📄 Hidden Prompts in Manuscripts Exploit AI-Assisted Peer Review

Summary

The paper looks at a new way to game AI-assisted peer review: authors hide instructions for language models inside their manuscripts, which is a form of indirect prompt injection. Following a July 2025 Nikkei Asia report, Lin searched arXiv, other preprint servers and Google Scholar. He found 18 arXiv papers containing invisible text, set in white or tiny fonts, that pushes LLM reviewers toward praise. He sorts these prompts into four types and links them to earlier attacks on Bing search and résumé screening. He also summarizes evidence that such injections usually work. He rejects the defense that the prompts are traps for careless reviewers, because every instance benefits the author. Instead, he classifies the behavior as a questionable research practice (QRP). Publisher rules conflict: Elsevier bans AI in review, while Springer Nature allows limited, disclosed use. Lin therefore recommends controlled AI integration, automated screening of submissions, researcher training and enforceable penalties. The problem matters beyond reviewing, since citation indexing, plagiarism checks and literature summarization share the same weakness.

Key points

• What was found: The search on July 7, 2025 identified 18 arXiv papers, one more than the press had reported. SSRN, PsyArXiv, bioRxiv, medRxiv and published peer-reviewed work showed no cases. The author treats the count as a lower bound.
• Four prompt types:
  • plain positive-review commands (10 papers)
  • acceptance recommendations (3)
  • a combination of both (2)
  • a detailed template dictating strengths and minor weaknesses (3)
• Evidence from cited studies:
  • hidden instructions succeed about 98.6% of the time across models
  • success stays above 94% even after human paraphrasing
  • injected text can raise review scores from 5.34 to 7.99
• Author's own test: the prompts had no effect when the model was explicitly asked for a critical review.
• Policy landscape: Among the top 100 medical journals, 46% ban AI in review, 32% allow limited use and 22% give no guidance. Elsevier and Cell Press prohibit it, while Springer Nature and Wiley permit it with disclosure.
• Proposed safeguards:
  • AAAI-26 attaches an unscored AI review to every paper
  • the OCR Consistency Test can expose hidden text in submissions
  • journals could plant benign prompts asking for homoglyphs (e.g., a Cyrillic "a"), which would then reveal reviewers who used AI without permission