How to Measure a Message No Recruiter Can See
For hidden prompt injection in automated résumé screening, the practical question is not simply whether a document contains unusual text. It is whether a screening system can find content that differs between the human-visible page and the machine-readable input, then judge whether that difference represents intentional manipulation. The detection methods used in the real-world study offer a useful model for doing this: combine a fast structural signal with contextual review, and report the resulting measurement with its uncertainty intact.
Two detectors, two views of the same résumé
A document-aware detector must see something that a plain text classifier cannot. If the extracted text is treated as the whole résumé, a hidden skill or experience claim may look entirely ordinary. The relevant clue is that the text object has a visual relationship to the page that makes it invisible or difficult to perceive. The detector therefore begins with the document rather than with the language model’s interpretation of the document.
The Hybrid Cascade Detector, or HCD, uses a two-stage design. Its first stage applies lightweight rules to the visual properties of text elements in a PDF. It looks for several kinds of evidence that text may be concealed: unusually small type, very small distance between text and its background color, extremely low visual variation in the text region, and very low ink density. These signals do not claim that an attack has occurred. They identify excerpts worth examining.
Each signal describes a different way in which a text object can fail to become ordinary visual content. Size asks whether the characters are practically readable; color distance asks whether they contrast with the background; visual variance asks whether the region produces meaningful pixels; and ink density asks whether the text contributes enough visible mark to be noticed. The signals may overlap, but they are not interchangeable. A document can evade one kind of visual test and trigger another, while an innocent template can trigger several at once. That is why the rules are best understood as a broad net for candidate excerpts, not as a definition of maliciousness.
That distinction is the reason for the word cascade. Running a semantic language-model check over every complete résumé would be slow and expensive, and a visual rule by itself cannot understand intent. HCD first narrows the document to candidate excerpts. A language model then classifies each excerpt as malicious or benign in the context of an attempt to manipulate automated screening. If at least one excerpt receives the malicious label, the résumé is flagged. The system also retains the location and content that led to the result, so a reviewer has something specific to inspect rather than an unexplained score.
Localization changes the task for a reviewer. Instead of comparing every character in a long résumé with its rendered page, the reviewer can examine the portion that triggered the visual analysis, see it in context, and ask whether the content is both hard for a person to perceive and relevant to manipulating screening. This is not only a convenience. It makes the detector’s reasoning more legible and gives the validation sample a concrete object of review. A flag without an excerpt would be difficult to audit; an excerpt without a visual comparison would be difficult to interpret.
The Visual Discrepancy Analyzer, or VDA, starts from a different division of labor. It builds a visual representation by rendering the résumé’s pages as images and a textual representation by extracting the machine-readable text. A vision-language model receives both and is asked to identify text present in extraction but absent from the rendered pages, then assess whether the discrepancy is suspicious. VDA is therefore less dependent on a predefined set of visual thresholds. It can reason about a document holistically and may notice a discrepancy that does not fit the rule-based detector’s signals.
That broader view comes with a different failure surface. HCD can miss a concealment method that does not produce one of its rule signals, while VDA can struggle when the document is long or visually dense. VDA must align a large text stream with page images, and the model’s attention is spread across tables, columns, small regions, and ordinary résumé detail. A model may miss a real discrepancy or hallucinate one. Neither detector is simply the more intelligent version of the other: HCD is designed to narrow and localize, while VDA is designed to compare representations holistically.
The two paths are complementary because they fail in different ways. HCD is efficient and local: the first stage can examine documents without an API call, and only the small fraction that triggers a rule moves to semantic verification. Its localized excerpts make review and later analysis practical. But visual rules can be tripped by design choices that have no malicious purpose, such as watermarks, conversion remnants, or unusual headers and footers. The language-model stage reduces that ambiguity, but it cannot guarantee perfect judgment.
VDA provides a broader comparison, but that breadth creates its own costs. A full-document request must align all extracted text with all rendered pages. Long résumés, many small text regions, tables, and multi-column layouts make that alignment harder and increase the chance that the vision-language model will miss a detail or report a discrepancy that is not real. The study notes that VDA can hallucinate a hidden difference in detail-rich documents. Page-wise or chunked comparison can reduce context length and allow the process to stop early, but it introduces more orchestration and potentially more model calls.
These are not minor implementation preferences. They express different answers to the question, “What is the scarce resource in this screening system?” HCD spends local computation to reduce the number and size of model calls. VDA spends more model context and latency to obtain a holistic comparison. In the reported conditions, HCD averaged 1.35 seconds and about $0.0001 per résumé, while VDA averaged 24.82 seconds and $0.0134. That large difference is why a detector that is not the most precise in isolation can still be the appropriate instrument for a population-scale measurement.
At scale, the cost distinction also changes what can be reviewed. A slower method may be valuable as a second opinion, a validation instrument, or a targeted check for difficult document classes, but applying it indiscriminately can consume the time and budget needed to investigate the cases it finds. A fast cascade can process a broad population and reserve more expensive reasoning for a small candidate set. That choice is defensible only if the organization measures what the first stage misses and does not report a fast detector’s output as complete ground truth.
The architecture also clarifies ownership. The visual stage owns the question of whether the document presents a structural anomaly. Semantic verification owns the narrower question of whether the localized material appears to be an intentional attempt to manipulate screening. Manual review owns the final interpretation in the validation sample. None of these stages should silently substitute for the others. A system that lets a visual threshold determine intent will overstate attacks; a system that asks a language model to infer hiddenness from extracted text alone will miss the defining evidence.
