus and configuration; does not establish recall |
| Chen et al., ACL 2025: constructed QA-text benchmark | 27.33% false-positive rate | Clean Inj-TriviaQA documents flagged by a Qwen2-0.5B detector trained on SQuAD-derived data | One out-of-domain configuration; not a production PDF or DOCX rate |
How to read the numbers
Many document studies concern indirect prompt injection: instructions arrive through material the system reads, rather than through an authorised request. Their statistics usually fall into four groups.
Detector-positive observations are simply documents the detector flagged. They show what that method found in that corpus. They do not establish true prevalence when missed cases are unknown, and a flag does not prove intent.
Controlled effects measure whether model output changes under specified conditions. An experiment can test whether an inserted instruction causes a change, but the result belongs to the tested model, prompt, parser, documents and success criterion.
Detection benchmarks measure performance on a defined dataset. Accuracy counts correct classifications overall. Precision asks how many flagged cases are genuine; recall asks how many genuine cases were found. F1 combines precision and recall. None is a percentage probability that your next document is safe.
Operational outcomes record what an organisation found or did in a real process. Its policy, population and detection method still matter. An enforcement action does not automatically show that a document manipulated a downstream decision.
For the difference between visible instructions, concealed content and other recognisable patterns, see these prompt injection examples.
Research papers: large effects in controlled tests
The Scientometrics study by Torrielli and colleagues generated 42,000 outputs from 100 OpenReview papers, with 21,000 trials per chatbot. Pooled success reached 98.34% for ChatGPT and 94.02% for Gemini. The pool combined positive and negative review steering with integrity probes such as refusal, watermarking and redirection, using different success criteria. These are high experimental results, but not a general success rate for either chatbot or a rate of changed publication decisions. Read the original study.
A separate JAMA Network Open experiment tested three models, two review prompts, four variants of one urology manuscript and 30 repeats per condition. Hidden text significantly increased simulated review scores. The single base manuscript and simulated process make this evidence of model effect, not evidence that a real journal decision changed. Read the JAMA experiment.
Field observations answer a different question. ICML reported in 2025 that a preliminary investigation found a handful of accepted papers containing hidden prompts. It classified favourable-review prompts as attempted subversion. The investigation happened after acceptance decisions and did not establish that a reviewer's model followed an instruction or changed a paper's outcome. Read ICML's publication-ethics statement.
What ICML's 795 reviews and 497 rejected papers mean
In 2026, ICML used invisible, paper-specific phrase instructions as an integrity control. It identified 795 reviews, about 1% of all reviews, by 506 unique reviewers as violations of the applicable no-LLM policy. It desk-rejected 497 papers, about 2% of submissions, associated with 398 reciprocal reviewers who violated that policy.
Those are enforcement counts: the consequences applied to submissions associated with the reviewers. They do not mean 497 papers contained author-planted prompt injection. ICML also described ways the control could miss model use, including removal of the phrase or editing it out of a review. Read ICML's 2026 account.
The guide to hidden prompt injection in research papers covers the research-integrity context and review workflow in more depth.
Resumes: 1.03% detector-positive is not industry prevalence
The hireEZ-linked study analysed two de-identified datasets. Its hybrid detector flagged 993 of 83,277 applicant-match files and 1,037 of 113,405 applicant-tracking-system files. Combined, that is 2,030 of 196,682 resumes, or 1.03% detector-positive.
Estimated detector precision was 86.1%; exact recall was unknown. The raw rate therefore cannot be treated as the true share of injected resumes, even within those datasets, let alone across recruitment as a whole.
A separate model-based categorisation assigned most positives to “data injection”: chiefly concealed professional content relevant to matching, rather than explicit instructions to a model. Neither a detector flag nor a model-assigned category proves authorship, intent or misconduct. Read the resume-corpus study.
What controlled hiring experiments measured
Akdemir and Levy prepared 1,564 job and job-seeker pairs, then ran 1,200 experimental configurations across ten synthetic attack strings, five models, 12 prompting strategies and two response formats. Those experiments reused a 50-pair evaluation sample containing 485 criteria.
Across 240 configurations per model, 0.8%–52.1% produced a statistically significant reduction in criteria receiving the “no evidence” label. This is the study's success criterion—not a percentage of candidates hired or an individual-candidate attack rate. Under the best prompting strategy, four models had zero successful conditions out of ten; one had two out of ten. The results belong to that bounded label-extraction task. Read the workshop paper.
Another study found ranking effects in fixed ten-candidate pools using synthetic resumes, two models, one IT Support Specialist role and years of experience as its quality proxy. It measured model rankings, not interviews or hires. Read the ACL Findings paper.
The CV and resume prompt injection guide explains how to preserve evidence, apply consistent intake checks and keep employment decisions with a human.
