Hacking AI Resume Screening with Text in a White Font

The Washington Post is reporting on a hack to fool automatic resume sorting programs: putting text in a white font. The idea is that the programs rely primarily on simple pattern matching, and the trick is to copy a list of relevant keywords—or the published job description—into the resume in a white font. The computer will process the text, but humans won’t see it.

Clever. I’m not sure it’s actually useful in getting a job, though. Eventually the humans will figure out that the applicant doesn’t actually have the required skills. But…maybe.

Posted on August 1, 2023 at 7:11 AM28 Comments


wiredog August 1, 2023 7:20 AM

Eh, it’s useful when the posting “requires “ 5 year’s experience in a technology that is 2 years old.

Seinfeld August 1, 2023 8:27 AM

The resume screeners brought it on themselves with unrealistic requirements as pointed out by wiredog. I would have no problem with an actually qualified applicant using this to get past the barriers that so commonly keep good people out of work.

Ted August 1, 2023 8:51 AM

The hiring teams are phoning in: “Uh, maaybe not Padawan.”

I see the WaPo benevolently offers some less precarious ‘hackity hacks’ for AI job screenings – even to run a resume thru ChatGPT to optimize it with specific keywords.

I just asked ChatGPT for keywords for an Astronaut resume and got some surefire winners, a few being: Orbital Mechanics, Extravehicular Activity (EVA), and Space Suit Operations. Now how to make a few segues 😄


Graham Clark August 1, 2023 8:57 AM

I was told about this some years ago by someone who said that it was successful because the HR people eventually got so curious about this guy whose CV kept popping out of the system that they gave him an interview in to find out why the computers liked him so much. One of the times this happened they were impressed enough to offer him the job.

I’ve no proof that any of it happened, obviously.

Grumpy Old Coot August 1, 2023 9:33 AM

I would modify this technique to use “cheap and lazy steganography” where you hide the white text under strike-out/underline/over-line characters that are the same color as the main text. Much less obtrusive compared to having a block of oddly sized white-space on the document. MS Word can only go down to 8pt text. Or if you really want to get creative, hide the ‘white’ text under your header/footer bars.

ezedogg02 August 1, 2023 9:36 AM

Seems like a useful hack for jobs you’re qualified for but the automated scanners would pass you on because the keyword matching fails. Rather than rebuild your resume to satisfy the keyword matches, you do this instead to increase your odds of getting to the actual technical evaluation stage of the process.

Andrew Ross August 1, 2023 9:37 AM

The problem with this is that there’s a risk that the program that screens the resume is also stripping the formatting from the resume, exposing your trick to the first human who sees it.

Steve August 1, 2023 10:05 AM


Eventually the humans will figure out that the applicant doesn’t actually have the required skills.

Hey, dodging that describes most of my career.

Smoke, mirrors, and handwaving will get you through an awful lot. . .

My Probation Oficer & FBI Know Who I Am August 1, 2023 10:54 AM

Wonder if anyone tried throwing something as ancient as “.hiddensong.mp3” (file name being just a random example) at ChatGPT to check whether it “sees” the hidden file? I don’t use ChatGPT so just curious? Thanks for any input.

jedb August 1, 2023 11:00 AM

Eventually the humans will figure out that the applicant doesn’t actually have the required skills.

The flaw in this view, and perhaps Andrew’s to a lesser degree, is the assumption that the skills listed as “requirements” in the job posting are actually required. In my experience: at medium-to-large companies, the people who are trying to hire employees often don’t quite know where that stuff comes from. Probably someone in the Human Resource department trying to feel useful. Like, we ask them to find us a senior programmer who knows the Rust language, and they think “senior, well, that’s gotta be about 20 years of experience, right?”. And then, as wiredog hints at, our ad then asks for “20+ years” of experience in a language that’s existed for 8, when we hadn’t even specified a number. (Anyone who thinks this is some clever trap to disqualify liars is vastly overestimating the amount of intelligence involved.)

When I was scheduled by a manager to help them interview a candidate, I generally just got a resumé. I didn’t see the listing, I don’t know whether the manager did, and it never came up in the interview. Nor did I care about the specific numbers, or the listed skills that didn’t seem relevant. People—especially “HR” people, I suspect—over-emphasize the importance of applicants knowing about the exact stuff we’re working with. One company even used an in-house language, and new hires always figured it out pretty quickly.