From a flag to a calibrated measurement
The study’s validation design shows why detection performance needs more than one summary number. On the 62,029 Applicant Match résumés for which both detectors returned valid results, the methods agreed that 61,151 were benign. They also produced three positive categories: 517 résumés flagged by both methods, 276 flagged only by HCD, and 85 flagged only by VDA. That agreement matrix is useful because it turns a vague claim that the detectors are “complementary” into a set of cases with different expected reliability.
The categories also determine what can be learned from manual review. The cases flagged by both methods provide a high-confidence group for estimating the reliability of consensus. HCD-only cases test whether the efficient rule-based path is overinclusive. VDA-only cases test whether a holistic visual-text comparison is finding genuine cases or model-generated discrepancies. The shared-benign group is not a proof set; it is a sample in which reviewers can look for the possibility that both methods missed the same hidden content.
Researchers manually reviewed a sample of each category. All 100 reviewed cases flagged by both detectors contained malicious hidden content. Among HCD-only cases, 60 of 100 were malicious. All 85 VDA-only cases were reviewed, and 41 contained malicious content. A separate sample of 100 résumés classified as benign by both detectors contained no hidden injections. The review procedure examined the localized content where available, confirmed that it existed in the PDF, assessed whether it was visually invisible or difficult to perceive, and considered whether it represented an intentional attempt to manipulate automated screening.
These results support two different interpretations. Agreement between detectors is a strong indicator in the reviewed positive sample, and the weighted estimates produced overall precision of 86.1% for HCD and 92.7% for VDA. Precision answers: when this detector flags a résumé, how often is that flag a true positive under the study’s definition and sampling design? It is directly relevant to the workload imposed on reviewers and to the trustworthiness of a reported positive count.
Recall answers a different question: of all the malicious résumés that exist in the population, what fraction did the detector find? The study does not know that value exactly. It manually inspected only 100 of the 61,151 résumés that both methods classified as benign. Finding no hidden injection in that sample is evidence that shared false negatives may be uncommon in that sample, but it is not proof that the remaining benign pool contains none. The paper therefore treats prevalence estimates based on HCD as conservative lower bounds.
The denominator matters here. A precision estimate starts with flagged résumés and asks how many withstand review. A prevalence estimate starts with the full résumé population and asks how many are detected, then carries forward assumptions about false positives and false negatives. A benign audit can increase confidence that the detector is not missing attacks everywhere, but a sample cannot certify an unreviewed population. Keeping those denominators separate prevents a high precision result from being misreported as a high recall result.
This distinction is easy to lose when a clean-looking table presents a single malicious-resumé count. A count produced by a detector is a count of detected cases, adjusted by the paper’s validation interpretation; it is not a census of every attack. A high-precision detector can still miss a meaningful number of cases. Conversely, a highly sensitive detector can create so many false positives that the output is not useful for a real screening operation. The right choice depends on what the system is trying to do: find candidates for review, estimate a rate, protect a live workflow, or investigate a disputed ranking.
The comparison with general-purpose prompt-injection detectors reinforces that point. Detectors built around explicit instruction patterns can have moderate precision but critically low recall when the dominant real-world cases consist of hidden professional data. A detector that labels almost everything suspicious can show high recall while producing extremely low precision, which is also impractical when most résumés are benign. Neither failure is solved by declaring the other metric unimportant. The detector must be aligned with the attack form and the operational decision it supports.
HCD was selected for the study’s large-scale measurement because it offered a workable balance of precision and cost. Its rule-based first stage processed all résumés locally, and only roughly the small fraction that triggered visual rules proceeded to language-model verification. VDA’s complete-document comparison was substantially more expensive and slower, even though its estimated precision was higher. HCD’s false positives were typically formatting artifacts that could be resolved through review. That is a reasonable trade when the goal is to characterize patterns across nearly 200,000 résumés, provided the lower-bound status of the result remains visible.
The choice also implies a monitoring obligation. If the document population changes, if applicants adopt new résumé-generation tools, or if the screening workflow changes its extraction path, the relationship between visual flags and true manipulation may change. A detector calibrated on one mixture of templates and formats should not be treated as permanently calibrated. Periodic review of positive strata, shared-benign samples, and difficult document classes is part of using the measurement responsibly, even though the paper itself does not establish a complete long-term monitoring program.
The deeper lesson is that a detector is an instrument, not a verdict about a person. Its output becomes meaningful only through a chain of observations: a difference between representations, a localized excerpt or discrepancy, a semantic assessment, and a validation rule that includes intent and context. The chain can still be wrong. Its value lies in making the error surface inspectable and in allowing an organization to estimate how often each kind of error occurs.
That approach also protects applicants from two opposite failures. If a system ignores document discrepancies, an applicant-controlled machine-only signal can enter ranking without a human reviewer’s knowledge. If it treats every discrepancy as proof of dishonesty, applicants can be penalized for templates or conversion software. A calibrated cascade creates a middle position: surface a technical anomaly, preserve the evidence, review it under a consistent standard, and avoid converting an uncertain signal into an irreversible hiring decision.
With that measurement model in place, the reported prevalence figures can be read more carefully. The relevant question is not merely how many résumés were flagged, but which populations were observed, what denominators were available, how the rate changed over time, and what the detector could not see. Only then can an approximate rate be connected to the separate question of whether any hidden content actually changed a model’s ranking or a real hiring outcome.