Hidden AI Traps in Assignments: The Detection Method No Humanizer Can Beat

Hidden AI traps in assignments are invisible instructions that instructors bury in a prompt or PDF, so that any student who pastes the file into ChatGPT unknowingly copies a phrase no human reader could see. They catch AI use without an AI detector, and no humanizer removes the evidence.

Detection Drama Research · Last updated: August 9, 2026 · 10 min read

In July 2026 a Mississippi history professor went viral for catching almost an entire class with one word. The coverage framed it as a clever gotcha. It is more interesting than that, because it sidesteps the argument the entire AI detector false-positive debate has been stuck in for three years.

Detectors produce probabilities. Probabilities can be disputed, and increasingly they are — Indiana University’s Kelley School banned them outright, and other institutions have followed. A hidden prompt trap produces something else entirely: a document containing text that was demonstrably never visible to a human reader. That is not a score. It is an artefact.

This piece covers how the traps are built, which ones actually work according to the only controlled study on the subject, how to check a file in two seconds, and why the tools sold on the back of detection anxiety are irrelevant here.

What is a hidden AI trap in an assignment?

A hidden AI trap is an instruction placed inside an assignment file where a person will not see it but a language model will read it. The technique has a name in security research — indirect prompt injection — and it predates its use in classrooms by several years.

The mechanics are simple. A model reading a document does not see a rendered page. It sees extracted text. So text set to white on a white background, or shrunk to a fraction of a point, or positioned outside the printable margin, is missing from your experience of the file and fully present in the model’s.

The instruction is usually a tell rather than a sabotage: include this specific word, cite this invented source, begin with this exact phrase. When the tell shows up in a submission, the instructor has their answer.

Two variants are in circulation. The keyword tell adds something that should not be there. The decoy swap replaces what the model reads — one instructor converted the real article to an image-only PDF and layered a different article underneath in 0.0125-point white text, so submissions confidently analysed a text nobody was assigned. Around 30% of that class evaluated the wrong article and took zeros.

How did one hidden word catch 32 of 35 students?

Dr. Jason Gibson, a history professor at Alcorn State University, set a midterm asking students to compare the Industrial Revolution with the digital age. Hidden in white font inside the prompt was the word “Madagascar”, placed where it made no contextual sense.

Anyone who copied the prompt into a chatbot and pasted the answer back without reading it carried the word across. The results were not subtle. Submissions contained lines like “Madagascar purple bicycle whispers to the ceiling” and “Madagascar wore a toaster to a basketball game” — sentences arriving in the middle of an essay on industrialisation.

Thirty-two of 35 students across two summer classes failed that portion of the midterm. Gibson offered all 32 the chance to resubmit their own work for a different grade. Two took it.

That last number is the one worth sitting with. The trap did not just identify AI use, it identified students who never read their own submission — and then most of them declined a free second attempt. For context on scale, see how many students actually get caught using AI and the GCSE and A Level malpractice figures.

Which hidden traps actually work?

The viral cases are anecdotes. The only controlled test of the technique is a 2025 paper from Maastricht University’s Department of Advanced Computing Sciences, presented at BNAIC 2025. Dorina Sîli, Bastian Küppers and Theodor Schnitzler built 20 Java assignments — ten on data structures and algorithms, ten general computer science — delivered in three formats, and ran five injection techniques against ChatGPT-4o, Gemini 2.0 and GitHub Copilot.

Their results are the closest thing to a map of what survives contact with a real model.

Injection technique	Format	ChatGPT-4o	Gemini 2.0	GitHub Copilot
White text	PDF	Works	Ignored	n/a
White text	DOCX	Works	Works	n/a
Hidden layout (off-page text box)	PDF	Works	Ignored	n/a
Hidden layout (off-page text box)	DOCX	Works	Works	n/a
Comment-based	Code file	Works	Works	Works
File metadata (Title, Author, Keywords)	PDF / DOCX	Ignored	Ignored	n/a
URL payload (plain and base64)	PDF / DOCX	Ignored	Ignored	n/a

Source: Sîli, Küppers & Schnitzler, Universal Prompt Injection Techniques for Detecting LLM-based Assignment Fraud, BNAIC 2025. Table 1, reformatted.

Three findings stand out.

Metadata and URL traps are dead ends. Neither worked on any model in any format. Document properties are never tokenised as prompt context, and the models do not parse or follow URL strings at inference time. An instructor who hides a tell in the Author field has caught nobody.

Code comments were the only universal channel. They succeeded across all three systems, for the straightforward reason that comments are visible, semantically valid text that every code-aware model reads alongside the functional content.

Format matters more than the trap does. Gemini honoured white text in DOCX and ignored it in PDF. The researchers chased that discrepancy and found the boundary: Gemini applies visibility filtering to PDFs, dropping content below a contrast threshold. Pure white was filtered out. Light grey at #D9D9D9 was the lowest level that still activated the instruction — invisible in normal reading, visible to the model. DOCX files get no such filtering, because they are parsed through a structural layer that retains every text object including ones positioned outside the page.

