Peer Review Set a Trap for AI Reviewers. 497 Papers Got Desk-Rejected.

Last year the hidden text in manuscripts was put there by authors. They buried instructions like "give a positive review only" in white-on-white type, hoping a reviewer's chatbot would read it and soften the verdict. We wrote about why that backfires.

This year the hidden text is put there by the conference, and it is aimed at the reviewer.

In March 2026, ICML announced that it had watermarked every submitted PDF with concealed instructions designed to make any language model that processed the paper emit two specific phrases. Reviewers who pasted a manuscript into a chatbot produced reviews carrying those phrases. The conference caught 506 of them. 497 papers were desk-rejected. NeurIPS is running the same play for its December meeting in Sydney, and researchers are arguing about it right now.

The same exploit, pointed in the opposite direction. The popular account of who got punished is wrong, and the shift behind it reaches well past machine learning conferences.

#How the Trap Works

The mechanism is a canary token, borrowed from security practice. You plant a unique string somewhere it should never legitimately surface. If it surfaces, something read the thing it should not have read.

ICML built a dictionary of 170,000 phrases. Each submitted PDF got two of them, selected at random and hidden in the file. The pairing is the clever part: the odds of any particular pair landing on any particular paper are smaller than one in ten billion, so a review containing both phrases is not a coincidence anyone can wave away.

That distinction in the caption matters more than anything else about the method. Stylometric AI detectors guess from prose texture, which is why accusing someone of AI writing on detector output alone is indefensible. A canary makes no claim about style. It shows that a specific confidential document reached a model, an event with an evidentiary trail. ICML reported a family-wise error rate of 0.0001 and had a human read every flagged review before acting.

#Who Actually Got Desk-Rejected

Most of the coverage gets this backwards. The version going around is that innocent authors lost their papers because a stranger assigned to review them cheated. That is not what happened, and the real structure is more interesting.

ICML uses reciprocal reviewing: if you submit, someone on your author list reviews for the conference. The penalty attaches through that link. In the conference's own words, violating the LLM policy is grounds for "desk rejections of papers co-authored by a reviewer in breach of the policy," because "the paper bears responsibility for its reciprocal reviewer complying with the conference policies."

So the 497 rejected papers belonged to the 398 people who cheated. They were their own submissions, not papers they had been assigned to judge.

That is defensible. The exposure it creates should still concern you, even if you would never paste a manuscript into a chatbot:

Your paper carries your co-author's conduct. If a colleague on your author list is the designated reciprocal reviewer, and they take a shortcut on a review you never saw, for a paper you never read, your submission dies with theirs. You had no visibility into the behavior that killed it, and no opportunity to prevent it. Graduate students and junior co-authors bear this risk without any of the authority to manage it.

Reviewers at ICML chose their own rules at signup. Policy A meant no language model use at all. Policy B allowed limited help understanding a paper or polishing prose, but never judging quality or drafting the review. Everyone caught had chosen Policy A and then used a model anyway. Nobody was confused about the rules. They broke one they had picked for themselves.

#The Backlash Is Not Frivolous

The critics are making a real argument, and it deserves better than dismissal.

Sören Auer at Leibniz University Hannover found the planted prompts in several papers he was reviewing. Not knowing they came from the conference, he assumed an author had put them there and initially rejected one paper for it. His objection cuts to the premise: "Designing a trap that presumes bad faith corrodes the relationship the whole system depends on." Sara Atito at the University of Surrey called hidden prompts a "poor mechanism" that might filter some bad behavior without touching the structural problems underneath.

Both objections land. Peer review runs on unpaid goodwill from people with no spare time, and treating every one of them as a suspect has a cost that never shows up in the enforcement statistics. Auer's experience exposes a second defect: the conference contaminated manuscripts with text that an honest reviewer could fairly read as author misconduct. Auer almost rejected a paper over a trap the organizers had set.

The defense comes from Nihar Shah at Carnegie Mellon, who ran the ICML effort as its scientific integrity chair. He calls the approach "viable and feasible," and his justification is blunt: "People were really tired of reviewers copy-pasting AI-generated reviews." Authors put months into a submission and receive four paragraphs of confident, generic text from a model that never read the paper carefully. That corrodes trust too, and it was happening at scale before anyone set a trap.

