Researchers analysed 196,682 real resumes and found 2,030 with hidden prompt injections, about 1% and stated as a lower bound. More than 90% were not commands aimed at an AI at all, just concealed keyword lists and invented experience. Two things the paper is honest about: the authors never tested whether it works (their data had no hiring outcomes attached), and the detectors they built are already running in a live recruiting platform.
Then a 2026 study tested injections against real screening models and found the advantage collapses toward zero as more people do it. At around 80% adoption the benefit is nil, and it helps weak candidates most, which is exactly who cannot survive the interview after.
And here is the mechanical irony: colour is a rendering property, but text extraction reads the text layer and never checks the colour. White-on-white text is invisible to a human and perfectly visible to the machine. As recruiter Mike Peditto puts it, "if you have to hide the keywords in white font, it means you didn't have them anywhere already in black font." It is catalogued as LLM01 in the OWASP GenAI Top 10: a vulnerability in someone else's system, not a career strategy.
In a 2025 study, 23 of 25 recruiters interviewed said their systems do not auto-reject resumes for formatting, content or design. But all 25 used knockout questions, and those genuinely do fire automatically. Oracle Taleo's docs say a candidate failing one "can be instantly exited from the application process". SAP SuccessFactors has a status literally called Auto-Disqualified.
Knockouts are binary because a law binding the employer makes them binary: work authorisation, licences, clearance, minimum ages. Nothing in your resume overrides those.
So the risk is not really rejection, it is burial. Where ranking is switched on, nothing rejects you. A human just never scrolls far enough down.
Before a role goes live, the recruiter and hiring manager hold a kickoff meeting, which Greenhouse says "should happen before a role is opened". They answer a fixed set of questions, and the answers fork into two places: the scorecard every interviewer is later scored against, and the job description you read. Same meeting, same answers. So reverse engineering one from the other is not a metaphor.
The questions they answer about you are: what will a superstar accomplish in a year, what would they need to do in the first 90 days, what is non-negotiable, and what is merely coachable.
A finished scorecard is roughly 15 to 30 attributes in four categories. That is the whole universe you are measured against:
| Category | The question it answers | Real example attributes |
|---|---|---|
| Details | Are they even eligible? | Able to work in the US, fits salary range, willing to travel |
| Qualifications | Do they have the background? | Engineering degree, HR certification, SaaS experience |
| Skills | Can they do the work? | Event coordination, lead generation, budget management |
| Traits | Will they add to the culture? | Entrepreneurial, likes to learn, passionate |
The exercise: sort every line of the job description into those four. Bucket one is where the knockouts hide. Buckets two and three are what a resume can evidence. Bucket four is what the interview is for.
Then the detail that should change what you write. Interviewers score you on two different scales: five points per attribute, including a "Mixed or Neutral" middle, and four points overall with no middle at all. Evidence is allowed to be partial. The hire call is not. Your whole job is moving attributes out of that neutral column, because it does not survive the overall rating.
That distinction is a deliberate instruction, not decoration. Greenhouse's kickoff worksheet tells recruiters to "stick to the need-to-haves" and, for anything else, "be sure to label it as such". Workable has them ask hiring managers outright: "should we immediately disqualify candidates who don't have X?"
The US federal government defines both precisely. A selective factor is "absolutely required because a person cannot perform successfully in the position without" it, and missing it makes you "ineligible for further consideration". A quality ranking factor could "significantly enhance performance, but are not essential", and candidates who have it "may be ranked above those who do not, but no one may be rated ineligible solely for failure to possess" it.
On the line that men apply at 60% of qualifications and women at 100%: it traces to an unpublished internal report with no author, date or method, and a 2024 paper ran four studies and found "no gender difference emerged in participants' application intentions, neither at 60% nor at 100% qualification fit". The real finding from the original article is better anyway. Asked why they did not apply, 41% of women and 46% of men said they assumed they would not be hired and did not want to waste the effort. Nearly identical, and as its author put it, the barrier was "not a mistaken perception about themselves, but a mistaken perception about the hiring process".
An assertion names a quality. Evidence names something that happened which a third party could confirm. Laszlo Bock, who ran hiring at Google, published the conversion:
Accomplished [X] as measured by [Y] by doing [Z]
Start with an active verb, numerically measure what you accomplished,
provide a baseline for comparison, and detail what you did.The baseline is the part people drop and the part that does the work. Bock: "Adding ($1.2M) anticipates the reviewer's question about whether 12% is a big deal or not. If you improved investment results by 12%, but that meant going from $100 to $112, that's not too impressive." A percentage with no denominator is a keyword wearing a number costume.
His own rewrites, where the claim usually stays identical and only the proof changes:
| Before | After |
|---|---|
| Managed sorority budget | Managed $31,000 Spring 2014 budget and invested $10,000 in idle funds in high-yielding capital notes returning 5% over the year |
| Skills: Excellent customer service skills. Friendly and positive attitude | Excellent customer service skills and positive attitude as demonstrated by receiving employee of the month in four consecutive months in 2014 |
| Achieved annual business plan commitments for volumes, model mix, wholesale revenue and brand | As a team member, contributed to 21% increase in advertiser spend by achieving 158% of target customer contacts (80 per week) and 192% of target interaction depth (20 minutes per customer) |
| Responsible for negotiating service contracts with XYZ | Negotiated 30% ($500k) reduction in costs with XYZ by designing and using results from an online auction of multiple vendors |
Notice the third: Bock added the hedge "as a team member, contributed to". Shrinking a claim to the truth made it more credible. And this works without a corporate job. Here he is on waiting tables: "Exhibited the spirit of Hospitaliano by achieving 120% of dessert sales targets (compared to an average of 98%) and averaging 26% in tips per night."
