When a Résumé Talks to the Machine
This series examines hidden and strategic prompt injection in automated résumé screening: the point at which an applicant-controlled résumé can influence an LLM not only as evidence of qualifications but also as an instruction-like input. This opening focuses on the tension between what a recruiter can see, what a document parser can extract, and what a hiring model may then use in ranking or triage. The practical understanding to carry forward is simple but consequential: before asking whether a model made a good hiring judgment, we must know whether it was given the same evidence a human believed they were reviewing.
The résumé is no longer only a record
A résumé has traditionally been a compact argument made by an applicant. It selects experiences, skills, credentials, and results, then presents them in a form that another person can read and assess. Even when an organization uses software to sort applications, the document is still presumed to be evidence about the candidate. Its words may be incomplete or flattering, but they are expected to describe the person’s qualifications rather than to issue commands to the evaluator.
LLM-based screening weakens that assumption because the résumé enters a language-processing system as text. A screening prompt may contain an employer’s instructions, a job description, and one or more extracted résumés. The model is asked to summarize, compare, score, or rank them. The applicant does not need access to the system prompt to affect this process. Control over the submitted document may be enough to place additional language inside the model’s context.
The model may not be the first or only gate in that process. A résumé can pass through parsing, structured-field construction, keyword or rule-based matching, and then a language model that summarizes or ranks the resulting material. A hidden element that is discarded by one stage may still be useful to another, while a machine-readable qualification can influence a preliminary match before a recruiter sees the application. The system’s behavior is consequently an interaction among document format, extraction logic, screening rules, and model interpretation—not a property of the LLM in isolation.
That is the defining feature of indirect prompt injection. The external material is supposed to be data, but some of its content is interpreted as an instruction, an evaluative cue, or an additional qualification. In a résumé, the manipulation may be explicit and instruction-like, asking the model to favor the candidate. It may also be less conspicuous: a hidden list of skills, an experience claim, a credential, or copied job requirements that add no genuine evidence but may influence matching and scoring. The important point is not that every persuasive sentence is an attack. It is that the document can contain material designed to change the evaluator’s behavior while masquerading as, or being processed alongside, evidence.
This makes résumé screening a particularly useful setting for understanding prompt injection. The applicant controls the input artifact, the employer controls the evaluation task, and the decision may be compressed into an early ranking that few people inspect closely. A failure at the input boundary can therefore be mistaken for an ordinary disagreement about a candidate’s merits. The model may appear to have misread a résumé when the deeper problem is that the machine received a version of the résumé that the human reviewer never saw.
The issue is not confined to a malicious applicant defeating a sophisticated model. It is a question about who is allowed to add decision-relevant material to an evaluation and whether that material is available to every party on equal terms. A visible claim can be challenged, compared with experience, or discussed in an interview. A machine-only claim can affect a score without entering the shared record of reasons. That difference makes the input boundary part of procedural fairness, even before anyone can show that a particular applicant was selected because of it.
One document, two audiences
The central difficulty is a difference between rendering and extraction. A PDF is not simply a photograph of a page. It can preserve text objects with properties that affect whether they are visible, where they appear, and how a parser retrieves them. Text that blends into its background, is set extremely small, sits outside the normal page area, or is hidden by document layering may be difficult or impossible for a person to notice during ordinary reading while remaining available to machine processing.
The same résumé can consequently have two practical versions. The rendered version is the page presented to a recruiter: visible sections, readable typography, and an apparent amount of content. The extracted version is the stream of text supplied to downstream software. Those versions often overlap, but they need not be identical. An LLM that receives the extracted stream may treat machine-only material as part of the candidate’s submission even though a human could not have evaluated it on equal terms.
Visibility is not a simple moral category. A formatting choice can be hard to see because of a conversion error, a watermark, a template convention, or an intentional attempt to conceal content. The technical discrepancy is the starting point for investigation, not its conclusion. A detector that treats every low-contrast or unusual text element as malicious would make the screening system noisy and could burden applicants whose documents were generated by imperfect software. A detector that examines only the words, meanwhile, can miss a plausible-looking qualification whose suspicious feature is its relationship to the page rather than its vocabulary.