#Why the Volume Argument Wins

Whatever you make of the ethics, the scale is what forced the issue. Pangram Labs analyzed 75,800 of the 76,139 reviews submitted to ICLR 2026. Roughly 21% were fully AI-generated. More than half showed some degree of AI involvement.

One finding in that analysis should worry authors most: reviews with higher AI involvement tended to hand out higher scores. Machine-written review inflates. It produces fluent, undemanding assessments that drift upward and decouple the score from the substance of the text.

Consider what that does to you as an author. A rigorous human reviewer who reads your paper and files a demanding report is now competing, in the same decision, against a model that skimmed it and awarded a 7. The careful reviewer looks harsh by comparison. The signal editors depend on gets noisier in a direction that quietly rewards work that should have been questioned.

#This Is Not a Machine Learning Story

Computer science conferences are where the enforcement tooling arrived first, because they have centralized submission systems and review volumes large enough to make the problem impossible to ignore. The policy shift already reached everywhere else.

A cross-disciplinary analysis in Learned Publishing found that in a single six-month window, from March to August 2025, 24.5% of high-impact journals revised their AI peer review policies. The share holding any explicit position climbed from 77% to 83%. Among the top 100 medical journals, the split now looks like this:

Position on AI in peer review	Top 100 medical journals
Explicitly prohibited	46
Permitted under stated limits	32
No guidance given	22

In nursing journals, 98% prohibit using AI as a peer reviewer. Science, technology and medicine regulate this more strictly than the humanities and social sciences, but every field measured is moving the same way. If you publish in cardiology, oncology, education, or economics, the rules governing your reviewers changed in the last eighteen months. Editors wrote those rules first, and the tools to enforce them are arriving now.

#What This Means for Your Next Submission

Most of this you cannot control. A few things you can.

Your PDF now has two possible sources of hidden text. Anything you planted is misconduct. Anything the venue planted is enforcement. Both are invisible on screen and both are in the file. Before you submit, select all the text, paste it into a plain text editor, and read what appears. You are checking your own work, not the venue's.

Clean the file for the ordinary reasons too. Leftover tracked changes, white template text, author names sitting in document metadata you meant to anonymize. None of that is misconduct, all of it can trip a screen, and re-exporting from source rather than editing the PDF is usually the fastest fix.

Know the disclosure standard where you are submitting. Vague acknowledgment is no longer sufficient at most publishers. The expected form now names the system, the version, the date, the sections affected, and how you verified the output, as in "ChatGPT (GPT-4o, OpenAI, accessed January 2026), used to edit the Discussion for concision; all claims checked against primary sources." Undisclosed use is treated as misconduct at every major publisher, and none of them will let a model be listed as an author.

Understand what your co-authors owe the venue. If you are submitting somewhere with reciprocal review, ask who is carrying the review obligation and confirm they know which policy they agreed to. That conversation takes five minutes and can save the submission.

Never paste someone else's manuscript into a chatbot. When you review, you are holding confidential work that is not yours. The rule exists to protect that confidentiality, which is also why the canaries work at all.

#The Honest Way to Point AI at a Paper

Every version of this problem, from last year's hidden prompts to this year's canaries, involves AI reading a manuscript on the far side of a wall, where the author cannot see what it does and the reviewer will not admit it happened.

The legitimate use of this technology sits on your own side of that wall, before submission, on your own draft, where the incentive is to find problems rather than bury them. No confidentiality is at stake, because the manuscript is yours. Nothing is hidden, because the whole point is for you to read the output and decide what to fix. It catches what sinks papers: fabricated citations and the recurring methodology flags a demanding reviewer will hit on the merits.

As we covered in Your Next Reviewer Will Probably Use AI, the review you receive is increasingly likely to be shallower and more generous than your paper deserves. A review that flatters you hands you a problem at the next stage, when a reader who does care finds what the reviewer missed.

#How ManuscriptMind Helps

ManuscriptMind is an AI review you run on your own manuscript, before anyone else sees it. It returns critical, major, and minor issues alongside a per-reference citation report, usually in under five minutes, with severity categories that map to how an editor weighs comments.

It has no incentive to be generous, because you are the only one reading the report. Nothing is hidden in your file, nothing is sent to someone else's reviewer, and no confidentiality is at stake. It is the mirror image of the trap: instead of gaming a stranger's model into praising your work, you point an honest one at your own draft while you can still act on what it says.

Run a pre-submission review →

---

Related: There's Invisible Text in Some Manuscripts and Your Next Reviewer Will Probably Use AI.