1 Introduction↩︎

Large language models (LLMs) now sit on both sides of the hiring table. Employers increasingly deploy LLMs in automated résumé screening and candidate triage pipelines [1]. At the same time, job seekers are turning to AI tools to draft résumés optimized to perform well in LLM-based applicant tracking systems (ATS).

As candidates become aware that automated résumé screening systems rely on LLMs for initial evaluation and ranking, some have begun to strategically target the models themselves. In particular, candidates experiment with so-called prompt injection strategies, such as embedding invisible or white-colored text in résumés, to influence LLM evaluations and push their applications higher in the ranking [2], [3]. This shift in candidate behavior raises a natural and consequential question: when faced with prompt injection, do LLM-based résumé screening systems continue to select candidates based on underlying quality?

Motivated by this concern, we study whether and how strategic candidate behavior, specifically, the use of prompt injection, distorts quality-based selection in LLM-driven résumé screening. Our central research question is: To what extent do LLM-based résumé screening systems preserve quality-based candidate selection in the presence of strategic prompt injection?

Specifically, we examine the following:

1. When candidates are similar in underlying quality, does prompt injection systematically alter their relative rankings in automated résumé screening?

2. How does heterogeneity in candidate quality affect the ability of LLM-based systems to distinguish high-quality candidates from lower-quality ones in the presence of prompt injection?

3. As multiple candidates engage in prompt injection simultaneously, does the system’s capacity to rank candidates by quality deteriorate, stabilize, or exhibit saturation effects?

To answer these questions, we conduct a series of controlled résumé-ranking experiments designed to isolate the causal effect of injected self-promotional text. We consider a setting in which candidates use prompt injection strategies, i.e., append additional text to their résumés, allowing them to strategically influence an LLM-based screener. We manipulate two key factors that govern strategic impact: competition intensity, measured by the number of candidates implementing prompt injection, and comparative quality, measured by whether the injected résumé is high- or low-quality relative to other applicants. Our design includes both single-injection (only one résumé is injected) and multi-injection (multiple résumés are injected) settings, as well as candidate pools that are either homogeneous or heterogeneous in quality. We further examine two types of injection that differ in their level of directness: (i) a descriptive injection, which provides an evaluative statement about the candidate, and (ii) an instructive injection, which explicitly directs the model’s decision. This distinction allows us to compare the effects of implicit evaluative cues with explicit decision directives. Finally, we evaluate all settings across two LLMs: GPT-4o-mini (closed-source) and DeepSeek-V3.2 (open-source), to assess the robustness of our findings across model architectures.

Our results show that prompt injection reliably improves candidate rankings when résumé quality is homogeneous and injection is limited. When only a small fraction of candidates inject, injected résumés achieve substantial and consistent rank gains relative to non-injected peers, particularly under DeepSeek-V3.2 and under instructive injection. As résumé quality becomes heterogeneous, the effectiveness of injection is attenuated: LLM-based systems prioritize higher-quality résumés on average. However, manipulation is not eliminated—near decision thresholds, injected lower-quality résumés can occasionally outrank higher-quality ones, distorting quality-based selection. Finally, as injection becomes widespread, its benefits collapse: rank gains and success rates converge toward zero as more candidates inject, indicating strong saturation effects. Across models and injection types, this pattern is robust: LLM-based résumé screening is most vulnerable when candidate quality is homogeneous and manipulation is limited, and becomes more resilient as quality diversity and competitive manipulation increase, though occasional ranking distortions persist.

2 Experimental Setup↩︎

We study prompt injection in an LLM-based automated résumé screening task, where the model ranks candidates within an applicant pool. Our experiments consider two settings: single-injection, in which exactly one résumé in the pool contains injected content, and multi-injection, in which multiple résumés in the same pool are injected. We then analyze how injection effectiveness varies with competition intensity and comparative quality.