This is an integrity problem before it is a model-intelligence problem. A model can be perfectly consistent with the text it received and still produce an unfair result if the input contains hidden material. Conversely, a visual discrepancy is not automatically malicious. Résumé templates can contain decorative elements, watermarks, conversion remnants, unusual headers, or other artifacts that trigger the same technical signals. A responsible system must therefore answer two separate questions: is there content that differs between the human and machine representations, and does the difference constitute an intentional attempt to manipulate screening?
That distinction also explains why a simple search for familiar override phrases is not enough. An explicit command is easy to imagine as an attack because it resembles a direct instruction to a model. Hidden professional content is harder to recognize: when extracted as plain text, it may look like a plausible skill or qualification. Yet that content can still affect an early matching stage, a structured field, or a model’s assessment of fit. The security signal is not limited to the meaning of the words. It is the relationship between their meaning, their location in the document, their visibility to a human, and the role they play in the screening pipeline.
The stakes extend beyond the applicant who inserted the material. Other candidates may be ranked against a manipulated representation. Recruiters may be unable to explain why a model favored one résumé. An organization may respond to a suspected attack by adding broad filters that discard legitimate formatting or disproportionately scrutinize certain applicants. Protecting the boundary therefore requires both technical detection and disciplined interpretation. The goal is not to assume that an unusual résumé is dishonest; it is to make the evidence available to the decision process inspectable and comparable.
What the evidence can answer
Two recent studies illuminate different parts of this problem. The real-world measurement study analyzes 196,682 de-identified résumés drawn from two hireEZ data sources. One covers 17 months of a candidate-matching system and supports fine-grained recent trends; the other spans 6.5 years across enterprise applicant-tracking sources and provides a longer historical view. Using document-aware detectors and manual validation, the study reports hidden injection in approximately one percent of résumés. That estimate is a conservative lower bound because the researchers did not exhaustively review every résumé classified as benign, and the data come from one platform rather than the entire hiring market.
The controlled ranking study asks a different question. With synthetic résumés, a fixed IT support role, pools of ten candidates, and two language models, it isolates whether short inserted text can move a candidate’s rank when the insertion adds no substantive qualification. It varies candidate quality, injection style, and the number of candidates who inject. This design can demonstrate a mechanism under specified conditions, but it cannot tell us how often the same effect occurs in live recruitment or whether a detected résumé changed a real hiring decision. In that experiment, an improved rank means movement in the model’s ordering relative to a baseline; it is not itself proof of a shortlist, interview, or hire.
Keeping these questions separate prevents two opposite mistakes. The first is complacency: if hidden material appears in only a fraction of documents, it may still matter whenever an automated ranking determines who receives scarce human attention. The second is alarmism: detecting hidden content is not the same as proving that a model obeyed it, that the candidate benefited, or that a hiring decision changed. There are several steps between a document anomaly and an organizational outcome, and each step needs its own evidence.
The distinction also changes what a useful audit record should contain. A final score alone cannot show whether the model relied on visible résumé content, machine-only text, or a formatting artifact. To investigate a disputed result, an organization would need to preserve the relevant representation, the extracted material, the model’s input and output, and the point at which a human or rule-based system took over. That is not a demand for perfect reconstruction of every internal model state. It is a demand that the evidence entering a consequential ranking remain inspectable enough to challenge.
The useful map for this series follows those steps. First comes visibility: can the machine receive content that a human cannot see? Next comes frequency: how often does that discrepancy appear in real résumé data, and how does the estimate change with detector limits, applicant volume, and time? Finally comes ranking effect: under what conditions does inserted content move a model’s ordering, especially when candidates are similarly qualified or a decision sits near a cutoff?
This framing changes the practical question for employers. It is not enough to ask whether an LLM is generally resistant to prompt injection. A hiring system must also ask whether its document ingestion preserves a fair evidence boundary, whether suspicious differences can be localized and reviewed, and whether ranking behavior remains grounded in qualifications when manipulation is rare. The answer may vary by document format, model, prompt, workflow, and competitive environment.
The résumé becomes an instruction to the hiring model not because every résumé contains a command, but because the system gives applicant-controlled text a pathway into a decision process that was designed to treat it as evidence. The next question is therefore mechanical and concrete: how can one document send two different representations into that process, and how can a detector tell intentional concealment from an innocent artifact? Understanding that channel is the first step toward measuring—and eventually repairing—the judgment built on top of it.