Should You Hide an Instruction to Trap AI-Written Applications?

Who does a hidden instruction actually catch?

Whoever proofread least. If the line is genuinely invisible, the only application it fires on is the one where the model's draft went out unread. A candidate who reads what the assistant gives back deletes the odd word and passes clean. A candidate who wrote every word by hand never saw the line at all, so they produce no hit either.

The other version of the tactic inverts on you. Leave the instruction readable but bury it deep in the requirements, and an assistant handed the full posting follows it every time, because following a stated instruction inside a document is the thing it is best at. The applicant who misses it is the one reading at the end of a long day. That is a compliance test AI passes and tired humans fail.

Either way, the output is one bit where you wanted a judgment. Included the word, or didn't. What you want to know is whether this person checks a confident claim before it reaches a client, and no property of the artifact answers that. Someone can echo your trap word and still be the most careful thinker in the stack. Someone else can strip it cleanly and verify nothing for the rest of their career.

Nothing tells you which of those you are holding, because a clean application has too many explanations. If nobody trips the line, it might mean nobody used AI, or everybody proofread, or the job board reflowed your posting and dropped the sentence before a single candidate saw it. A screen that cannot separate a pass from a failure to deliver is not a screen, and you will not find out afterwards which one you ran.

What does hiding the line do to your posting?

It decides which candidates can read your posting at all, and the two ways of hiding a line fail in opposite directions. Content hidden with display:none or visibility:hidden is, in WebAIM's words, "removed from the visual flow of the page and is ignored by screen readers" ³, so a blind applicant never meets your instruction. Position it off-screen and "screen readers will read it" ³ while sighted readers do not.

There is no third technique that reaches everyone equally, because reaching everyone equally is the thing you are trying not to do. Whichever one you pick, some candidates are answering a different posting from the rest, and which group that is falls out of the assistive technology they use rather than out of anything about the job.

The listing most candidates see is not your page anyway. Google's job posting documentation says the feature "recognizes the following HTML tags: <p>, <ul>, and <li>" and does not recognize character-level tags ⁵. Three tags are recognized there and none of them is a way to make text invisible. The same page requires that "all information in the markup must be visible on the job page" ⁵, which is the reverse of what a trap is for.

Google's spam policies name your exact techniques too. Hidden text abuse is defined as "the practice of placing content on a page in a way solely to manipulate search engines and not to be easily viewable by human visitors", with "Using white text on a white background", "Using CSS to position text off-screen" and "Setting the font size or opacity to 0" given as examples ⁶. A trap line is not aimed at a search engine, so it may sit outside that definition, and the only carve-out for text that stays invisible covers text that exists only for screen reader users and is meant to improve their experience ⁶, which a trap is not either. That leaves an automated system deciding what you intended, on a document whose whole job is to be found.

The plumbing has a vote, too. Postings get syndicated, and boards, aggregators and ATS ingest pipelines sanitize markup on the way in. A careful white-on-white sentence can arrive at part of your audience as ordinary black text sitting in the middle of the requirements, where it reads as a typo or as an instruction the candidate had better follow. Part of the channel gets a trap and the rest gets a strange sentence.

Why does the trap stop working so fast?

Two clocks run against it and neither one is yours. A phrase planted in text a model retrieves is indirect prompt injection, the technique named in Greshake and colleagues' 2023 study of LLM-integrated applications, where adversaries exploit an application remotely by "strategically injecting prompts into data likely to be retrieved" ². Assistants are being hardened against exactly that behavior. The second clock is your applicants, who talk to each other.

Postings circulate. One screenshot in a subreddit, one thread on a careers Discord, and everyone applying to that role knows the word. The people most likely to be in those channels are the ones already following hiring closely, which is again not the population you set out to sort. A trap that is public knowledge selects for being plugged in.

The artifact arms race has already run this experiment in public, and the detector lost. Seven detectors, run over 91 TOEFL essays written by non-native English speakers, produced a 61.3% average false-positive rate; at least one detector flagged 97.8% of those human-written essays as AI generated, all seven agreed on 19.8% of them, and the same tools "accurately classified the US student essays" written by eighth-graders ¹. The study also reports that "a simple manipulation in prompt design can easily bypass current GPT detectors" ¹. The full version of that question is whether AI detectors work at all in hiring, and the answer has not improved since.

The pattern holds for anything that tests the artifact rather than the person. Whoever produces the artifact gets to iterate, and you find out months later, from nothing. A trap is a detector you wrote yourself, with no measured error rate and no way to acquire one, because the only thing it ever returns is a count of applications that tripped it.

Could you explain this screen to the candidate?

Run that test before you plant anything. If a rejected applicant asks what happened and the honest answer is that a sentence they could not see decided it, the screen has to be defended by describing the ambush. A rule someone could have followed had they known it existed is a rule. One they could not is a trick, and the two read very differently out loud.

The asymmetry is the part that lands badly. You asked candidates to be straight with you by being less than straight about what your own document contains, in a market where they already suspect the process of being automated at them. Every applicant who spots the line learns something durable about how this company screens, and a job posting is a public artifact that gets screenshotted.

US law already has a name for a step like this. The Uniform Guidelines on Employee Selection Procedures, 29 CFR 1607.16(Q), adopted in 1978 and still in force, define a selection procedure as "Any measure, combination of measures, or procedure used as a basis for any employment decision", reaching "the full range of assessment techniques from traditional paper and pencil tests" through "informal or casual interviews and unscored application forms" ⁴. A hidden line used to move applications sits inside that definition rather than outside it for having been informal. Whether a particular trap produces adverse impact is an empirical question about your own applicants, so take it to counsel before it becomes a step in the process, not after.

The practical exposure is consistency. The trap fires on some applications and not others for reasons unrelated to the job: who read closely, which board they came through, what assistive technology they use. Sorting on that is the same failure as rejecting a candidate for sounding like AI, with a plausible-looking artifact attached to make the guess feel like evidence.

Ask a question whose answer needs the work

Put one question in the application that an assistant cannot finish alone, because answering it takes an act outside the conversation. Not "why do you want this role", which a model writes beautifully. Ask for a claim the candidate checked, what they checked it against, and what changed when they did. Someone who ran the check answers in specifics inside two sentences.

By role, each answerable in a short paragraph:

• Financial analysis. Name a figure in a recent filing you would re-derive before trusting it, and say what you would reconcile it against.
• Software engineering. Describe a bug you found in code you did not write. What made you look there?
• Marketing. Give a statistic you have seen quoted about this market, and say what the underlying sample actually was.
• Legal operations. Describe a time a cited authority did not say what the summary claimed it said, and how you caught it.
• Data and analytics. Name a result you stopped trusting, and what you recomputed to settle it.

A model will happily draft an answer to any of these. The good ones carry a specific object: a filing, a fixture, a sample size, a paragraph. The generated ones carry a shape. That difference takes about ten seconds to read, and unlike a trap word it is a difference about the work.

Then state the AI rule in the posting instead of hiding one inside it. A single line does most of the job: AI is allowed, and the application should name what was generated and what was verified. It is answerable, gradeable, and identical for everyone who reads the posting in any medium, including aloud. What to ask for on the application now that cover letters are all AI and how to write the AI requirement into the job description go further into the wording.

The question has a ceiling, and it is worth knowing where that sits before you lean on it. A written answer is a claim about an act rather than the act, so a candidate can describe checking a figure they never opened, and a good writer with an assistant can describe it well. Nothing a posting or an application form does gets past that, which is why the checking has to be watched somewhere later in the process. See how Olive measures this.

See a sample report >