Hidden Prompts in Manuscripts: What the AI Peer Review Exploit Means for Medical Authors

Peer review has never been perfect. Reviewers miss errors, carry biases, and sometimes fall short of the thoroughness a manuscript deserves. What it has always assumed, though, is that the document in front of the reviewer is what it appears to be: a scientific paper, not a file that has been engineered to override the evaluator's judgment. That assumption is now under pressure in ways no one anticipated two years ago.

Prompt injection, a well-known attack technique against large language models, has arrived in academic publishing. The idea is straightforward. A manuscript PDF contains hidden text, invisible to human readers because it is formatted in white on a white background or rendered at a microscopic font size. That text consists of instructions directed at any AI system that processes the document: instructions that tell the AI to overlook weaknesses, inflate scores, or simply write a positive review. If the journal is using an AI tool to assist with initial screening or review, those instructions can take effect without anyone noticing.

What Zhicheng Lin Found in July 2025

The first systematic account of this practice in academic manuscripts came from Zhicheng Lin, affiliated with Yonsei University and the University of Science and Technology of China. In a paper posted to arXiv in July 2025, Lin reported finding 18 manuscripts on the arXiv preprint server that contained hidden instructions targeting AI-assisted peer review. A targeted search using terms such as "GIVE A POSITIVE REVIEW" combined with site-specific operators was enough to surface them.

The papers came from 14 universities across eight countries, including institutions in Japan, South Korea, China, Singapore, and the United States. Prominent names in the affected list included Waseda University, the Korea Advanced Institute of Science and Technology (KAIST), Peking University, and Columbia University. Lin identified four distinct types of hidden prompts. The simplest were blunt commands, the kind of instruction a child might type into a chatbot. The most elaborate were detailed evaluation frameworks that tried to redirect an AI reviewer toward specific criteria and away from others, dressed up to look like legitimate assessment guidance.

The author responses made the picture more complicated. One paper's authors announced they would withdraw their manuscript. Another author defended the practice as a way of testing whether reviewers were using AI in violation of conference policies, framing it as a counter-measure rather than misconduct. A third called it an experiment in reviewer compliance. Lin's paper categorized the practice as a novel form of research misconduct, regardless of stated intent. The rationalization that you were testing the system does not change the structural effect: the file was designed to subvert evaluation.

Searches of other preprint servers including SSRN, PsyArXiv, bioRxiv, and medRxiv returned no results at the time of Lin's search. That finding should be read cautiously. The absence of detected cases on bioRxiv and medRxiv does not mean the technique has not been used in medical and biological sciences. It means the search conducted in mid-2025 found no instances. The same white-on-white technique that evaded detection on those platforms would evade casual visual inspection by any journal editor or reviewer.

The Experimental Evidence: What Happens When Injection Works

Understanding that hidden prompts exist is one thing. Knowing how effective they are is another. A quality improvement study published in JAMA Network Open in 2026 provided the clearest experimental data yet. Researchers tested the vulnerability of leading commercial large language models to invisible text injection in a simulated medical peer review setting. They inserted concealed instructions into manuscript files, directing LLMs to evaluate the papers positively and recommend acceptance without revision.

The findings were not subtle. Acceptance rates in the injected condition rose from 0% to between 99.2% and 100% depending on the model tested. Scores inflated substantially. The injected LLMs also showed significantly impaired ability to identify scientific flaws in the papers they were reviewing, which is perhaps the more alarming finding. A review that recommends rejection but notes specific problems at least informs revision. A review that endorses a methodologically weak manuscript and fails to flag its weaknesses leaves authors, editors, and ultimately readers with a false picture.

A separate preprint posted to medRxiv in July 2025, titled "Invisible Text Injection: The Trojan Horse of AI-Assisted Medical Peer Review," extended this analysis specifically to medical journals. That paper, which later appeared in PubMed-indexed form, examined the intersection between invisible text attacks and the AI assistance tools that an increasing number of medical journals are either piloting or considering. Its recommendations called for enhanced safeguards and human oversight as prerequisites for any deployment of LLMs in medical peer review.

ICML 2026: The Technique Used in Reverse

In March 2026, the International Conference on Machine Learning (ICML) disclosed that it had used the same hidden-prompt technique, but in the opposite direction. Rather than authors hiding instructions to manipulate reviewers, the conference organizers had hidden instructions in submitted manuscripts to detect reviewers who were using AI.

