# ResumeShield: Channel Separation and an Open Benchmark for Indirect Prompt Injection in AI Resume Screening

arXiv: https://arxiv.org/abs/2609.20188 · HTML: https://mlsanity.com/paper/2609.20188/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 17 of its 21 references that are in the map.
- First posted on arXiv 24 Jul 2026.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Builds on (most cited first, 17 of 17)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Ignore Previous Prompt: Attack Techniques For Language Models](https://mlsanity.com/paper/2211.09527/) (2022)
- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents](https://mlsanity.com/paper/2403.02691/) (2024)
- [The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions](https://mlsanity.com/paper/2404.13208/) (2024)
- [StruQ: Defending Against Prompt Injection with Structured Queries](https://mlsanity.com/paper/2402.06363/) (2024)
- [Defeating Prompt Injections by Design](https://mlsanity.com/paper/2503.18813/) (2025)
- [Defending Against Indirect Prompt Injection Attacks With Spotlighting](https://mlsanity.com/paper/2403.14720/) (2024)
- [SecAlign: Defending Against Prompt Injection with Preference Optimization](https://mlsanity.com/paper/2410.05451/) (2024)
- [Jatmo: Prompt Injection Defense by Task-Specific Finetuning](https://mlsanity.com/paper/2312.17673/) (2023)
- [Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?](https://mlsanity.com/paper/2403.06833/) (2024)
- [Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competition](https://mlsanity.com/paper/2311.16119/) (2023)
- [Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchy](https://mlsanity.com/paper/2410.09102/) (2024)
- [ASIDE: Architectural Separation of Instructions and Data in Language Models](https://mlsanity.com/paper/2503.10566/) (2025)
- [Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening](https://mlsanity.com/paper/2605.28999/) (2026)
- [AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications](https://mlsanity.com/paper/2512.20164/) (2025)
- [The Ranking Blind Spot: Decision Hijacking in LLM-based Text Ranking](https://mlsanity.com/paper/2509.18575/) (2025)
- [Prompt Injection in Automated R'esum'e Screening with Large Language Models: Single and Multi-Injection Settings](https://mlsanity.com/paper/2606.27287/) (2026)

## Abstract (arXiv)

An AI resume screener reads a document supplied by the person it is evaluating, inverting the usual trust relationship between an assessor and the material it assesses. Candidates exploit this by concealing instructions inside a resume using white text, zero font size, hidden elements, markup comments, document metadata, or zero width characters. A human reviewer sees nothing, while a naive extraction pipeline places the concealed text into the model prompt, where it is read as an instruction and obeyed. This is indirect prompt injection, listed as LLM01:2025 by OWASP, and recent measurement work reports it in roughly one percent of resumes in a production screening corpus. We present ResumeShield, an open-source defense and benchmark. The defense combines three filtering stages with a fourth architectural stage that places candidate content in an explicitly fenced data channel that the operator's trusted instructions declare inert. The benchmark builds a seeded synthetic corpus spanning nine concealment techniques and two payload families, one using documented phrasings and one modeling an adaptive attacker who paraphrases around the filter, and it scores an attack as successful only when the screening outcome changes. On a corpus of 104 documents, the naive pipeline is manipulated in every injected case while the defended pipeline is never manipulated. Detection reaches a precision of 1.000 and a recall of 0.944 with no false positives on clean resumes. An ablation shows that channel separation alone removes all measured attack success, whereas the complete filtering stack without separation still leaves 16.7 percent of attacks effective. We also identify a concealment dilemma: every payload that evaded detection was one the attacker left visible, surrendering the invisibility that motivates the attack. ResumeShield is released under the Apache 2.0 license with synthetic data only.