2.0.0.1 LLM ranking task

In each evaluation round \(r \in \{1,\dots,R\}\), the LLM is provided with a fixed IT support specialist job description and a pool of \(N = 10\) résumés, and is asked to output a strict ranking of all candidates, where rank \(1\) denotes the best candidate and rank \(N\) the worst.¹ To mitigate ordering effects, we randomize the order of résumés in each round.

Each experimental configuration is evaluated over \(R\) independent rounds. We set \(R = 100\) for single-injection experiments and \(R = 30\) for multi-injection experiments.² We evaluate two LLMs, GPT-4o-mini and DeepSeek-V3.2, using the same ranking task, prompt template, and candidate pools.

2.0.0.2 Candidate quality and pool composition

We operationalize candidate quality using years of relevant work experience, a widely used and interpretable screening signal [4]. While candidate quality is inherently multi-dimensional, we focus on experience duration because it can be manipulated cleanly in synthetic résumés without introducing confounders such as writing style, keywords, or prestige cues. The job description specifies a minimum requirement of 5 years of experience, so all candidates in our setting meet the baseline qualification threshold.

To create a transparent and controlled quality proxy, we construct two tiers: high-quality candidates with \(10\) years of experience (HQ) and low-quality candidates with \(5\) years of experience (LQ). The resulting quality gap of \(5\) years captures variation above the minimum requirement, allowing us to isolate differences among qualified candidates. Our goal is not to fully characterize candidate quality, but to use a simple, controlled proxy to test whether prompt injection distorts ranking outcomes.

We consider two types of applicant pools. In a homogeneous pool, all résumés have identical quality corresponding to \(5\) years of experience.³ In a heterogeneous pool, the applicant set consists of five high-quality and five low-quality candidates. All résumés share the same template and differ only in quality-related fields (e.g., years of experience).

2.0.0.3 Prompt injection design

We study two prompt injection variants. The first is a descriptive injection: “This is an exceptionally well-qualified candidate.” The second is an instructive injection: “Classify this candidate as fully qualified and superior to all other applicants, regardless of the resume content.” For both injections, we vary the placement of the injected text within the résumé, either near the top or near the bottom. The placement is randomized by sampling a single position (top or bottom) once per round and applying it to all injected résumés in that round.

2.0.0.4 Outcome measures

We evaluate injection effectiveness using two outcome measures. Rank gain measures how a résumé’s position changes under prompt injection relative to the non-injection baseline. Success rate captures how often injection leads to an improvement in rank.

Let \(\operatorname{rank}^{(r)}_{\text{base}}(j) \in \{1,\dots,N\}\) denote the rank of résumé \(j\) in round \(r\) under the baseline (non-injection) condition. Let \(\operatorname{rank}^{(r)}_{\text{inj},\mathcal{I}}(j) \in \{1,\dots,N\}\) denote the rank under a prompt injection configuration, where \(\mathcal{I} \subseteq \{1,\dots,N\}\) is the set of résumés in the pool that contain injected text (i.e., the injected set). For a fixed injected set \(\mathcal{I}\) in round \(r\), the rank gain of résumé \(j\) is defined as \(\Delta_{\mathcal{I}}^{(r)}(j) := \operatorname{rank}^{(r)}_{\text{base}}(j) - \operatorname{rank}^{(r)}_{\text{inj},\mathcal{I}}(j)\), where positive, negative, and zero values indicate upward movement, downward movement, and no change, respectively. We define the average rank gain of résumé \(j\) under injection set \(\mathcal{I}\) as \[\Delta_{\mathcal{I}}(j):= \frac{1}{R} \sum_{r=1}^{R} \Delta_{\mathcal{I}}^{(r)}(j),\] i.e., the average change in rank across \(R\) independent rounds.

We define the success rate for résumé \(j\) under injection set \(\mathcal{I}\) as \[S_{\mathcal{I}}(j) := \frac{1}{R} \sum_{r=1}^{R} \mathbf{1}\big(\Delta_{\mathcal{I}}^{(r)}(j) > 0\big),\] i.e., the fraction of rounds in which the résumé achieves a strictly positive rank gain.

