arXiv: Real-World Prompt Injection Attacks in LLM-Based Resume Screening
AI relevance: This paper moves prompt injection research from synthetic benchmarks into real-world HR systems — measuring how injection attacks succeed or fail against production LLM-based resume screening pipelines, and evaluating three classes of defenses.
A new arXiv paper, "Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening" (Zhang et al., May 27, 2026), tests injection attacks against actual resume screening systems used in hiring workflows. The study evaluates three categories of defenses:
- Prevention: Preprocessing contaminated prompts, fine-tuning the LLM, and enforcing security policies on the actions the LLM can perform.
- Detection: Identifying injected content within input streams before it reaches the model's reasoning path.
- Localization: Isolating injected segments after they appear in the context window and limiting their influence on tool calls or downstream decisions.
Key contributions
- Resume screening is a concrete, high-stakes production workload where candidates can embed injected instructions directly in CV text — a real-world indirect injection vector.
- The study measures attack success rates across multiple models and screening configurations, providing empirical baselines rather than theoretical risk assessments.
- Defense effectiveness is evaluated against the same attack corpus, enabling direct comparison of prevention, detection, and localization approaches.
Why it matters
Most prompt injection research relies on synthetic benchmarks or deliberately constructed test cases. This paper demonstrates injection attacks in a workflow where the adversary (the job candidate) controls the input document and has strong incentive to manipulate the screening outcome — making it one of the few empirical studies of indirect prompt injection in a real operational setting.
What to do
- Audit LLM-powered HR/recruiting tools — if resumes or cover letters feed into an LLM scoring pipeline, indirect injection is a live risk.
- Layer defenses: Combine input sanitization (prevention) with injection detection and context isolation rather than relying on any single control.
- Test with realistic payloads: Red-team screening systems with injection payloads embedded in actual resume formats (PDF, DOCX) rather than raw text.
arXiv:2605.28999 — Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening