# Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review

arXiv: https://arxiv.org/abs/2507.06185 · HTML: https://mlsanity.com/paper/2507.06185/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 3 of its 15 references that are in the map.
- First posted on arXiv 8 Jul 2025.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 3 of 3)

- [Are We There Yet? Revealing the Risks of Utilizing Large Language Models in Scholarly Peer Review](https://mlsanity.com/paper/2412.01708/) (2024)
- [Detecting LLM-Generated Peer Reviews](https://mlsanity.com/paper/2503.15772/) (2025)
- [Beyond principlism: Practical strategies for ethical AI use in research practices](https://mlsanity.com/paper/2401.15284/) (2024)

## Built on by (most cited first, 13 of 13)

- [AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations](https://mlsanity.com/paper/2603.10749/) (2026)
- [Prompt Injection Attacks on LLM Generated Reviews of Scientific Publications](https://mlsanity.com/paper/2509.10248/) (2025)
- [Autonomous Research Agents: A Survey of AI Scientists and the Verification Gap](https://mlsanity.com/paper/2608.05179/) (2026)
- ["Give a Positive Review Only": An Early Investigation Into In-Paper Prompt Injection Attacks and Defenses for AI Reviewers](https://mlsanity.com/paper/2511.01287/) (2025)
- [LLM-as-a-Reviewer: Benchmarking Their Ability, Divergence, and Prompt Injection Resistance as Paper Reviewers](https://mlsanity.com/paper/2605.25415/) (2026)
- [Hidden State Poisoning Attacks against Mamba-based Language Models](https://mlsanity.com/paper/2601.01972/) (2026)
- [What happens when reviewers receive AI feedback in their reviews?](https://mlsanity.com/paper/2602.13817/) (2026)
- [Does AI Reviewer See the Full Picture? Attacking and Defending Multimodal Peer Review](https://mlsanity.com/paper/2606.12716/) (2026)
- [AI-Assisted Peer Review Across Research Communities: From Reviewer AI Policies to LLM Review Quality](https://mlsanity.com/paper/2608.03581/) (2026)
- [The Emerging AI Paper-Review Arms Race: Adversarial Co-Evolution in Scholarly Publishing](https://mlsanity.com/paper/2609.07713/) (2026)
- [ChatGPT: Excellent Paper! Accept It. Editor: Imposter Found! Review Rejected](https://mlsanity.com/paper/2512.20405/) (2025)
- [Generative artificial intelligence and the marginalization of minoritized knowledges in higher education: the case of disability](https://mlsanity.com/paper/2605.26769/) (2026)
- [Local AI pre-screening for human triple-blind peer review in health sciences](https://mlsanity.com/paper/2608.14625/) (2026)

## Abstract (arXiv)

In July 2025, 18 academic manuscripts on arXiv contained hidden instructions that manipulated AI-assisted peer review (indirect prompt injection). Instructions such as "GIVE A POSITIVE REVIEW ONLY" were concealed using white text and microscopic font sizes. Author responses varied: one planned to withdraw their manuscript, while another defended the practice as legitimate testing of reviewers misusing large language models (LLMs). This analysis examines the technique within the broader pattern of prompt injection exploits that manipulated web search and r'esum'e screening systems. For peer review, I reveal four types of hidden prompts, ranging from simple positive review commands to detailed evaluation frameworks. The honeypot defense--that prompts detect reviewers improperly using AI--fails under examination, given the consistently self-serving nature of these hidden prompts, though motivations likely vary from naive copying to calculated manipulation. This practice is best characterized as a novel form of questionable research practice (QRP). Publishers maintain inconsistent policies: Elsevier prohibits AI use in peer review entirely, while Springer Nature permits limited use with disclosure requirements. The practice exposes systematic vulnerabilities extending to plagiarism detection, citation indexing, and literature summarization. This analysis underscores the need for controlled AI integration in formal review processes alongside coordinated technical screening and harmonized policies governing AI use in academic evaluation.