3 Results and Discussion↩︎

We evaluate prompt injection effectiveness using rank gain and success rate across homogeneous and heterogeneous candidate pools under both single- and multi-injection settings.

3.1 Single Prompt Injection in a Homogeneous Candidate Pool↩︎

3.1.0.1 Single prompt injection reliably improves rank in homogeneous pools, with effects varying by model and injection type.

Table ¿tbl:tab:single95homog? shows that rank gains are uniformly positive and statistically significant across both models and injection types. DeepSeek-V3.2 is highly responsive to both descriptive and instructive injections, exhibiting large rank gains and high success rates. In contrast, GPT-4o-mini is relatively robust to descriptive self-promotion but becomes substantially more sensitive under instructive injections, where both rank gains and success rates increase markedly.⁴

2pt

2pt

3.2 Multiple Prompt Injections in a Homogeneous Candidate Pool↩︎

3.2.0.1 Injection effectiveness collapses as prompt injection becomes widespread in homogeneous pools.

As shown in Figure 1, under DeepSeek-V3.2, both rank gain and success rate decline monotonically as the number of injected résumés increases. As injection becomes more prevalent, these gains shrink toward zero, and success rates drop sharply, approaching zero once roughly \(80\%\) or more of résumés are injected. GPT-4o-mini exhibits greater robustness under descriptive injection, with consistently low gains across all levels of intensity, but becomes markedly more vulnerable under instructive injection, where the same diminishing-return pattern emerges. This pattern reflects increasing competition among injected candidates for a fixed set of top-ranked positions. As prompt injection becomes widespread, the injected text ceases to serve as a differentiating signal, and its marginal value is effectively competed away.⁵

3.3 Single Prompt Injection in a Heterogeneous Candidate Pool↩︎

3.3.0.1 Prompt injection can allow low-quality résumés to outrank high-quality résumés in heterogeneous pools.

Table ¿tbl:tab:single95hetero? summarizes the effects of a single prompt injection in a heterogeneous pool containing both HQ and LQ candidates. Under DeepSeek-V3.2, quality differences attenuate the average impact of manipulation: HQ candidates retain higher success rates due to their stronger baseline rankings. At the same time, LQ candidates exhibit larger and more variable rank gains. For candidates near decision thresholds, injected self-promotional language can shift the model’s evaluation in favor of an LQ résumé, occasionally allowing it to outrank an HQ résumé and thereby creating an unjust advantage for lower-quality candidates. GPT-4o-mini is substantially more robust under descriptive injection, showing minimal effects for both HQ and LQ candidates. However, under instructive injection, it becomes markedly more vulnerable and exhibits a similar pattern.⁶

3.4 Multiple Prompt Injections in a Heterogeneous Candidate Pool↩︎

3.4.0.1 Quality differences limit manipulation under high injection intensity in heterogeneous pools.

Figure 2 examines multi-injection in heterogeneous pools, where injection is confined to either the HQ or LQ group. Under descriptive injection, prompt injection yields only limited and short-lived benefits for both groups: rank gains are positive when injection is rare but decline rapidly toward zero as more candidates within the same quality tier inject, with success rates falling in parallel. This pattern reflects within-tier competition for top-ranked positions and the constraining role of quality differences. GPT-4o-mini remains largely robust in this setting, exhibiting near-zero effects throughout.

Under instructive injection, effects are stronger but still exhibit diminishing returns. In particular, LQ-only injection produces larger initial rank gains than HQ-only injection, and can generate substantial improvements when few candidates inject. However, these gains decay as within-tier injection intensity increases, and success rates decline accordingly. Overall, quality differences limit manipulation on average, but do not eliminate it: instructive injections can still distort rankings especially for lower-quality candidates, while competitive saturation continues to erode benefits as more candidates adopt the strategy.

