The Hidden Channel Between What Humans See and What Models Read
Hidden prompt injection in automated résumé screening is a document problem before it is a language problem. The focus here is the gap between a résumé’s rendered page and the machine-readable material that a screening pipeline may pass to an LLM. Understanding that gap gives readers a practical way to distinguish three things that are often collapsed: a document that contains more text than a person can see, a document whose hidden text is intended to manipulate screening, and a document whose ranking is actually changed by that manipulation.
A PDF can carry more than it displays
When a recruiter opens a résumé, the natural assumption is that the page is the document. The recruiter sees headings, paragraphs, dates, and perhaps a few design elements. The page appears to have a particular amount of content, arranged in a particular order. A text-processing system does not begin with that visual impression. It may inspect the objects stored inside the PDF and extract their characters into a text stream.
Those two operations—rendering and extraction—are related, but they answer different questions. Rendering asks what should appear on the page for a person looking at it. Extraction asks which text objects can be recovered for software. Most of the time the answers overlap enough that the distinction is invisible. The security problem begins when they diverge in a way that changes what the screening system can consider.
A résumé can contain text whose color is close to the page background, so the characters contribute little to ordinary visual reading. It can contain text set at an extremely small size, present in the document but effectively imperceptible at normal viewing. It can place text beyond the visible page area or behind another element. It can also exploit layers in the PDF structure so that extraction preserves material that a renderer does not display. These are different document mechanisms, but they serve the same broad purpose: separating machine availability from human visibility.
The important detail is not that a PDF has a hidden compartment in the same sense as a secret file. The hidden material may still be part of the ordinary text objects that a parser examines. What makes it hidden is the relationship between those objects and the visual result. A parser does not automatically know that a one-point text object at the edge of a page was meant to be read, that a background-colored string was decorative, or that a layer was suppressed for a reason. Unless the screening pipeline explicitly compares representations, extraction can turn an invisible object into an ordinary-looking line of input.
The path from submission to judgment usually contains several transformations. An applicant submits a résumé file. A system renders it for a person, extracts text for software, and may map that text into fields such as skills, experience, or education. It can then apply matching rules or provide the extracted material to a language model with a job description and an evaluation task. At each transformation, the system may preserve, discard, reorder, or reinterpret information. A hidden element need not influence every stage to matter; it only needs to survive into a stage that treats it as decision-relevant.
The diagram’s two middle paths are the essential distinction. The human reviewer receives a visual representation; the hiring model may receive a text representation assembled by extraction and other preprocessing. They are not necessarily evaluating the same evidence. This does not require the model to be gullible in a general or mysterious way. A model can follow the input it receives consistently, while the system around it has failed to establish which parts of that input a human was allowed to inspect.
Several consequences follow from that split. First, a machine-readable object is not automatically influential: it must survive the particular parsing and field-mapping steps used by the screening workflow. Second, an element can be irrelevant to one stage and consequential at another. A directive may not fit a structured field, while a concealed skill or experience claim may be carried forward as if it were an ordinary attribute. Third, the same document-level anomaly can have different effects when a system changes its parser, matching rules, prompt, or model. The vulnerability belongs to the relationship between the artifact and the pipeline, not to a single universal definition of what a PDF “means.”
That failure is especially easy to miss in a multi-stage screening workflow. Suppose a parser converts a résumé into structured attributes before an LLM sees it. A hidden skill may be added to the skills field and used in a keyword match. A hidden experience claim may be carried into a summary. An explicit instruction, by contrast, may be discarded because it does not fit a structured field. The outcome depends on the interfaces among the stages, not merely on whether the final model has been warned about prompt injection.
This is why the résumé’s representation gap changes the meaning of evidence. Evidence is not only a statement that exists somewhere in a submitted file. It is material that the decision process is permitted to use and that the affected parties can, in principle, inspect and challenge. If a model receives a machine-only qualification, the claim may look like an ordinary fact inside the model’s context even though no recruiter could have evaluated it on equal terms. The problem is procedural as well as technical: the source of a decision-relevant signal has become opaque.
The gap does not prove intent. The paper documenting real-world résumé injections notes that visual anomalies can also come from decorative design, conversion tools, watermarks, or unconventional headers and footers. A system that labels every unusual object malicious would create false positives and could burden applicants whose documents were generated by imperfect software. A system that ignores the gap would leave a known route for manipulation unexamined. The right response is to treat the discrepancy as evidence for a second-stage question, not as the final verdict.
