Document-Channel Manipulation in a Text-Extracted AI Review Pipeline

AI-assisted peer review turns a submission PDF into both scientific evidence and an input channel for evaluation control. We connect document interventions, directional content controls, and four input designs in a fixed review pipeline using page-order pypdf extraction and a 24,000-character cap. On a frozen 456-paper holdout spanning ICLR 2024–2025 and NeurIPS 2024–2025, author-side payloads increase GLM-5's 1–10 score by $+0.991$ for explicit instructions, $+0.505$ for naturalized intent, and $+0.653$ for evidence framing. Matched white-text cases reproduce positive effects on GLM-5 and GPT 5.2; Gemini-2.5-flash is inconclusive for explicit instruction. On an independent 84-paper reserve, repeated comparisons and polarity reversal support sensitivity to directional content under matched extracted context. Comparing four input designs, the pooled attack shift is $+0.853$ for plain concatenation, $+0.754$ with delimiters, $+0.317$ with structured summaries, and $+0.000$ (95% CI $[-0.075,+0.091]$) with separate extraction and review calls. Organizer-side audit markers also affect the review: natural-language marker reproduction remains $0.289$ after filtering. These results connect controlled content interventions to concrete input designs and distinguish score stability from marker suppression.