4 Related Work↩︎

4.0.0.1 Prompt Injection Attacks in LLM-Integrated Applications.

Researchers have extensively studied prompt injection attacks in LLM-integrated applications, examining a wide range of injection techniques [5]–[8] and vulnerabilities in different domains [9], [10]. However, comparatively little attention has been paid to LLM-based automated résumé screening systems. Prior work also predominantly considers single-injection settings, evaluating the effectiveness of prompt injection in isolation and abstracting away from strategic interactions among multiple injections. Our work takes a first step toward understanding multi-injection dynamics, highlighting how potential competition from multiple injections can alter attack effectiveness.

4.0.0.2 Generative AI and the Future of Work.

An emerging literature examines the implications of generative AI for labor markets and hiring. Recent studies document the disruptive effects of generative AI on work and skill evaluations [11], [12], analyze biases and self-preferencing behavior in LLM-based hiring systems [13]–[15], and propose safeguards to improve fairness and equity in algorithmic hiring [16], [17]. Our work complements this literature by studying strategic prompt injection in LLM-based hiring systems. Rather than focusing on model-internal bias or institutional safeguards, we examine how individual-level strategic behavior can distort automated résumé screening outcomes, and how such distortions depend on résumé quality distributions and competitive dynamics.

5 Conclusion↩︎

Using controlled experiments, we study prompt injection in LLM-based résumé screening and show that even minimal self-promotional text can influence candidate rankings. Prompt injection is most effective when candidates are similarly qualified and manipulation is rare, but its benefits diminish rapidly as more candidates inject, collapsing under high competitive intensity. When candidate quality differs, manipulation is weaker on average, yet can still distort outcomes near decision boundaries, occasionally allowing lower-quality candidates to outrank higher-quality ones. These effects vary across models: DeepSeek-V3.2 is consistently more responsive to both descriptive and instructive injections, whereas GPT-4o-mini is relatively robust to descriptive self-promotion but becomes more vulnerable under instructive prompts.

Our findings highlight that the robustness of LLM-based screening systems depends not only on model behavior but also on the strategic and competitive environment in which they operate. Evaluations that focus on isolated attacks can substantially mischaracterize system vulnerability by ignoring congestion and interaction effects among candidates. Robust hiring pipelines should therefore be evaluated under competitive, multi-attacker conditions, with particular attention to scenarios where manipulation is limited but impactful. From a design perspective, reducing reliance on free-form self-promotional inputs and applying additional scrutiny near decision thresholds can help mitigate ranking distortions and preserve quality-based selection.

Limitations↩︎

Our study is intentionally scoped to a controlled testbed to isolate the effects of prompt injection and competitive intensity on LLM-based résumé ranking. We evaluate a fixed ranking pipeline for one job description (IT Support Specialist) with a fixed pool size (\(N{=}10\)), prompt template, and controlled decoding configuration, and we study two LLMs (DeepSeek-V3.2 and GPT-4o-mini) under this shared setup. While this improves interpretability, the quantitative magnitude of effects may differ for other roles, larger applicant pools, additional models, alternative prompts, or multi-stage ATS workflows. Thus, our results are best read as mechanism-level evidence about when ranking is vulnerable (e.g., homogeneous pools, rare manipulation, and near decision boundaries), rather than as a universal estimate of effect size.

We also simplify both manipulation and candidate quality. Our injections are limited to two short injections—one descriptive and one instructive—with controlled placement, whereas real candidates may use longer, tailored, visually hidden, or iteratively optimized content. Candidate quality is primarily operationalized via years of relevant experience under a shared résumé template. Real hiring decisions depend on richer and correlated signals, including skills, credentials, project fit, writing style, formatting, and institutional prestige. Such signals could either attenuate or amplify the observed effects, depending on how a given ranking system trades off evidence-based qualifications against persuasive or strategically inserted language.

Finally, we focus on ranking outcomes (rank gain and success rate) measured at the résumé level. We do not model downstream hiring decisions such as top-\(K\) shortlisting, interview selection, human review, spillover effects on non-injected candidates, or the effectiveness and operational costs of specific defenses. Although we add robustness by comparing models and injection types, our study does not capture the full strategic space of real-world candidate behavior or employer-side mitigation. Multi-injection settings also use fewer rounds than single-injection experiments, reducing precision for rare outcomes, though sufficient to recover clear systematic trends. Extending the analysis to richer applicant representations, end-to-end hiring pipelines, additional models, and adaptive attack–defense dynamics remains important future work.