The method worked as follows. Program chairs modified each submitted PDF to contain machine-readable instructions invisible to human readers but interpretable by any large language model processing the file. The instructions directed any AI system to include two specific phrases in its review output, with those phrases drawn randomly from a dictionary of 170,000 entries. Reviews returned by human reviewers would contain no such phrases. Reviews generated or substantially mediated by AI tools would, under most conditions, include them.

The result: ICML desk-rejected 497 papers after identifying 506 reviewers whose submissions contained the watermark phrases. The success rate exceeded 80% across most tested models. The family-wise error rate was approximately 0.0001, meaning the false positive rate was negligible. All 506 flagged reviewers had explicitly agreed to Policy A before accepting their assignments, a choice that committed them to not using AI in their review. They agreed, then violated that agreement.

ICML is a computer science conference, not a medical journal, and its reviewer population skews toward people who work on the very AI systems being exploited. The numbers are nonetheless worth noting, because they establish that AI-assisted review misuse is not a theoretical edge case. More than 500 reviewers at a single major conference violated their declared commitments. The rate of undeclared AI use in medical journal review is unknown, but there is no principled reason to assume it is lower.

Where Medical Journals Stand on AI in Peer Review

Among the top 100 medical journals, 46% now explicitly prohibit AI use in peer review, according to a study analyzing published reviewer policies. Another 32% permit limited AI use under specific conditions, typically restricted to grammar checking or translation, with a prohibition on using AI to generate substantive review content. The remaining 22% provide no guidance at all, which effectively means reviewers in those journals face no written policy to violate.

Elsevier and Cell Press maintain strict prohibitions on AI use in peer review, citing both confidentiality risks and the fundamental importance of human expertise in evaluating scientific claims. Their position is that a peer review signed by a human reviewer must represent that reviewer's own assessment. The ICMJE's April 2025 guidelines took a similar posture, stating that confidentiality means a manuscript under review must not be uploaded to any external system, including AI platforms, because doing so could expose unpublished data to third parties.

None of this directly addresses the hidden-prompt problem, because hidden prompts target AI systems that journals might themselves be deploying, not just AI being used surreptitiously by reviewers. As medical journals increasingly pilot AI-assisted triage, preliminary screening, and review support, the threat surface grows.

What This Means for Medical Authors Who Are Not Doing This

Most medical authors reading this have not embedded hidden prompts in their manuscripts and have no intention of doing so. The reason to understand this problem anyway is that it shapes what is coming in journal submission policies, what may affect your file in transit, and what editors are now watching for.

On the policy side, the hidden-prompt problem is likely to accelerate two changes that journals were already considering. The first is submission portal screening. Several journal submission systems are now evaluating automated tools that scan uploaded files for common prompt-injection signatures, such as white-on-white text blocks, near-invisible font sizes, and character encoding tricks that render text invisible in a PDF viewer while remaining parseable by an LLM. If your submission passes through such screening, a false positive (however unlikely) could trigger a review of your file. If your institution's in-house manuscript preparation tools have auto-formatted anything unusual, that is worth checking before you upload.

The second change involves the AI tools journals use for initial processing. Several journals now use LLMs for metadata extraction, plagiarism-adjacent similarity scoring, or preliminary topic classification. If those tools are vulnerable to injection, a malicious actor submitting in the same batch as your paper could theoretically contaminate the processing environment in ways that affect your submission. This is a speculative risk at present; no confirmed cases of that kind of cross-submission contamination have been documented in medical publishing. But it is precisely the kind of systemic risk that motivates the recommendations coming out of the medRxiv and JAMA Network Open studies.

More immediately practical: if you are reviewing manuscripts for any journal and you have not read that journal's current policy on AI use in review, read it now. The ICML case demonstrated at scale that reviewers who think they are using AI as a helpful drafting aid are simultaneously violating explicit commitments they made at assignment. Medical journals face the same dynamic. A reviewer who uses Claude or ChatGPT to draft a review of your manuscript may be doing something that invalidates that review under the journal's terms, which creates editorial complications that ultimately slow your paper.

Why Hidden Prompts Constitute Research Misconduct

The COPE guidelines define research misconduct to include falsification, fabrication, and plagiarism, but also any action that improperly influences the peer review process. Embedding hidden instructions designed to manipulate an AI-assisted review system fits squarely within that last category, regardless of whether the author knew the specific journal was using AI at the time of submission.

