AI security beyond core domains: resume screening as a case study of adversarial vulnerabilities in specialized LLM applications

Abstract

Large Language Models (LLMs) are increasingly used to automate high-stakes screening decisions, yet they can be manipulated by adversarial instructions hidden in the documents they evaluate. This paper introduces a benchmark for this vulnerability in LLM-based resume screening: 463 job-candidate pairs drawn from a 14-domain corpus, with the evaluated sample covering 13 domains, attacked through a taxonomy of four attack types and four injection positions (16 attack configurations). Across 12 model configurations covering open-weight and proprietary models, some attack types exceed 80% attack success rate (ASR) when the injected content reaches the model, and attacks upgrade up to 73.4% of candidates unanimously rejected by human annotators. The hidden-content attacks assume the resume text or HTML reaches the model; an end-to-end parser-layer analysis shows that style-aware sanitization removes most of them before classification, whereas visible-text attacks survive. We evaluate prompt-based defenses on all 12 model configurations and our proposed FIDS (Foreign Instruction Detection through Separation), a fine-tuning defense, on Qwen3-8B, the one base model we could fine-tune. On Qwen3-8B, in paired configuration-level comparisons against a common no-defense baseline, prompt-based defense reduces ASR by 10.1 percentage points (pp; 95% bootstrap CI [6.3, 14.3]), FIDS by 15.4 pp (95% CI [8.8, 23.4]), and their combination by 26.3 pp (95% CI [18.2, 35.0]), at the cost of also downgrading candidates the undefended model had accepted (a proxy for false rejections), by 12.5, 10.4, and 19.4 pp respectively. No defense eliminates the attacks, training-time and prompt-only defenses have comparable utility costs, and whether these trade-offs carry over to the proprietary models we cannot fine-tune is left to future work.