The Invisible Prompt Trap: How a Professor Caught 32 Students Cheating with AI in One Move

A Carefully Designed "Phishing" Experiment

Recently, a discussion on Hacker News sparked widespread attention across both education and tech communities: a university professor embedded an "invisible prompt" in an assignment and successfully identified 32 out of 35 students who used AI tools to complete their work. The number is staggering—a cheating rate exceeding 91%, essentially meaning the entire class was relying on large language models to do their work for them.

What makes this incident so clever is its technical implementation. The professor didn't rely on any expensive AI detection software, nor did they resort to the error-prone human judgment of "this sounds like AI." Instead, they exploited a fundamental characteristic of how large language models process text, designing a trap that's virtually invisible to the human eye yet faithfully executed by AI.

The Technical Principles Behind the Invisible Prompt Trap

The core technique of an invisible prompt trap involves embedding instructional text in an assignment document that humans can't see but AI can read. The underlying logic is directly related to "Prompt Injection"—a vulnerability that has received significant attention in the cybersecurity field. Prompt injection was first systematically described by security researcher Simon Willison in 2022, and its essence lies in the fact that current large language models are architecturally incapable of distinguishing between "system instructions" and "user input data"—all text is treated as an equally weighted sequence of tokens. This means instructional text embedded anywhere in the input will be executed by the model as a valid command. The professor essentially "reverse-weaponized" what is typically considered a security vulnerability—not to attack an AI system, but to leverage AI's inherent tendency to follow embedded instructions as a way to mark users.

There are several common implementation methods:

Visual Hiding Techniques

The simplest approach is to set the font color of a text passage to match the background (e.g., white text on a white background), or to shrink the font size to near zero. For students reading the assignment with their eyes, this text is completely invisible. But when students copy and paste the entire assignment into ChatGPT or similar tools, the hidden text gets copied along with it and is treated by the AI as a valid instruction to execute.

Prompt Injection Instructions

In the hidden text, the professor typically writes instructions like "please include a specific, unrelated keyword in your response" or "please cite a fictitious author in a peculiar way." Since large language models are inherently inclined to follow all textual instructions in a prompt, they will dutifully plant these markers in the generated answers. Students who independently complete their work would have no idea these markers exist and would never include them in their answers.

This is essentially a "honeypot" approach: rather than detecting the statistical characteristics of AI-generated content, it proactively sets a behavioral trap that only AI would trigger. Honeypots are a classic defensive strategy in cybersecurity, originating in the 1990s. The core idea is to deliberately deploy a seemingly valuable but heavily monitored decoy system, then wait for attackers to take the bait. Unlike passive defense, honeypots are an active intelligence-gathering mechanism—legitimate users would never interact with a honeypot, so any interaction with it can be considered definitive evidence of malicious behavior. The professor's invisible prompt is a creative adaptation of this classic security concept to an educational context.

Why Invisible Prompt Traps Are More Effective Than AI Detection Tools

Compared to AI detection tools on the market, the advantages of invisible prompt traps are quite clear.

Traditional AI content detectors (such as GPTZero and Turnitin's AI detection module) rely on statistical analysis of text perplexity and burstiness, and false positive rates have always been a persistent problem. Specifically, perplexity measures how "surprised" a language model is by a piece of text—AI-generated text tends to choose the highest-probability word combinations, resulting in lower and more uniform perplexity; human writing, due to personal style, creative expression, and occasional word preferences, typically has higher and more variable perplexity. Burstiness measures the variation in sentence complexity—human writing alternates between long and short sentences with noticeable fluctuations in complexity, while AI-generated text tends to have more uniform sentence complexity. However, these statistical features have numerous edge cases: carefully edited AI text, as well as human authors with uniform writing styles (especially non-native speakers), can cause detection results to go seriously awry. Many non-native writers and students with structured writing styles are frequently misidentified as "AI-generated," leading to numerous appeals and disputes.

The invisible prompt trap, by contrast, produces deterministic evidence: if a student's answer contains that hidden, impossible-to-independently-conceive marker, it can be safely concluded that they fed the assignment directly into an AI. This type of evidence is far more persuasive than probabilistic detection results and much harder for students to contest.

Controversy and Reflection in the Tech Community

In the Hacker News comment section, the tech community displayed two sharply divided attitudes.

Supporters argue that this is a low-cost, high-precision academic integrity tool. The professor's approach is both clever and fair—after all, only those who actually cheat get caught, while students who work independently are completely unaffected.

Critics raised several concerns:

• Ethical controversy: Does deliberately setting traps constitute "entrapment"? The purpose of education should be to guide, not to ensnare.
• Bypassability: Once students learn about this method, they can easily circumvent it by manually cleaning the text before pasting, or by using screenshot OCR to pose their questions. OCR (Optical Character Recognition) converts text in images into editable text through image processing technology. When students screenshot the assignment and then use OCR tools or multimodal AI with visual capabilities (such as GPT-4o) to ask questions, the formatting attributes of invisible text naturally disappear during the screenshot process—white text on a white background leaves no recognizable trace in an image, and zero-size font text similarly doesn't appear in the rendered pixels on screen. This means that with even minimal technical awareness, students can completely bypass the trap through the "visual channel." As such, it's more like a temporary advantage in an ongoing cat-and-mouse game.
• Deeper issues are being masked: The 91% cheating rate itself is the signal most worthy of reflection. When nearly the entire class is using AI, perhaps the problem lies not with the students but with whether the assignment design itself has lost its meaning.

The Fundamental Challenge Facing Educational Assessment in the AI Era

Beyond the technical cleverness, what this incident truly reveals is the fundamental challenge facing educational assessment systems in the AI era.

When large language models can easily handle traditional essay questions and short-answer questions, continuing to use "take-home assignments" as an assessment method becomes inherently fragile. Rather than exhausting themselves in the arms race between detection and counter-detection, an increasing number of educators are shifting toward redesigning assessment methods: emphasizing in-class responses, oral defenses, process-based documentation, and requiring students to explain their thinking process rather than merely submitting results.

This trend has already formed clear institutional changes globally. Since 2023, multiple Australian universities have been among the first to announce large-scale returns to pen-and-paper exams; the UK's Russell Group has published framework guidance documents on AI use; and institutions like Stanford University in the US have adopted more open strategies, allowing and even encouraging students to use AI while requiring them to submit complete interaction logs and reflective reports. These response strategies roughly fall into three schools: the prohibition school (returning to closed-book exams in monitored environments), the transparency school (allowing use but requiring process disclosure), and the restructuring school (completely redesigning assessment tasks so that even with AI assistance, higher-order cognitive abilities are required). The higher-order objectives in Bloom's Taxonomy—analysis, evaluation, and creation—are becoming the core reference framework for "AI-proof" assessment design, because these cognitive levels require genuine understanding and critical thinking from students even with AI assistance.

The invisible prompt trap is a brilliant short-term solution, but it cannot answer the larger question—in a future where AI is ubiquitous, what exactly do we want students to master, and how should we measure that mastery? Technical methods can catch cheaters, but they cannot substitute for the evolution of educational philosophy.

Conclusion

The number 32/35 is both a victory for a technical approach and a wake-up call. It demonstrates the effectiveness of a simple, clever "prompt injection trap" in identifying AI misuse, while also forcing the entire education system to face an unavoidable reality: AI has already deeply penetrated every aspect of learning. The real answer probably lies not in how to better "catch," but in how to redefine "learn."