Hidden instructions, hidden data, and innocent artifacts
The second distinction concerns what the machine-only material is trying to do. Instruction injection uses command-like language intended to steer the model’s behavior directly. It may try to make the model favor a candidate, disregard the screening task, or produce a desired evaluation. Data injection is less theatrical. It hides professional content—skills, experience, credentials, or job-related requirements—that appears to belong to the résumé but adds no genuine qualification. Its intended route may run through keyword matching, structured attributes, or a model’s assessment of fit rather than through an obvious command.
To a human reader, these categories can seem very different. An explicit instruction looks like an intrusion into the evaluator’s role. A concealed skill list can look like a formatting oddity or, once extracted, like ordinary résumé content. To the screening system, however, both exploit the same underlying asymmetry: applicant-controlled material is given access to a decision process without guaranteeing that the material is visible and contestable to the human side of the process.
The ordinary appearance of data injection is what makes it difficult for a text-only detector. If the extracted stream contains a plausible technology, credential, or experience statement, a detector that searches for phrases such as “ignore earlier instructions” has little reason to flag it. The suspicious feature lies in the connection between content and presentation. A skill is not suspicious because skills are irrelevant; skills are exactly the sort of evidence a screener is supposed to consider. It becomes a concern when the system can consider it even though a person reviewing the résumé could not see it.
This also explains why the absence of explicit commands should not be treated as evidence that no manipulation occurred. The real-world study found that data injection overwhelmingly dominated the detected cases in its two résumé populations, while instruction injection represented a much smaller share. The researchers’ interpretation is that hidden professional content can fit the early stages of automated screening more naturally than a direct command. That is a finding about the observed datasets and their pipelines, not a universal law of hiring systems. It is nevertheless a strong reason to broaden defensive checks beyond familiar prompt-injection wording.
At the same time, hiddenness alone cannot establish malicious intent. The real-world detector’s manual review required more than locating a suspicious excerpt. Reviewers checked that the content existed at the reported position, assessed whether it was visually invisible or difficult to perceive, and considered whether it represented an intentional attempt to manipulate automated screening. This combination matters because technical concealment and harmful purpose are separate properties.
A useful review therefore asks questions in sequence rather than collapsing them into one label. Is there a real difference between the rendered and extracted representations? Does the machine-only material make a substantive claim about the applicant or the job? Is the discrepancy consistent with a benign document artifact? Finally, is there enough contextual evidence to regard it as an intentional attempt to influence screening? The first question is largely technical, the second semantic, and the last two require judgment. A visual rule can surface candidates for review, but it should not be asked to infer motive by itself.
Consider three possible interpretations of a machine-only string. It could be an intentional addition meant to improve a candidate’s match. It could be a remnant introduced when a document was converted from another format. Or it could be an unusual design element with no role in the decision at all. The same visual signal may initiate investigation in all three cases, but the appropriate response is not the same. The first may require a security and integrity review; the second may call for better document handling; the third may be a false positive that should not affect the applicant.
The distinction protects both sides of the hiring process. Applicants should not be treated as suspicious merely because a file contains an unusual object. Employers should not assume that a model’s extracted text is an impartial transcript of what a recruiter could have read. A responsible screening system needs a way to expose the discrepancy, preserve the relevant excerpt, and make the reason for further review understandable. That is a more defensible posture than either trusting every extracted character or filtering every document with unconventional formatting.
The representation gap also changes what should be logged. A final score or rank cannot show whether the model relied on visible résumé material, machine-only text, or a benign artifact. An investigation needs, at minimum, a relationship among the rendered representation, the extracted content, the localized discrepancy, and the model output. Preserving that relationship does not reveal every internal step of an LLM. It does make it possible to ask whether a decision-relevant signal entered through a channel that the human process had not authorized or could not inspect.
There is a further reason to resist a purely semantic definition of the threat. A résumé is not just a sequence of claims; it is a formatted artifact whose structure can determine which claims survive into automated processing. The words and their presentation jointly shape the system’s evidence. A defense that reads only the words discards part of the causal story. A defense that reads only the formatting cannot determine whether the content was intended to manipulate. Document structure supplies the first signal, semantic and contextual review supply the second, and neither should be mistaken for a complete judgment on its own.
Once this channel is visible, the next question is no longer whether hidden text is conceivable. It is how to measure it at scale without confusing an anomaly with an attack. That requires a detection design that can compare visual and machine-readable representations, localize the material that caused concern, and use human or model-assisted review to calibrate the result. The goal is not to make the résumé unreadable to machines. It is to ensure that whatever the machine uses as evidence is visible, attributable, and open to appropriate scrutiny.