No Hidden Prompts Needed! You Can Game AI Peer Review with Presentation-Only Revisions

• URL: http://arxiv.org/abs/2606.13044v1
• Date: Thu, 11 Jun 2026 08:30:18 GMT
• Title: No Hidden Prompts Needed! You Can Game AI Peer Review with Presentation-Only Revisions
• Abstract summary: We study a harder and more policy-relevant failure mode: no hidden text, no prompt injection, and no changes to methods, experiments, figures, equations, proofs, or numerical results.<n>The attacker modifies only presentation-level content, such as the abstract, contribution framing, related work, discussion, and narrative structure.<n>Across three mainstream AI reviewers, adversarial repackaging achieves a 75.1% attack success rate and a mean score gain of +1.21/10.
• Score: 43.03725702558361
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As AI-generated reviews move from experimental tools into peer-review infrastructure, most robustness concerns have focused on explicit attacks such as hidden instructions and prompt injection. We study a harder and more policy-relevant failure mode: no hidden text, no prompt injection, and no changes to methods, experiments, figures, equations, proofs, or numerical results. The attacker modifies only presentation-level content, such as the abstract, contribution framing, related work, discussion, and narrative structure. We introduce adversarial repackaging: a closed-loop attack that uses AI-reviewer feedback to search for presentation-level revisions while keeping the scientific evidence fixed. Across three mainstream AI reviewers, adversarial repackaging achieves a 75.1% attack success rate and a mean score gain of +1.21/10. The effect is not explained by ordinary prose polishing. We also reveal that strategies that change how the reviewer interprets the paper, such as related-work repositioning and analytical discussion expansion, substantially outperform surface edits such as local polishing, table formatting, and algorithm boxes. Our analysis reveals two deeper structural failure modes. First, AI reviewers are easier to impress than to convince: highlighting strengths reliably increases perceived merit, while attempts to dissolve weaknesses frequently backfire. Second, AI reviewers can confuse the appearance of addressing a limitation with actually resolving it, allowing unchanged evidence to be reinterpreted as stronger scientific contribution. These results show that the deployment risk is not only malicious hidden instructions, but the emergence of paper presentation itself as an optimization surface. We release a contamination-free rolling benchmark and attack framework for testing whether AI reviewers remain anchored to scientific content under presentation-only edits.

Related papers

• How Can Rhetoric Reward-Hack AI Reviewers? Dissecting Rhetorical Sensitivity in AI-Based Peer Review [34.868311584135775]
  We investigate how rhetorical choices shape AI-review judgments when reported scientific content is preserved.<n>We construct a controlled corpus of 4,200 full-paper manuscripts derived from 120 anonymized ICLR 2026 submissions.
  arXiv  Detail & Related papers  (2026-08-10T00:42:51Z)
• Does AI Reviewer See the Full Picture? Attacking and Defending Multimodal Peer Review [48.61205783234013]
  PaperGuard is the first comprehensive benchmark designed to evaluate and defend AI-generated peer-review against domain-specific, cross-modal attacks.<n>Our framework is built on three pillars: (1) a new multimodal peer-review dataset spanning multiple scientific domains; (2) a unified suite of attacks, including black-box prompt injections and white-box perturbations; and (3) a practical defense, motivated by the long-term challenge of academic papers, that uses chunk-based embedding search to efficiently localize and mitigate harmful instructions.
  arXiv  Detail & Related papers  (2026-06-10T22:06:35Z)
• Gaming AI-Assisted Peer Reviews Poses New Risks to the Scientific Community [33.39468805524881]
  We show that AI-mediated peer review is vulnerable to a simple, low-cost manipulation.<n>We see this across disciplines and publication venues, for both human-written and AI-generated papers.<n>Our results suggest that AI tools should not be treated as neutral evaluators in high-stakes peer review.
  arXiv  Detail & Related papers  (2026-06-08T20:38:06Z)
• Can AI Review Improve Paper Drafting? An Empirical Study on 20 Computer Architecture Submissions [4.04252733799147]
  We study 20 computer architecture papers, with varying levels of submission lineage, to expose how well AI review aligns with human review.<n>To conduct the case study, we build a web UI-integrated tool, emphAI-Paper-Review, that generates structured AI review of a draft paper.
  arXiv  Detail & Related papers  (2026-05-31T05:05:26Z)
• Stop Automating Peer Review Without Rigorous Evaluation [51.53099943385505]
  This position paper argues that today's AI systems should not be used to produce paper reviews.<n>We identify two critical issues: 1) AI reviewers exhibit a hivemind effect of excessive agreement within and across papers that reduces perspective diversity.<n>We argue that addressing the peer review crisis requires a science of peer review automation.
  arXiv  Detail & Related papers  (2026-05-04T22:41:04Z)
• When AI reviews science: Can we trust the referee? [73.47745294608072]
  We map attacks across the review lifecycle -- training and data retrieval, desk review, deep review, rebuttal, and system-level.<n>We use two advanced LLM-based referees to isolate the causal effects of prestige framing, assertion strength, rebuttal sycophancy, and contextual poisoning on review scores.
  arXiv  Detail & Related papers  (2026-04-26T08:03:32Z)
• "Give a Positive Review Only": An Early Investigation Into In-Paper Prompt Injection Attacks and Defenses for AI Reviewers [23.25377752659151]
  Recent reports have revealed that some papers contain hidden, injected prompts designed to manipulate AI reviewers into providing overly favorable evaluations.<n>We propose two classes of attacks: (1) static attack, which employs a fixed injection prompt, and (2) iterative attack, which optimize the injection prompt against a simulated reviewer model to maximize its effectiveness.<n>Our findings underscore the need for greater attention and rigorous safeguards against prompt-injection threats in AI-assisted peer review.
  arXiv  Detail & Related papers  (2025-11-03T07:04:22Z)
• Verifying the Robustness of Automatic Credibility Assessment [50.55687778699995]
  We show that meaning-preserving changes in input text can mislead the models. We also introduce BODEGA: a benchmark for testing both victim models and attack methods on misinformation detection tasks. Our experimental results show that modern large language models are often more vulnerable to attacks than previous, smaller solutions.
  arXiv  Detail & Related papers  (2023-03-14T16:11:47Z)
• Can We Automate Scientific Reviewing? [89.50052670307434]
  We discuss the possibility of using state-of-the-art natural language processing (NLP) models to generate first-pass peer reviews for scientific papers. We collect a dataset of papers in the machine learning domain, annotate them with different aspects of content covered in each review, and train targeted summarization models that take in papers to generate reviews. Comprehensive experimental results show that system-generated reviews tend to touch upon more aspects of the paper than human-written reviews.
  arXiv  Detail & Related papers  (2021-01-30T07:16:53Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.