Multilingual Hidden Prompt Injection Attacks on LLM-Based Academic Reviewing

TL;DR

This paper investigates the vulnerability of LLM-based academic reviewing to document-level hidden prompt injections across multiple languages. It uses a dataset of 484 ICML papers and evaluates four injected variants per paper, containing semantically equivalent prompts written in English and translated to Japanese, Chinese, and Arabic, embedded as white text on the first page. The study measures score drift with ΔS and acceptance transitions via Injection Success Rates, reporting significant negative score shifts for EN, JP, and CN (p < 0.001) and near-zero effects for Arabic, along with widespread decision changes in EN/JP/CN but limited changes in Arabic. The findings reveal language-dependent robustness concerns, underscoring the need for defenses and multilingual robustness research in LLM-assisted peer-review pipelines.

Abstract

Large language models (LLMs) are increasingly considered for use in high-impact workflows, including academic peer review. However, LLMs are vulnerable to document-level hidden prompt injection attacks. In this work, we construct a dataset of approximately 500 real academic papers accepted to ICML and evaluate the effect of embedding hidden adversarial prompts within these documents. Each paper is injected with semantically equivalent instructions in four different languages and reviewed using an LLM. We find that prompt injection induces substantial changes in review scores and accept/reject decisions for English, Japanese, and Chinese injections, while Arabic injections produce little to no effect. These results highlight the susceptibility of LLM-based reviewing systems to document-level prompt injection and reveal notable differences in vulnerability across languages.