HiddenInk
A resume security tool that detects hidden prompt injections aimed at AI screeners and gives recruiters a clean, human-visible version to review.
Project Details
About the Project
What if a resume could quietly tell the AI screening it to rate the candidate 10 out of 10?
More companies now let AI read resumes before any human does, and some candidates have noticed. They hide instructions in white text, 1-point fonts, text pushed off the page or invisible Unicode characters. The recruiter sees a normal resume, but the AI reads the hidden line and often obeys.
I built HiddenInk to catch this prompt injection aimed at hiring, which is unfair to every honest applicant. It scans a PDF or Word resume, shows recruiters exactly what their AI is reading, and gives them a clean version that is safe to screen.
How It Works
HiddenInk answers three questions for every resume:
- Is there hidden content? — it looks for invisible-colour text, tiny fonts, off-page and covered text, hidden Word runs, metadata, annotations, embedded files, and zero-width or Unicode-tag characters, which it decodes;
- What is it trying to do? — each hidden fragment is classified as prompt injection, data exfiltration, keyword stuffing or harmless, with an explainable 0–100 risk score and a verdict of Clean, Suspicious or Poisoned; and
- What would a safe AI screener conclude? — a protected screener reads only the sanitised, human-visible text, must back every score with a quote that really appears in the resume, and trips a wire if hidden text leaks into its answer.
The Visibility Gap
At the file level, PyMuPDF compares each character's colour with the rendered background and checks font size, page bounds, render mode and draw order. Separately, each page is rendered and a vision model transcribes only what a person can actually see. Anything the file contains but the vision model cannot see is flagged, with rapidfuzz aligning the two texts.
On top of that sit an LLM classifier with strict JSON schemas and embeddings that match new attacks against confirmed ones. Hidden text is always treated as untrusted data, wrapped in random delimiters and never followed. Regex patterns and forensic facts set a deterministic safety floor, so the AI layers can only raise a risk score, never talk it down, and cached AI answers mean the same file always gets the same result.
Keeping Humans in Charge
HiddenInk never rejects anyone on its own: it flags, explains and leaves the final call to the recruiter. Around the scanner sit a review log, a confirmed-attack library, a Red-Team Lab that generates new randomised attacks to test the detector, and a live Evaluation page.
Scans are deleted automatically after 30 days and no resume text is stored. Only hidden attack text, scrubbed of personal details, goes into the attack library.
Project Satisfaction
I'm most proud that HiddenInk doesn't trust a single AI model: file forensics, a vision model and an LLM classifier all cross-check each other. My favourite moment came in the Red-Team Lab I built to attack my own tool, where the same poisoned resume fooled a normal AI screener but not HiddenInk's protected one, because it can only score evidence it can quote from the visible resume.
Biggest Challenge
Standard PDF text extraction silently drops some hidden text, such as text placed off the page, so I switched to low-level, character-by-character analysis matched against the page's drawing order, which also caught text hidden under shapes. In the Red-Team Lab, I also had to make sure a generated attack was truly invisible to a human before it counted. All of this ran on a $1 API budget, so I relied on caching, smaller models for simple tasks and limits on the free trial.
Key Takeaway
Prompt injection isn't only a chatbot problem: any document an AI reads is an attack surface. I also learnt that the safest AI systems don't rely on the model alone. Deterministic checks, grounding in verifiable evidence and a human in the loop matter as much as the model does.