1 in 5 Say They Hid Text in Their Resume. The ATS Parse Prints It

If you're thinking about pasting white-text keywords or an "ignore previous instructions" line into your resume, know this first: the parser that reads your file removes the white font and shows that text in plain view. Hidden text doesn't keep anything from the employer. It shows them what you tried to do.

Plenty of people have tried it anyway. Greenhouse released a candidate survey on Oct 20 (PR Newswire ran it Oct 21) finding that 62% of US job seekers tried tactics to get past automated screening, and a third of that group added hidden text meant for an AI reviewer. The headlines left out the part that matters to you: what happens to that text after you hit submit.

How many job seekers actually hide text in their resume?

About 1 in 5 US job seekers say they hid text in their resume. When researchers scan real resumes, they find it in roughly 1%. That gap is the most useful number in this story.

Here's where the numbers come from. Greenhouse surveyed 2,800+ candidates, but the headline figures cover only the 1,200 US respondents. Of those, 62% tried at least one tactic to beat screening, and a third of that 62% added hidden text. That works out to about 20.5% of all US respondents, not "a third of applicants," which is how HR Dive put it on Oct 23. In the UK and Ireland, 63% tried tactics and 28% of those hid text, so about 17.6% overall.

Researchers from Duke, UNC Chapel Hill, Arizona State and UC Berkeley worked with the recruiting platform hireEZ and scanned roughly 200,000 real resumes for a USENIX Security 2026 paper. About 1% contained hidden prompt injections. Greenhouse's own estimate is also about 1%. The staffing firm ManpowerGroup reports a much higher rate, around 10% of the resumes it scans with AI.

Several things could explain a self-reported rate about 20 times the measured one:

• Overreporting. People say they tried something they only thought about doing.
• Broken attempts. The text they meant to hide didn't actually end up hidden in the file.
• Inconsistent templates. The hiding depends on a template that doesn't behave the same way every time.

One more thing about the source: Greenhouse sells hiring software, including a voice AI interview product. Its numbers are worth using, but it isn't a neutral party.

Where does hidden text end up after you hit submit?

Hidden text ends up in the plain-text version of your resume, and that version is what the ATS, the recruiter's view, and any AI screener actually read. Making the font white changes how the page looks. It doesn't change the text underneath.

An applicant tracking system (ATS) is the software employers use to receive, parse, and route job applications. Parsing means pulling the raw text out of your PDF or DOCX so the system can fill in fields and run searches. As Built In explains, the ATS removes all formatting and reads only the underlying text, so white-font prompts become visible to the recruiters reviewing the file.

Here is where that text shows up:

1. The parsed candidate record. Your white keywords become ordinary text in the record, with nothing to mark them as hidden.
2. The recruiter's review of the file. Anyone looking at the parsed text sees lines that aren't on the page you designed.
3. The AI screener's detector. Indeed says it added checks for hidden or obscured text.
4. A trained human reviewer. At Indeed, resumes that look off or risky get escalated to people who review them by hand.

The white text resume ATS trick took off after TikTok creator Cami Petyn posted about "white fonting" in 2024. It only works if the reader sees nothing but the rendered page. Software never looks at the page. It reads the text.

What does hidden resume text usually contain?

Hidden resume text is mostly keywords, not commands. In the Duke and hireEZ data, more than 90% of injected prompts contained no explicit instruction like "ignore previous instructions."

Prompt injection is text written to change how an AI model behaves. In a resume, the goal is to get an AI screener to rank you higher than your visible content would. The paper's case studies found four common versions:

• A long list of hidden skills
• A hidden description of experience
• The job's requirements copied into hidden text
• A hidden certification

So prompt injection in a resume is mostly the old keyword-stuffing trick under a new name. That has an awkward result. A detector built to catch commands can miss a hidden skills list. The parser misses nothing. The recruiter sees the posting's requirements pasted word for word in your resume, and few signals say "I gamed the bot" more clearly than that.

A hidden certification is worse than stuffing. It's a credential claim, and a recruiter can check it.

Does hiding keywords in your resume still work?

No, not reliably, and it's getting less effective. Detection is now cheap enough to run on every file, and the ranking boost shrinks as more applicants use the trick.

Neil Gong, a Duke associate professor and co-author of the hireEZ study, said: "Even a few years ago, these attacks would have been completely effective and AI screeners wouldn't have questioned it." Those few years are over. A 2026 ACL study found that injection could raise a resume's ranking. It also found that as more applicants stuff their resumes with hidden instructions, the advantage erodes.

The mechanism is simple. Rankings are relative. If everyone in the pile has the same hidden keyword list, nobody gets ahead of anyone else, and they all share a pattern a detector can catch. Several things are now working against the trick:

• It grew fast enough to get noticed. Injected resumes rose sevenfold between July 2024 and November 2025.
• Detection costs almost nothing. The paper's fast detector runs at about $0.0001 per file, so a platform can scan every resume it receives.
• The architecture fix works. Indeed's research found that keeping resume content separate from the AI's instructions dramatically reduced vulnerabilities, and in some cases eliminated them.

At best, the hidden text does nothing. At worst, it flags your file and sends it to a person who now has a reason to doubt everything else on the page.

