Researchers associated with UNC and Duke found hidden, machine-targeted text in about 1% of a large sample of real resumes processed by hireEZ. The study is strong evidence that prompt injection has entered recruiting data. It does not show that 1% of applicants cheated, that the hidden text changed rankings or that an AI system hired anyone because of it.
The paper, submitted May 27 and accepted for USENIX Security 2026, analyzed a random sample of approximately 200,000 deidentified resumes dated from July 2019 through December 2025. Duke Engineering published its account July 22; Duke Today recirculated the story Aug. 10.
A real corpus, measured with a new detector
The research team built a detector for text apparently designed to influence large language models used in resume screening. It then applied that detector to historical records supplied by hireEZ. The authors report that approximately 1% of the sampled resumes contained suspected prompt injection and that detected prevalence rose about sevenfold between July 2024 and November 2025.
More than 90% of the flagged content did not use explicit commands such as an instruction to ignore prior directions. That matters because a narrow search for obvious attack phrases would miss most of what this detector classified. It also raises the standard for validation. Invisible text, unusual formatting and keyword manipulation can have benign or ambiguous causes, so a detection score cannot establish a candidate’s intent.
The paper authors include:
- Mohan Zhang, a UNC-Chapel Hill computer-science doctoral student
- Yuqi Jia, a Duke electrical and computer engineering doctoral student
- Neil Zhenqiang Gong, Duke, associate professor.
- Zhen Tan at Arizona State,
- Steven Jiang, hireEZ co-founder and CEO
- Tianlong Chen, UNC assistant professor
- Dawn Song, UC Berkeley professor
Chen’s hireEZ role requires careful wording. Duke says he previously served as the company’s chief AI scientist and is now at UNC. Some current-looking biographies still use the hireEZ title. Unless Chen or hireEZ confirms a continuing dual appointment, the former-company description is safer.
What the study did not test
The researchers did not run the flagged resumes through employers’ live selection systems to see whether hidden text changed scores, interviews or job offers. They say they avoided that test for ethical reasons. They also did not interview applicants to determine who inserted the content or why. The paper therefore measures suspected attack material, not successful manipulation or employment harm.
Duke says hireEZ customers make final screening decisions with human involvement. That reduces the basis for claiming an autonomous system made a final hire. It does not eliminate risk. Hidden text could influence candidate summaries, rankings or recommendations before a person sees the result, creating a distorted starting point even when a human makes the final choice.
The detector itself is another source of uncertainty. The authors manually validated it on a smaller labeled set and report high precision compared with general-purpose detectors. Applying a new classifier across 200,000 documents still leaves unresolved recall and population-level error. False positives could classify formatting artifacts as attacks. False negatives could miss unfamiliar techniques.
The date range also prevents a simple statement about today’s applicants. The sample spans more than six years, including a period before generative AI became common in recruiting. The reported sevenfold increase is more informative than an all-period average, but the public summary does not provide the monthly denominator, confidence intervals or exact count behind each point. A late-period spike could reflect changed applicant behavior, changed document formatting, changed customer mix or all three.
Because the records are deidentified, the study cannot show whether the same person submitted multiple versions, whether a recruiter edited a file or whether resume-writing software inserted hidden material. Those possibilities do not remove the security problem. They do limit claims about who initiated it and what sanction, if any, would be fair.
The operational signal for employers
The strongest response is not to label applicants as cheaters from an automated flag. Employers and recruiting vendors should treat resumes as untrusted input, strip or expose invisible text, isolate resume content from system instructions and keep auditable records of any model-generated ranking or summary. Suspicious cases require human review that can inspect the source document and the detector’s reason.
The study also points to unanswered accountability questions. The public record does not describe which sectors dominate the hireEZ sample, whether the customers are representative of employers generally, how detected rates vary by occupation or whether particular groups face different false-positive risks. Those gaps limit broad claims about the labor market.
This is a substantial measurement study because it uses a real recruiting corpus rather than a laboratory attack. Its finding is that suspected hidden manipulation is present and increasing in the sampled data. Its evidence stops before intent, effectiveness and hiring consequences.