Prompt Injection in Automated Résumé Screening with Large Language Models: Single and Multi-Injection Settings
Preet Baxi, Jiannan Xu, Jane Yi Jiang, Stefanus Jasin
Read on arXiv →
Key claim
Prompt injection can manipulate LLM rankings in hiring.
In plain English
Imagine you're building a hiring system that uses a large language model (LLM) to screen job applicants. The goal is to find the best candidates based on their résumés, but as more people apply, some might try to game the system by adding subtle self-promotional text that doesn't actually change their qualifications. This is where the problem lies: when only a few candidates use this tactic, it can boost their rankings, but as more candidates start doing it, the effectiveness drops sharply. This situation is known as prompt injection, and it can lead to lower-quality candidates outranking better ones, especially when the differences in candidate quality are small. This raises serious fairness issues in the hiring process.
The paper explores this issue by conducting controlled experiments to understand how prompt injection works in practice. It turns out that when résumé quality is similar and only a few candidates manipulate their texts, they can significantly improve their chances of being ranked higher. However, as more candidates adopt this strategy, the advantage diminishes, and the system becomes less reliable. The key takeaway is that LLM-based screening is most vulnerable when manipulation is rare and candidate quality differences are minimal. This insight is crucial for anyone building automated hiring systems, as it highlights the need for safeguards against such manipulative tactics.
The paper introduces a new perspective on the vulnerabilities of LLMs in job screening, highlighting prompt injection as a manipulation tactic.
The findings are supported by controlled experiments and provide a clear understanding of the conditions under which prompt injection is effective.
Deep reliability assessment
The methodology supports a mechanism-level claim: in a controlled LLM resume-ranking setup, short self-promotional injections can shift rankings, especially when candidates are similar and few inject. It overclaims if read as an estimate of real-world ATS risk, because the experiments use one job description, N=10 pools, two models, two injection styles, simplified quality signals, and no realistic multi-stage recruiter workflow or defenses.
Reproducibility
Yes. The paper states that code and resources are publicly available at https://github.com/preetb1199/Prompt_Injection_ACL26, though the excerpt does not fully specify whether all synthetic resumes, prompts, model outputs, and random seeds are included.
Key figure
The key experimental design is an LLM ranking pipeline where a fixed job description and 10 resumes are given to the model while the authors vary resume quality, injection type, and the number of injected candidates.