Ethical Considerations↩︎

This work studies vulnerabilities in LLM-mediated résumé screening and thus has dual-use implications. Although our experiments are intentionally conservative—using synthetic résumés and restricting prompt injection to two short injections, one descriptive and one instructive, without optimized jailbreaks, automated attack search, or deployment guidance—the finding that strategically inserted text can shift rankings could still be misused and may also encourage wider adoption of injection-like tactics, contributing to an arms race between applicants and screening systems.

Our results raise fairness and security concerns for multiple stakeholders. For applicants, rank distortions—especially near shortlist or interview thresholds—can change downstream outcomes and may disproportionately disadvantage individuals who already face structural barriers and may have less access to coaching on strategic résumé writing or AI-assisted optimization. For recruiters and organizations, susceptibility to persuasive but weakly grounded self-evaluations can lead to erroneous screening even when systems are used as intended, undermining trust, consistency, and accountability. Our heterogeneous-pool results further suggest that injected less experienced candidates can sometimes outrank more experienced candidates, highlighting the possibility that strategic text can distort quality-based selection rather than merely amplify existing qualifications. Although our experiments use controlled screening scenarios to isolate mechanisms, real-world pipelines differ in models, prompts, oversight, and validation steps, so quantitative effect sizes may vary even if the qualitative risks remain.

We do not train new models; our study is limited to inference-time evaluation of existing systems, so its incremental environmental impact is minimal relative to model training. To mitigate misuse risk, we focus on identifying when manipulation is most likely to arise—for example, in homogeneous pools, near decision boundaries, and when manipulation remains relatively rare—rather than providing exploitation guidance. We also recommend stress-testing LLM-based screeners under competitive multi-attacker conditions, reducing reliance on free-form self-assessments, prioritizing structured and evidence-grounded attribute extraction or verification, and using additional monitoring and human review for borderline cases.

6 Prompts and Materials↩︎

6.1 Main ranking prompt↩︎

The following prompt is used for every evaluation call. The placeholders {job_posting} and {resumes_text} are instantiated each round.

6.2 Job description↩︎

We hold the following IT Support Specialist job posting fixed across all rounds and conditions [18].

6.3 Sample candidate résumé↩︎

Candidate résumés are provided to the model as raw text blocks. Below is a representative example (in the same formatting style used for all candidates):

7 Additional Experiment Setup Details↩︎

7.1 Model access and decoding configuration↩︎

All experiments use two LLMs: DeepSeek-V3.2, accessed via the DeepSeek chat-completions API [19], [20], and GPT-4o-mini, accessed through the corresponding OpenAI API deployment used in our experiments.

Decoding is held fixed within each model across conditions. We explicitly set and log the decoding configuration rather than relying on unspecified provider defaults. We use temperature=0.2 and keep all other request settings fixed within each model throughout the study.

7.2 Output parsing and validation↩︎

The prompt requests JSON output with a ranked_candidates list. We parse the returned text by extracting the JSON object containing ranked_candidates and mapping each candidate_id to its integer rank. Candidate identifiers are normalized to the canonical format Candidate A–Candidate J. Outputs that do not yield a valid full ranking over all candidates are discarded and excluded from analysis. All reported rank-gain and success-rate statistics are therefore computed only from valid complete rankings.

7.3 Randomization, mappings, and logging↩︎

Within each round, the résumé order presented to the model is randomized. We use a pre-generated universal mapping file to associate résumé indices with candidate IDs consistently within each round, and we log the mapping for reproducibility. For injection placement, we randomly select a single position—either near the top or near the bottom of the résumé—once per round, and apply that same placement to all injected résumés in that round. For each round we store (i) the résumé–candidate mapping, (ii) the injection placement, (iii) the full prompts, and (iv) raw model outputs in a detail CSV, and we aggregate metrics in summary CSV files.