Who is checking resumes for hidden text?

Hiring platforms do the checking, not specialist staff. The detection is built into the ATS and screening tools, so every recruiter using them gets it by default.

In Refolk's index of professional profiles, 145,111 US profiles hold Recruiter, Technical Recruiter, TA Specialist or TA Partner titles. The UK has 11,655, so the US has about 12.5 times as many. Across all US profiles in the index, only 46 mention "prompt injection" in their headline, and the examples look like security people (a GenAI red teamer, for instance), not recruiters. Recruiting teams aren't hiring injection specialists. The platform does that work.

Recruiters also have to read more than ever. Greenhouse's benchmark data shows applications per recruiter rose 411.8% between 2022 and 2025.

At the measured 1% rate, a recruiter handling 746 applications would see about 7 injected resumes a year. If the self-reported 20% rate were real, it would be about 150. Treat both numbers as illustrative. Either way, a recruiter who has opened one parsed resume with a pasted job description in it will recognize the next one right away.

That workload explains why applying feels like shouting into a void, and why people reach for hidden text in the first place. Greenhouse's Chief People Officer, Sharawn Tipton, put it this way: "The application used to be a front door. Now, too often, it's a dead end." When dozens of careful applications get no reply, a trick that promises to get you past the bot starts to look reasonable. It doesn't fix the silence. It just changes what the recruiter sees when your file is finally opened.

Could your resume template already contain hidden text?

Yes. The Duke researchers note that applicants might not even know a template they use contains prompt injection commands. Downloaded templates and files copied from someone else's resume are the most likely places to find it.

Your intentions don't matter here, because the parser shows the text either way. Run the paste test before your next application:

1. Open the exact file you're about to submit, whether PDF or DOCX, not the version in your editor.
2. Select all, copy, and paste into a plain-text editor (Notepad, or TextEdit set to plain text).
3. Read it top to bottom. If you can't find a line on the visible page, it's hidden text.
4. Look for the usual hiding places: white or tiny fonts, text boxes behind images, headers and footers, and leftover placeholder text from the template.
5. Delete what you find, export the file again, and paste again until the plain text matches the page.

This takes about a minute. It also shows you whether your real content parses in a sensible order, which matters more than any hidden line.

Where should those keywords go instead?

Put them in your visible skills section and in bullets that show where you used each one, but only if they're true. The same words you were going to hide do more for you when a recruiter can read them next to evidence.

The Greenhouse survey already shows which version is legitimate. The most common tactic, used by 54%, was using AI to work out what the screening system wants. That's research, and it's fine. The risky one was the 40% who added skills or keywords they don't have. Hidden or visible, that claim falls apart in the first technical question.

Here's how to use the keywords properly:

• Match the posting's exact phrasing for skills you actually have. If the posting says "stakeholder management," don't write "managing partners."
• Tie every priority keyword to a bullet that names what you did with it and what happened as a result.
• Leave out requirements you don't meet. If you have something close, explain the overlap in the cover letter.
• Write one version per posting. A generic resume with every keyword you've ever seen reads like the hidden slab, just visible.

Doing this for every application is the slow part, and it's the part Refolk handles. Refolk builds your resume from your own work history, then rewrites it for each posting you paste in, so the posting's keywords land in bullets you can defend in an interview. It also scores how well you actually fit. That way you see which requirements you can't back up before you apply, instead of being tempted to cover them with hidden text.

This also helps with the other big finding in the report. 77% of US respondents used AI in their search, yet 60% have changed or considered changing how they write so their application isn't mistaken for AI. A block of hidden keywords is about as machine-written as text gets. Specific bullets with your real numbers and project names are the opposite. When Refolk drafts the cover letter, it works from that same history, so the letter sounds like you and not like the posting read back to the recruiter.

FAQ

Will an ATS automatically reject a resume with white text?

Not always. The outcome depends on the platform. The more reliable consequence is exposure: parsing removes the formatting, so the hidden text sits in the record where a recruiter can read it. Some platforms go further. Indeed checks for hidden or obscured text and sends suspicious resumes to trained human reviewers, so you end up in front of the exact person you were trying to get past.

Is hiding keywords okay if they're all true?

There's no reason to do it. If the keywords are true, they belong in your visible skills and bullets, where they help with both the screener and the recruiter. Hidden, they look exactly like the fabricated kind, because a parser can't tell honest hidden text from dishonest hidden text. Either way, the recruiter sees an attempt to game the system.

Does "ignore previous instructions" work on AI resume screeners?

Rarely, and less as defenses improve. Over 90% of real injections don't even use explicit instructions, and platforms are building defenses aimed at the ones that do. Indeed found that separating resume content from the AI's instructions dramatically reduced vulnerabilities and in some cases eliminated them. Detection costs about $0.0001 per file, so assume every file gets checked.

How do I check if my resume has hidden text I didn't add?

Paste your final PDF or DOCX into a plain-text editor and compare it line by line with the visible page. Anything that appears in the paste but not on the page is hidden. Templates are the usual source, and the Duke researchers note that applicants may not know their template carries injected text. Remove it, export again, and run the test once more before you submit.