一句话：揭示提示压缩在共享预算下引入对抗性信息丢失，并提出黑盒攻击 COMA。
提示压缩被广泛用于降低 LLM 智能体延迟与成本，但它决定后端 LLM 所见上下文，改变安全边界。论文指出，当可信与不可信输入共享压缩预算时，有损变换形成新攻击面：攻击者仅扰动不可信输入，便可使压缩器在推理前丢弃任务关键证据或安全护栏。作者将其形式化为对抗性信息丢失（AIL），即对抗性操纵压缩器导致的额外下游行为扭曲。为利用 AIL，提出黑盒迁移攻击 COMA：用攻击方替代压缩器与后端 LLM，先在压缩空间选择诱导错误行为的目标，再搜索使替代压缩匹配目标的扰动。在工具选择、问答、系统提示破坏三类任务与六种压缩器上，COMA 平均成功率 0.71，最强非压缩基线为 0.21，并跨预算、后端与替代压缩器泛化至真实智能体案例。隔离可信与不可信输入的压缩可提升鲁棒性。
Prompt compression is increasingly deployed in LLM agents to reduce latency and cost. It determines what the backend LLM ultimately sees, thereby unexpectedly changing the security boundary of the agent pipeline. We show that, when trusted and untrusted inputs are compressed under a shared budget, this lossy transformation exposes a new attack surface in the LLM agents. By perturbing only untrusted inputs before compression, an adversary can cause the compressor to discard task-critical evidence or safety guardrails before LLM inference. Unlike prompt injection, jailbreaks, or RAG poisoning, our attack target is the compressor rather than the backend LLM. The perturbation need not encode a meaningful instruction or even survive compression. We formalize this vulnerability as adversarial information loss (AIL), the excess downstream behavioral distortion caused by adversarially steering a lossy compressor beyond benign compression alone. To exploit AIL, we present COMA, a transfer-based black-box attack that uses attacker-side surrogate compressors and backend LLMs to optimize pre-compression perturbations. COMA first selects a misbehavior-inducing target in compressed space, then searches for a perturbation whose surrogate compression matches that target. Across three tasks (agent tool selection, question answering, and system prompt corruption) and six widely used compressors, COMA achieves an average attack success rate of 0.71, versus 0.21 for the strongest non-compression-based baseline. COMA further generalizes across compression budgets, backend LLMs, and surrogate compressors, transfers to two case studies of real-world agents. We also show that isolating trusted inputs from untrusted inputs during compression improves robustness, especially for system prompt corruption.
@inproceedings{paperbot12381,
title = {When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents},
author = {Zesen Liu and Zhixiang Zhang and Yuchong Xie and Dongdong She},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834394}
}