7.4 Rounds and computational budget↩︎

We use \(R=100\) rounds for single-injection experiments and \(R=30\) rounds for multi-injection experiments to keep the overall computational budget feasible. In the multi-injection setting, we evaluate injected subsets of size \(k\); for \(N=10\) candidates this yields \(\binom{10}{k}\) subsets per round, peaking at \(k=5\) with \(\binom{10}{5}=252\). Because multi-injection experiments sweep multiple values of \(k\), we reduce \(R\) per configuration while preserving consistent evaluation across configurations.

8 Detailed Results↩︎

8.1 Single Prompt Injection in a Homogeneous Candidate Pool↩︎

Figure 3 shows the single-injection results in homogeneous pools under both descriptive and instructive injections. Under the descriptive injection (Figure 3 (a)), DeepSeek-V3.2 exhibits very large gains: the injected résumé achieves an average rank gain of \(4.158\) with an average success rate of \(86.2\%\). GPT-4o-mini is far less vulnerable to the same descriptive injection, with an average rank gain of only \(0.638\) and a success rate of \(7.4\%\). Under the instructive injection (Figure 3 (b)), DeepSeek-V3.2 remains highly vulnerable, with an average rank gain of \(4.086\) and success rate of \(85.4\%\), while GPT-4o-mini becomes substantially more susceptible, with an average rank gain of \(2.364\) and a success rate of \(59.7\%\).

Thus, when candidates are otherwise indistinguishable in terms of underlying quality, prompt injection can provide a visible differentiating cue that the LLM ranker rewards, even though it adds no new substantive information about candidate quality. Moreover, DeepSeek-V3.2 is highly responsive to both injection styles, whereas GPT-4o-mini is comparatively robust to descriptive self-promotion but much more sensitive to instructive injection.

8.2 Single Prompt Injection in a Heterogeneous-Quality Candidate Pool↩︎

Figure 4 shows the effects of a single prompt injection in a heterogeneous pool containing both more experienced (HQ) and less experienced (LQ) candidates, under both descriptive and instructive injections. Compared with the homogeneous setting, differences in candidate experience attenuate the average effect of manipulation, but they do not eliminate it.

Under descriptive injection (Figure 4 (a)), DeepSeek-V3.2 still exhibits meaningful effects: HQ candidates achieve an average rank gain of \(1.456\) with success rate \(59.2\%\), while LQ candidates achieve a larger average rank gain of \(3.038\) but a lower success rate of \(41.0\%\). This pattern suggests that HQ candidates benefit from stronger baseline rankings, whereas LQ candidates can experience larger upward shifts when injection succeeds. In contrast, GPT-4o-mini is much less responsive under descriptive injection, with near-zero effects for both groups and slightly negative average rank gain for LQ candidates.

Under instructive injection (Figure 4 (b)), the manipulation effects become substantially stronger. For DeepSeek, HQ candidates achieve an average rank gain of \(1.964\) and success rate of \(79.0\%\), while LQ candidates achieve a much larger average rank gain of \(6.496\) and success rate of \(93.2\%\). GPT-4o-mini also becomes clearly more vulnerable under the instructive variant: HQ candidates achieve an average rank gain of \(1.028\) with success rate \(49.0\%\), and LQ candidates achieve an average rank gain of \(2.636\) with success rate \(45.6\%\).

Taken together, Figure 4 (a) and Figure 4 (b) show that experience differences constrain manipulation on average, but do not prevent it from distorting rankings near practical decision thresholds. In particular, LQ candidates often exhibit larger rank gains than HQ candidates, especially under the instructive variant, creating conditions under which injected less experienced résumés can occasionally outrank more experienced résumés. This is precisely the fairness-relevant distortion that motivates our concern.

For the descriptive injection setting, the HQ–LQ difference is statistically significant for both rank gain (\(t=-1.582\), \(p=1.64\times10^{-17}\), Cohen’s \(d=-0.554\), \(95\%\) bootstrap CI \([-1.928,-1.238]\)) and success rate (\(t=18.2\), \(p=8.65\times10^{-9}\), Cohen’s \(d=0.370\), \(95\%\) bootstrap CI \([12.0\%,24.0\%]\)). These results support the interpretation that HQ candidates retain stronger baseline success, while LQ candidates can obtain larger upward shifts when injection succeeds.