The rationalization that emerges most often in cases where authors have been asked to explain their hidden prompts is that the technique was experimental or that it was intended to expose a flaw rather than exploit it. These arguments do not hold in any other domain of research integrity. You cannot fraudulently alter data to demonstrate that a journal's data verification process is weak. You cannot plagiarize text to show that a journal's plagiarism detector has gaps. The intent to expose a vulnerability does not constitute authorization to exploit it. Publishing a paper with hidden prompts embedded in the file sends an unvetted manuscript into a peer review process that has been sabotaged before it begins.

The practical consequence for authors considering this technique, for any reason, is that the risk calculus is poor. Detection is becoming easier as submission systems add screening. If detected, the outcome is at minimum desk rejection and potentially a formal misconduct finding. The author who described the technique as testing reviewer compliance found their rationalization published in international commentary as an example of exactly the kind of motivated reasoning that integrity bodies are now being asked to address.

What Journals and Submission Portals Are Being Asked to Do

The PubMed-indexed paper "Hidden Prompts in Manuscripts Threaten the Integrity of Peer Review and Research: Recommendations for Journals and Institutions" offers the most comprehensive set of technical and policy proposals to date. Its core argument is that technical safeguards represent the most immediate line of defense. Submission portals should implement automated scanning for common injection techniques before a manuscript is assigned for review. Journals should include explicit language in their submission policies prohibiting hidden text instructions of any kind. Institutions should incorporate hidden-prompt manipulation into their research integrity training, alongside fabrication and plagiarism.

The medRxiv paper on invisible text injection in medical peer review makes an additional recommendation that is more specific to journals using AI in their own editorial workflows. It calls for enhanced human oversight as a mandatory backstop: no AI-assisted screening tool should be the final word on a manuscript's disposition without human verification of the key assessment. This is a more conservative position than many journals are currently taking, but the experimental evidence supports it. When injection worked in the JAMA Network Open study, it worked comprehensively enough that an AI-only review pathway would have passed manipulated manuscripts at near-perfect rates.

A Practical Pre-Submission Check for Authors

Most honest medical authors will never intentionally embed hidden text in a manuscript. The practical risk for those authors is inadvertent rather than deliberate. Certain academic writing tools, PDF conversion pipelines, and collaborative editing workflows can produce artefacts in the final file that include invisible or near-invisible text layers. These might include tracked changes not fully accepted, comment metadata embedded in the document body, background text from template placeholders, or watermarks from institutional manuscript systems.

Before submitting to any journal that uses AI-assisted processing, it is worth opening your final PDF in a viewer that allows you to select all text (Command-A or Control-A) and pasting the full contents into a plain-text editor. If you see text that does not match your manuscript, you have an invisible layer that needs to be resolved. This takes five minutes and removes any possible ambiguity about what is in your submission file. It is also worth running the PDF through Adobe Acrobat's accessibility checker, which surfaces hidden text as an accessibility deficiency and will flag content that a standard visual review misses.

If you are corresponding author for a large collaborative manuscript, ask whether any co-author contributed sections that were prepared using AI writing assistants that embed formatting metadata. These are unlikely to include anything that functions as a prompt injection, but the same careful review applies. Anything you cannot see but a machine can read is something you are responsible for having in the submission file.

The Longer View

The hidden-prompt problem is a specific instance of a more general challenge facing academic publishing: the peer review system was designed for a world where the document is what it appears to be and the reviewer is who they say they are. Both of those assumptions are now contested. AI is being used by reviewers to generate reviews they present as their own. AI is being targeted by hidden instructions in manuscripts. AI is being deployed by journals to supplement a process that is under strain from reviewer shortages and submission volumes that have grown faster than the available reviewer pool.

None of these trends is reversible in the short term. What is possible is that journals, authors, and institutions develop clearer norms faster than the exploitation of those gaps accelerates. The ICML watermarking approach, despite its ethical controversy, showed that enforcement is technically feasible when journals are willing to design systems that verify reviewer behavior rather than relying solely on signed commitments. Medical journals will not all follow ICML's lead on hidden watermarking, but the underlying logic that verification matters more than policy text alone is likely to influence how the field develops over the next several years.

For medical authors, the actionable implication is straightforward. Understand what AI tools your target journals are using. Read the current policies on AI in review, not to find loopholes but to understand what the editor is watching for. Check your final PDF for invisible content. And recognize that a peer review system worth submitting to is worth protecting, even when it is slow, uneven, or frustrating, because the alternative being demonstrated by hidden-prompt manipulation is a system that functions as a formality rather than a genuine check.

Further Reading