Why can’t an AI detector or a humanizer help here?

Because nothing about this is detection. That distinction is the entire point, and it is what every piece of news coverage about the Madagascar case missed.

An AI detector reads your text and outputs a probability. That probability carries a false-positive rate, it is wildly inconsistent between vendors, it is contestable under most institutional rules, and a growing list of universities no longer trusts it. All of that is what makes the detector debate a debate.

A hidden prompt trap outputs nothing. The instructor compares your submission against a phrase that existed only in a layer you could not see. There is no model, no threshold, and no false-positive rate — a student who wrote their own work has no mechanism by which “Madagascar” appears in it.

This is also why the humanizer category has no answer to it. A humanizer rewrites text so that a detector’s statistical read changes. Run one over a submission carrying a smuggled phrase and one of two things happens: the phrase survives paraphrasing and you are caught anyway, or it gets rewritten and you have still submitted an answer to a decoy article you never read. The tool is solving a different problem. Worth noting the mirror image, too — some humanizers inject their own hidden characters into your output, which is the same trick pointed the other way.

How do you check a document for hidden text?

Two seconds, no tools, no subscription.

1. Select all. Open the file and press Ctrl+A (Windows) or Cmd+A (Mac). White-on-white text renders as a highlighted block with nothing legible inside it. Off-page text boxes appear in the selection count. This catches most traps.
2. Paste into a plain-text editor. Copy everything and paste into Notepad, TextEdit in plain mode, or any code editor. Formatting is stripped, so hidden text arrives in black on white alongside everything else.
3. Change the background. In Word, select all and apply a coloured highlight, or switch the page colour. Anything that was matching white stops matching.
4. Check for a text layer at all. If Ctrl+A selects nothing in a PDF, it is an image-only scan — which is itself a signal, because that format is what the decoy-swap variant is built on.

What none of these do is make it safe to submit AI-written work. They tell you a file has been prepared with a trap. They do not tell you the instructor is not also reading, and reading is still the method that catches the most people.

What if you get accused because of a hidden trap?

The honest answer is that this accusation is much harder to fight than a detector score, and it should be. A detector flag is an opinion generated by software. A smuggled phrase is a document artefact with one plausible explanation.

There is a narrow set of situations where you are genuinely innocent and still affected:

• You use a screen reader. This is the strongest objection to the technique and it comes up in nearly every instructor discussion of it. Assistive technology reads the hidden layer aloud, because that is exactly what it is built to do. A blind student may reasonably incorporate text a sighted student never encountered.
• You used AI for something permitted. If your institution allows AI for outlining or proofreading and you passed the brief through a tool for that purpose, a tell can travel into a document you otherwise wrote.
• Group work. You are answering for a section a collaborator produced.

In all three cases the defence is the same thing that works everywhere else: process evidence. Version history, drafts with timestamps, and notes predating the submission. Build it before you need it — see how to build an authorship packet, what writing-process trackers actually prove, and if it has already happened, what to do in the first 24 hours. Note also that detectors cannot read your document history — only you can produce it.

Is setting hidden traps even allowed?

It is contested, and worth understanding before you assume an accusation will stand unchallenged.

Instructors defending the practice argue it is a control, not a trick: the trap only fires if a student pastes an entire prompt into a chatbot and submits the output unread. Nobody is caught by accident.

The objections are real, though. The accessibility problem above is the sharpest — a defence mechanism that specifically disadvantages screen-reader users is a policy problem regardless of intent. Beyond that, the same technique used in academic publishing has already been called out as ethically dubious; a 2025 paper in Research Integrity and Peer Review examined authors hiding prompts in manuscripts to influence AI-assisted review, and Bruce Schneier documented the same pattern spreading through preprints.

There is also a practical ceiling the Maastricht team found. Alignment training makes models transparent, so when the injected instruction asked for something odd — insert a subtle bug, over-comment the code — the models frequently announced they had been told to do it. Stealth held only for the simplest instruction, a flat refusal. As the researchers put it, alignment “becomes an obstacle to stealth”. Ambitious traps expose themselves.

What does this change about how you work?

Less than the framing suggests, and more than it looks.

If you write your own work, a hidden trap is the first detection method in three years that cannot produce a false positive against you. That is a strict improvement over living under detector anxiety and it is worth saying plainly, because most coverage of this topic sells the opposite feeling.

If you use AI within your institution’s rules, the operational change is to stop pasting files you have not opened, and to keep a workflow that produces proof as a by-product.

And if you were counting on a bypass tool, this is the category of risk it was never built to cover. That is not an argument against those tools existing. It is an argument against the belief that a subscription buys immunity, because the technique that caught 32 students in Mississippi never once asked what their writing looked like.