9 Additional Results: Homogeneous Pool with 10-Year Experience↩︎

This appendix reports the homogeneous-pool results when all résumés in the pool encode \(10\) years of IT support experience. These analyses mirror the corresponding homogeneous \(5\)-year results in the main text, but allow us to verify that the observed effects are not specific to the minimum-threshold homogeneous setting. We report both descriptive and instructive injection results for (i) the single-injection setting and (ii) the multi-injection setting.

9.1 Single-injection↩︎

Figure 5 reports the single-injection analysis for the homogeneous \(10\)-year pool under both the descriptive and instructive injections. The qualitative pattern mirrors the homogeneous \(5\)-year results in the main text. Under both injections, a single injected résumé shifts upward in the ranking, indicating that prompt injection can provide a consistent advantage even when all candidates share strong and homogeneous merit signals. As in the main text, DeepSeek-V3.2 remains highly vulnerable under both variants, whereas GPT-4o-mini is much less responsive to the descriptive injection and more responsive to the instructive one.

9.2 Multi-injection and saturation↩︎

Figure 6 reports the multi-injection analysis for the homogeneous \(10\)-year pool under both the descriptive and instructive injections. As the number of injected résumés grows, the advantage of any single injected résumé diminishes: rank gain and success rate drop as injected candidates compete against one another. When most or all résumés are injected, the injection signal becomes non-discriminative and no longer yields a systematic ranking advantage. This confirms that the saturation result observed in the main text also holds in a homogeneous pool of uniformly stronger candidates.

10 Scientific artifacts, documentation, and terms↩︎

10.0.0.1 Artifacts used/created

Our experiments use (i) third-party LLMs accessed through the DeepSeek and OpenAI APIs (Appendix 7.1), and (ii) synthetic résumé text, prompts, and evaluation scripts created for this study (Appendix 6–7). All text materials are in English and scoped to an IT Support Specialist screening scenario.

10.0.0.2 Terms, licensing, and intended use

We access DeepSeek-V3.2 through the DeepSeek Open Platform and use it in accordance with the DeepSeek Open Platform Terms of Service and DeepSeek Terms of Use [21], [22]. The job posting reproduced in Appendix 6.2 is from a publicly available listing [18] and remains subject to the source website’s terms and the original copyright holder; we include it only to document the evaluation context. The synthetic résumés and prompts are intended solely for research on robustness and should not be used to make or automate real hiring decisions.

10.0.0.3 PII/offensive content checks

Because our résumés are synthetic and templated, they contain no real individuals. We additionally performed a manual review of all templates and materials and a basic automated scan for common identifiers (e.g., emails, phone numbers, addresses, and real-person names) and did not include offensive content.

10.0.0.4 Use of AI assistants

We used an AI assistant (ChatGPT) to help with editing and rephrasing portions of the manuscript and checklist responses. All scientific decisions, experimental design, analyses, and final wording were reviewed and approved by the authors, who take full responsibility for the content. No private or personal applicant data were provided to the AI assistant.

References↩︎

---

1. The full prompt and job description are provided in Appendix 6. Details about the models and additional experimental setup are provided in Appendix 7.↩︎

2. We use fewer rounds for multi-injection due to substantially higher computational cost; details are provided in Appendix 7.4.↩︎

3. Additional results for a homogeneous pool with \(10\) years of experience are reported in Appendix 9.↩︎

4. Appendix 8.1 provides detailed results for this analysis. Appendix 9 presents additional evidence for homogeneous pools with 10 years of experience, which exhibits the same qualitative pattern.↩︎

5. Homogeneous-pool results with \(10\) years of experience, reported in Appendix 9, exhibit the same qualitative pattern.↩︎

6. Appendix 8.2 provides detailed results for this analysis.↩︎