I recall two particularly useful at-home exercises we’d mail applicants between the phone and in-person interviews. One: critique this software interface, being a page or two of function definitions with brief “Javadoc-style” comments. Two: here’s a multi-threaded program that fails because it’s missing synchronization; fix it. For the second one, people might be surprised how often we got code that didn’t compile, or that immediately crashed when run. (I always thought that was something one could bang out in an hour, if not 10 minutes, but the manager always told applicants it would take about a day. And it was rare to get a program with no significant flaws—or, for the critiquing example, feedback that would let one transform it into a good interface.)

Clive Robinson August 1, 2023 11:03 AM

@ Andrew Ross, ALL,

“…there’s a risk that the program that screens the resume is also stripping the formatting from the resume, exposing your trick…”

Re formating is generally not,changing the colour of the text…

But I guess from now on colour changing will get added.

Which suggests other tricks will be tried.

Some “Word Pro” formats us HTML and some HTML tags can hide a lot of text.

So if the HTML tags get deleated before the colour change…

I can see this becoming another


Which means of course “little bobby tables” will get a look in 😉

jedb August 1, 2023 11:56 AM

Also, the idea that a resumé represents reality has long been the butt of jokes. I don’t know how common lying is, or how serious Steve is, but there’s probably a pretty good chance of getting away with it. At least for long enough to get hired. Not that “fake it till you make it” is only for job applicants—entire Silicon Valley companies seem to have followed that “advice”.

Anyway, for your amusement…

[Alex Papadimoulis – Hacking the Workplace: How to Make the Most with the Least – Notacon 8 / 2011] @ 22:21

Tailor your resumé to exactly the job description. In fact, copy-paste the job description into Word, or whatever, and then just take bullet points and make it as that. Make yourself look like the perfect candidate. Um, your expertise? Let’s put it this way. If you’ve heard of what the technology means—maybe I know “SOA” is Service-Oriented Architecture—you are now an expert at it. As am I; that’s what expertise is, right?

Um, the other thing about working at places—I mean, what is really work, after all? Have you bought some— have you heard of the place? One might arguably say that you’ve worked there. And when you do that, try to pick a place that they’ll never catch that you never actually worked there. Uh, places that went out of business, gold mine. ‘Cause you cannot call to verify that. This is important stuff, right?

[The Simpsons – S04E07 / 9F05 – Marge Gets a Job] @ 7:06

Marge: Well, Lisa, I finished my resumé. (paper reads “Marge Simpson / Resume / Homemaker: 1980 to present”)
Lisa: Uh, I think it needs a little padding.

Marge: chauffer, seamstress… curator of large mammals? … Oh, I see.
Lisa: Mom, they expect you to lie a little.
Marge: Worked for the Carter administration‽
Lisa: Well, you voted for him, twice.

Smithers (reading resumé in front of Marge): Mm-hmm… uh-huh… oh, I though Muddy Waters wrote that song. … Let me be the first to say “Kadibu kazini.”
Marge: What?
Smithers: “Welcome aboard.” I guess my Swahili’s not as good as yours.

[Seinfeld – S08E06 – The Fatigues] @ 1:22

George: Steinbrenner wants everyone in the front office to give a lecture in their area of business expertise.
Jerry: Well, what makes them think you’re a risk management expert?
George: I guesss it’s on my resumé.

jedb August 1, 2023 1:04 PM

jones, this is still how search engines, including Google, are gamed—except now via CSS or Javascript instead of direct HTML tags.

Haven’t you ever gotten a link to some “experts” or “answers” site, or a news article, only to see a paywall instead of the promised text snippet? You might see that text if you turn off stylesheets and/or Javascript.

(In some cases, I think sites are serving entirely different pages to search engines, based on user-agent strings or IP addresses, because that text just isn’t there. In other cases, the text is there and not even hidden—but, in context, is clearly auto-generated bullshit in an entire web of bullshit pages.)

K.S. August 1, 2023 1:16 PM

I think with boomers retiring, the days of multiple qualified applicants applying are about to be over. In the next 10 years HR will have to worry not how to screen resumes, but how to get qualified people that already have a decent job to apply or how to in-house train people to do the job.

iAPX August 1, 2023 3:33 PM

Some recruter are so… That maybe a real list of keywords in plain sight for them to check is anyway better than a real resume!

The problem with a résumé is that it will be read by recruter that don’t know anything about technology, filtering by keywords, except in rare notable cases, by the HR that are less interested by the keywords than the journey, and by people doing your work (wether at your level or upper-level), that will be interested by what you really did with these technologies.

