Restoring the Résumé as Evidence
The subject of this series is hidden and strategic manipulation in automated résumé screening, and the final question is how a hiring system can use applicant documents without allowing machine-only material to become unexamined influence. The evidence supports a practical judgment rather than a dramatic verdict: trustworthy screening depends on protecting the document boundary, measuring what the detectors can and cannot see, testing ranking behavior under competitive conditions, and preserving human accountability where a small rank shift can change access to opportunity.
The phrase “restore the résumé as evidence” does not mean returning to a world without automation. It means making the automation answerable to the same basic rule expected of a human evaluator: decision-relevant claims should be attributable, inspectable, and evaluated under a consistent standard. An LLM can still summarize or rank candidates. What it should not receive is an opaque second version of a résumé whose hidden material is treated as if it were an ordinary, shared qualification.
The integrity boundary comes before the model judgment
A résumé enters screening as an applicant-controlled artifact. That fact is not itself suspicious; it is the normal condition of hiring. The integrity question is what happens after submission. A system may render the document for a recruiter, extract text for software, map content into structured fields, apply keyword or rule-based matching, and pass some combination of those representations to a language model. If the extracted representation contains material that the human cannot see, the system has introduced a new decision-relevant signal without making its status explicit.
That signal can be an instruction, but the real-world evidence says it is more often professional-looking data: a hidden skill, experience claim, credential, or job requirement. The difference changes where a defense must look. A model guard that recognizes direct commands may not notice a machine-only qualification, because the qualification resembles the evidence the screener is designed to use. Document integrity therefore precedes model alignment. Before asking whether the LLM followed the employer’s task, the organization must ask whether the input was a fair and inspectable representation of the résumé.
The evidence chain has several distinct links. A visual or extraction mismatch is a document anomaly. A manual or semantic review can classify some anomalies as intentional hidden injections. A detector can then estimate how frequently such cases occur in a defined population. A separate experiment can show that inserted language is capable of moving a ranking under particular conditions. Only downstream records can establish whether a production model used that content and whether an organization’s decision changed as a result.
These links should not be collapsed for the sake of a simpler headline. The large observational study found approximately one percent detected hidden injection across two production-derived résumé datasets, but its exact recall was unknown and its records did not include downstream decision labels. The controlled study found that inserted self-promotional language could move rankings, especially among similarly qualified candidates and under particular model and wording conditions, but it used synthetic résumés, one job, ten-candidate pools, and a narrow experience-based quality proxy. Together, the studies make the risk credible and measurable; they do not establish that one percent of applicants successfully changed a hiring outcome.
This separation is the first governance control. It keeps a detector flag from becoming an accusation, a controlled rank gain from becoming a hiring probability, and a model vulnerability from becoming a claim about every employer. It also makes disagreements productive. If a system reports a suspicious résumé, the organization can ask which representation differed, what content was localized, how intent was assessed, whether the affected material reached the ranker, and whether the ranking mattered to a human decision. Each question has a different owner and a different evidentiary requirement.
The boundary must also account for benign artifacts. Tiny or low-contrast text, unusual positioning, watermarks, conversion remnants, and unconventional headers can trigger visual checks without representing an attempt to manipulate screening. A rule-based detector is valuable because it can surface a structural discrepancy at scale, but a visual threshold cannot infer motive.