# Prompt Injection in Automated R'esum'e Screening with Large Language Models: Single and Multi-Injection Settings

arXiv: https://arxiv.org/abs/2606.27287 · HTML: https://mlsanity.com/paper/2606.27287/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 4 of its 18 references that are in the map.
- First posted on arXiv 25 Jun 2026.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 4 of 4)

- [Optimization-based Prompt Injection Attack to LLM-as-a-Judge](https://mlsanity.com/paper/2403.17710/) (2024)
- [PromptArmor: Simple yet Effective Prompt Injection Defenses](https://mlsanity.com/paper/2507.15219/) (2025)
- [Two Tickets are Better than One: Fair and Accurate Hiring Under Strategic LLM Manipulations](https://mlsanity.com/paper/2502.13221/) (2025)
- [Prompt Injection Vulnerability of Consensus Generating Applications in Digital Democracy](https://mlsanity.com/paper/2508.04281/) (2025)

## Built on by (most cited first, 1 of 1)

- [ResumeShield: Channel Separation and an Open Benchmark for Indirect Prompt Injection in AI Resume Screening](https://mlsanity.com/paper/2609.20188/) (2026)

## Abstract (arXiv)

Large language models (LLMs) are increasingly used to screen and rank job applicants, creating incentives for candidates to strategically manipulate algorithmic hiring systems. We study prompt injection in automated r'esum'e screening, defined as subtle self-promotional text that introduces no new qualifications but is designed to influence LLM evaluations. Using controlled experiments, we show that prompt injection reliably improves applicant rankings when r'esum'e quality is homogeneous and few candidates inject. However, its effectiveness rapidly diminishes as more candidates inject, collapsing when manipulation becomes widespread. When candidate quality is heterogeneous, prompt injection is less effective on average, but can occasionally allow lower-quality candidates to outrank higher-quality ones, raising fairness concerns. Overall, LLM-based screening is most vulnerable when manipulation is rare and candidate quality differences are small. Code and resources are publicly available at: https://github.com/preetb1199/PromptInjectionACL26