It is very difficult with one resume to please all of them, and as for anything in life, it’s all a matter of compromise. No magic solution.

iAPX August 1, 2023 4:04 PM

Last word about résumé, that is very sad for some of us that are very experienced with a long and interesting career.

You have to truncate it to the lasts 25 years, whatever powerful or incredible you have done before, mine is 40 years long as I began selling my work while teen.

This is really sad.
I encountered a ex-VAX developer in his sixties, a very competent person, autonomous and at ease with current technologies, someone that would have been a role model for me.
I was the CTO, and I chose him for his qualities over younger programmers, and it didn’t deceived me in any way. A great fellow programmer.

The CEO, a friend with a strong character, thought I was gaming him, and fired him. One week later I was out too.
We, old programmers or old anything, we are disregarded even when competent and competitive!

Phillip August 1, 2023 10:14 PM

It would help if there were more standardization within the HR industry as a whole. The whole thing is kind of a joke. OTOH, the learning curve is pretty steep for some skills, so one can understand why a company might screen candidates this way. The problem is many companies ignore a training budget.

Peter A. August 2, 2023 4:50 AM

Everyone has one’s own tricks. Over here, screening for sensible technical positions is probably much less automated than on the other side of the pool. My trick is getting a distinct, but clear layout that stands out of a thousands of resumes crafted in MS Word or similar.

My trick is using LaTeX with CM font and some fancy packages for color and layout plus a little manual tweaking. Whoever had used (La)TeX for some time can spot it from two desks away, and it is a sure way to get invited to a tech talk, which gets you a job – or not (honest mismatches happen, quite often). Even non-LaTeX people can see it is somehow different. In fact, I got openly complimented for the layout by the recruiter in one or two cases.

Clive Robinson August 2, 2023 6:28 AM

@ Bruce, ALL,

Re : And now with Uni-code and more punch.

Actually it’s a bit more serious than potentially fraudulently pushing your CV past an HR department.

From Prof Ross j. Anderson and friends[1] over at the Cambridge Computer lab blog,


The idea uses two things,

1, Issues with unicode.
2, Getting a user to copy the bad string as a search into LLM’s etc.

“By imperceptibly perturbing text using uncommon encoded representations, adversaries can control results across search engines for specific search queries. We demonstrate that this attack is successful against two major commercial search engines – Google and Bing – and one open source search engine – Elasticsearch. We further demonstrate that this attack is successful against LLM chat search including Bing’s GPT-4 chatbot and Google’s Bard chatbot. We also present a variant of the attack targeting text summarization and plagiarism detection models, two ML tasks closely tied to search.”

The important point to note is,

“We provide a set of defenses against these techniques and warn that adversaries can leverage these attacks to launch disinformation campaigns against unsuspecting users, motivating the need for search engine maintainers to patch deployed systems.”

Expect to see a lot more papers like this under the,

“Old Wine in New Bottles”

That currently appears to be the main idea driving various malware attacks.

[1] The paper,

“Boosting Big Brother: Attacking Search Engines with Encodings”

Nicholas Boucher, Luca Pajola, Ilia Shumailov, Ross Anderson, Mauro Conti


JeR August 2, 2023 11:50 AM

“The computer will process the text, but humans won’t see it.”

In my experience from job hunting a few years ago, the first person to see the white-on-white text in proverbial black-on-white is the person who has just uploaded the CV.

The “processing” involves summarising your resume automatically and then presenting you, still on that website that you just uploaded the document to, with all the items of interest it found, and then you go through the list and are required to acknowledge each and every one of them. And then you sign off the summary of your resume. And then the summary may get passed on to humans.

I fail to see how the hack could possibly work. Also, I now know why I had to go through that process so many times.

Andy August 3, 2023 2:58 PM

To get hired, you only need four words on your resume, depending on job level:

management position: Friend of the boss
staff position: the boss likes me

a truly smart AI should pick it up and put you on the top of the stack.

ElCliquy August 15, 2023 8:36 AM

Open the document, then just “select all” text and the white text will be highlighted, so visibile by humans.

WhiskersInMenlo September 13, 2023 1:12 PM

Hidden in this are critical aspects of what to put in a resume.

There is a classic training where one repeats the question and then answers.
This applies to spoken and written dialogues.

I watch for it and other disagreement argument tricks in current political discourse. I doubt AI filters will move the BS filter score beyond near-zero on: network news, political stump speeches and debate. Companies are under pressure to fill check boxes so select text that does not raise your own objections while still checking many company objective boxes.


Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.