ICPR 2026 · 2026

Prompt injection attacks on llm generated reviews of scientific publications

Janis Keuper

Why this publication matters

Automating scientific reviews creates a new vulnerability: instructions hidden in the submitted document may influence the reviewer. This study tests that problem and also examines whether language models are too inclined to accept papers. It provides evidence for designing review assistance and evaluations that do not mistake fluent feedback for independent judgment.

Abstract

The ongoing intense discussion on rising LLM usage in the scientific peer-review process has recently been mingled by reports of authors using hidden prompt injections to manipulate review scores. Since the existence of such “attacks” - although seen by some commentators as “self-defense” - would have a great impact on the further debate, this paper investigates the practicability and technical success of the described manipulations. Our systematic evaluation uses 1k reviews of 2024 ICLR papers generated by a wide range of LLMs shows two distinct results: I) very simple prompt injections are indeed highly effective, reaching up to 100% acceptance scores. II) LLM reviews are generally biased toward acceptance (>95% in many models). Both results have great impact on the ongoing discussions on LLM usage in peer-review.

Abstract source ↗

Figures

Example of a hidden prompt injection embedded in a scientific manuscript. — **Figure 1.** Visualization of a hidden prompt injection using white text on white ground. Here highlighted by a red bounding box and gray background. While this text would be invisible for human reader, it is still contained in the PDF and interpreted by LLMs like ordinary text. View in source ↗

**Figure 2.** Visualization of the shifts in the distributions of the central “Rating” score for the representative gemini-2.5-pro model (full results for all models are given in Table 4). Positively and negatively biased prompt injections have a clear effect compared with a neutral LLM prompt. However, even the “neutral” LLM scores have a strong positive bias compared to the human reviews. View in source ↗

Cite this paper

Download .bib

@inproceedings{keuper2026promptinjectionattacks86,
  title = {{Prompt injection attacks on llm generated reviews of scientific publications}},
  author = {Janis Keuper},
  booktitle = {International Conference on Pattern Recognition},
  year = {2026},
  url = {https://arxiv.org/pdf/2509.10248}
}

Figures and abstract are reproduced from the linked research sources. Credit remains with the authors and publishers.