Industrial psychologists measure how well each hiring method predicts actual job performance:
| How you're assessed | Predicts performance at |
|---|---|
| Structured interview | .42, the best predictor there is |
| Job knowledge test | .40 |
| Work sample | .33 |
| Unstructured interview | .19 |
| Years of experience | .07 |
Deception research finds liars and truth tellers separate most sharply on unanticipated questions, the detail layer nobody rehearses. Worth being precise though: one study found follow-up questioning can actually increase polish. What probing reliably does is separate people with real specificity from people generating more of it, and the tell is not how much detail you give but how much verifiable detail. Names, dates, numbers somebody else also saw. You can invent detail. You cannot invent checkable detail.
Here is a two-column resume run through a standard text extractor. The sidebar and the main column interleave:
JANE CANDIDATE
CONTACT
EXPERIENCE
jane@example.com
Data Analyst, Acme Corp
Jan 2022 to Present
0400 000 000"EXPERIENCE" is stranded next to "CONTACT" and the job title is severed from its heading, so a parser assigning content by proximity files the role under contact details. PDF has no guaranteed reading order, so extractors reconstruct it heuristically and a two-column grid defeats the heuristic.
Run this on your own resume:
pdftotext resume.pdf - # raw stream, reveals column interleaving
pdffonts resume.pdf # empty table means no text layer at all
pdftotext resume.pdf - | wc -c # near zero means it is an image, not textNo terminal? Open the PDF in a browser, select all, copy, paste into a plain text editor. That is roughly what the machine gets.
You need the complete job description, your resume, and a proof bank of projects, results, dates, tools, links and qualifications. Strip your home address and phone number first, since none of it improves the output.
You are helping me prepare truthfully for an applicant screen. Do not invent experience, keywords, credentials, metrics, tools, dates, responsibilities, personality traits, or outcomes.
JOB DESCRIPTION
[PASTE THE COMPLETE JOB DESCRIPTION]
CURRENT RESUME
[PASTE RESUME]
MY PROOF BANK
[PASTE PROJECTS, RESULTS, LINKS, QUALIFICATIONS, AND REAL EXAMPLES]
STAGE 1: BUILD THE LIKELY SCORECARD
Sort every line of the job description into the four categories employers actually use:
1. DETAILS: eligibility and knockouts (work authorisation, location, licences, salary range, travel)
2. QUALIFICATIONS: credentials and background
3. SKILLS: work product and demonstrable ability
4. TRAITS: behavioural signals
Then extract:
- Knockout criteria, stated separately
- Required versus preferred, kept strictly apart
- The 90-day or first-year outcome the role exists to deliver
- Claims that would require proof
Quote the exact words from the job description for every criterion. Mark each as explicit, strongly implied, or uncertain. Do not pretend to know the employer's proprietary system.
STAGE 2: MAP MY EVIDENCE
Build a table with:
- criterion
- my exact supporting evidence
- source location in my resume or proof bank
- strength: strong, partial, missing, or contradictory
- what a recruiter may still need to verify
Do not treat a keyword as evidence. An assertion names a quality; evidence names something that happened which a third party could confirm.
STAGE 3: RUN THE INTEGRITY PASS
Flag:
- inflated or ambiguous claims
- any metric with no baseline or denominator
- experience that sounds more senior than the proof
- tool names unsupported by an example
- inconsistent titles or timelines
If evidence is missing, write [GAP: the exact proof I need]. Do not fill it.
STAGE 4: REWRITE FOR RECRUITER AND PARSER
Propose the smallest truthful edits that:
- use the employer's language where it accurately matches my experience
- follow "accomplished X as measured by Y by doing Z", always including the baseline
- put required evidence near the relevant role
- use standard headings and remove decorative tables, icons and columns that may parse poorly
- preserve my voice
For every changed bullet, show:
ORIGINAL
WHY IT MAY FAIL
REVISED
EVIDENCE USED
FINAL OUTPUT
1. Likely scorecard, in the four categories
2. Evidence map
3. Integrity risks
4. Revised resume
5. Five interview questions built from the remaining gaps, with the verifiable detail I would need to answer eachThat matters because credential claims do not expire. MIT's dean of admissions resigned in 2007 over degrees claimed on a 1979 application. In R v Andrewes [2022] UKSC 24 the UK Supreme Court noted a man with faked degrees "did a good job" and was appraised "strong or outstanding", then ordered confiscation of his earnings uplift anyway. Closer to home, Tham v Hertz [2018] FWC 3967 upheld a dismissal for overstated resume dates, finding they were "not only intentional they were also misleading". Being good at the job is not a defence.
The injection findings come from Measuring real-world prompt injection attacks in LLM-based resume screening (USENIX Security 2026). Read §6.1 for the prevalence, §6.3.1 for the concealed-data split, and §7 for the authors' own limitations. Citing sections rather than pages on purpose, because the published PDF adds a cover sheet and prints proceedings numbers in the footers. Full disclosure they make themselves: the resumes come from a single platform and one of its employees is a co-author.
Scorecard mechanics from Greenhouse's structured hiring docs and Lever's API docs. The formula and every rewrite from Laszlo Bock's own post. Validity figures from Sackett, Zhang, Berry and Lievens.