PDF detection: strong test results need their context
CrackedPDFs contains 29,322 generated one-page PDFs derived from 4,983 base documents: 9,774 injected files and 19,548 benign or matched-confounder files. These are constructed examples, not a sample of PDFs found in ordinary project work.
On 2,919 held-out files, its hybrid detector reported F1 0.960, ROC-AUC 0.998 and PR-AUC 0.997. The latter two scores describe discrimination across decision thresholds, not a percentage of files guaranteed safe.
On a balanced 1,946-file subset, classification accuracy was 95.9%. The separately reported 100% refers to score ordering across 973 injected/confounder pairs: the injected file scored higher than its counterpart. It does not mean perfect classification of every file.
The results support the approach on this benchmark. They do not establish performance across every PDF producer, language, layout or unseen attack family. Read the CrackedPDFs preprint.
PhantomLint evaluated 3,402 PDF and HTML documents across several sub-studies. On the subset of 3,257 accepted ICML 2025 PDFs, its default configuration and phrase list produced three false positives, approximately 0.092%. All three were manually judged false alarms caused by OCR failures. This is a rate for that named subset; it does not establish universal false-positive performance or recall. Read the PhantomLint preprint.
For the document mechanics behind these studies, see why AI may read more than the PDF page appears to show.
Detection accuracy changes with the test
Chen and colleagues evaluated two 900-sample benchmarks derived from SQuAD and TriviaQA. A Qwen2-0.5B detector trained on the paper's SQuAD-derived data produced a 27.33% false-positive rate on clean Inj-TriviaQA documents. This shows a generalisation problem in a particular training-and-testing combination. It is a constructed question-answering text test, not an estimate for production PDF or DOCX scanning. Read the ACL 2025 paper.
InstructDetector reported 99.60% detection accuracy on Wiki+LaMini and 96.90% on News+BIPIA, with 2,000 evaluation samples in each condition. In downstream BIPIA tests, attack-success rates were 0.03% for Vicuna-7B, 0.10% for Qwen2.5-7B-Instruct, 0.12% for GPT-3.5-Turbo and 0.13% for GPT-4o.
Importantly, the system discarded flagged external content before downstream testing and calculated success against the total sample count, not only content that passed. Filtering may also remove useful information. The figures support the tested approach under those conditions; they do not establish that arbitrary documents are safe. Read the EMNLP 2025 paper.
A detector can perform well on one benchmark and struggle elsewhere. To assess a document result, you need the finding, completed coverage, unsupported surfaces and next action—not one score in isolation. The document-checking guide explains how to use those parts together.
What this evidence does not establish
The sources reviewed here do not provide:
- a global prompt-injection prevalence rate across business documents or the open web;
- representative detection performance for native DOCX files;
- one accuracy figure that transfers across models, formats, parsers, languages and attack families;
- a measured rate of hidden prompts changing real hiring, publication or other consequential decisions; or
- a universal conversion or sanitisation method that removes every instruction channel while preserving document usability.
These gaps do not make the observed effects irrelevant. They mean you should not turn a benchmark percentage into a forecast of incidents, accuse a document's author based on a flag, or claim that one scanner solves prompt injection.
How these statistics were selected
This review prioritises primary research and first-party operational reporting. Each included figure has an identifiable dataset or population, a stated method, a measured outcome and a material limitation. Preprints are labelled and linked as such; they should not be mistaken for independently replicated production results.
Unattributed percentages and marketing claims without a checkable method are not a basis for this roundup. Nor are secondary summaries that collapse document occurrence, model response and real-world outcome into one number. Check the original source and its version before relying on a figure: preprints and operational reports can change.
What the numbers mean for your AI projects
If your system ingests outside documents, the useful response is a deliberate intake process. Check what can be inspected before it becomes project context, keep unresolved findings visible, and compare consequential output with the source. Constrain access to private context, tools and destinations, with human approval for high-impact actions. This layered approach is consistent with the NCSC's guidance on designing around prompt-injection risk.
The same rule needs to apply when a file changes. A decision about yesterday's version is not evidence about today's replacement. And a command-like sentence or hidden layer still needs interpretation: a finding is a reason to investigate, not proof that a person is malicious.
.mdSiren is a document security checkpoint for AI projects that use outside documents. Standard Scan checks each exact version for supported prompt-injection and document-borne risks, then routes it to Approved, Needs review or Quarantine. The private Library makes only current eligible Approved versions available with their scan records for retrieval and reuse. A replacement needs its own check. See the document workflow, or Coming soon.
The research figures above are not .mdSiren performance claims. Product results remain limited to their reported checks and coverage.
The most useful question is not “what percentage of prompt injections succeed?” It is “what population, system, condition and outcome did this percentage measure?” Keeping that context attached turns a striking number into evidence you can use.
