压缩机制成新攻击面，扰动输入可让模型丢失关键信息
When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents
- 通过扰动未信任输入，在压缩前诱导丢弃关键内容
- 攻击成功率0.71，远超基线的0.21，跨多个压缩器有效
- 适合关注大模型安全与压缩风险的研究者
提示压缩被广泛用于降低大模型代理的延迟和成本，但其会改变后端模型实际接收到的内容。当可信与不可信输入共享压缩预算时，这种有损变换会产生新攻击面：攻击者仅需在压缩前扰动不可信输入，即可导致压缩器提前丢弃任务关键证据或安全防护机制。不同于提示注入、越狱或RAG污染，攻击目标是压缩器而非后端模型；扰动无需包含有意义指令，也不必在压缩后存活。我们将其形式化为对抗性信息损失（AIL），即因恶意引导有损压缩器所导致的额外下游失真。为此提出COMA，一种基于迁移的黑盒攻击方法，利用攻击方的替代压缩器与后端模型优化压缩前扰动。在三个任务与六个压缩器上，COMA平均攻击成功率达0.71，显著高于最强基线的0.21，并在两个真实场景中验证了迁移能力。
原文摘要 · Abstract (English)
Prompt compression is increasingly deployed in LLM agents to reduce latency and cost, but it also determines what the backend LLM ultimately sees. We show that, when trusted and untrusted inputs are compressed under a shared budget, this lossy transformation creates a new attack surface: by perturbing only untrusted inputs before compression, an adversary can cause the compressor to discard task-critical evidence or safety guardrails before inference. Unlike prompt injection, jailbreaks, or RAG poisoning, the attack target is the compressor rather than the backend LLM; the perturbation need not encode a meaningful instruction or survive compression. We formalize this vulnerability as adversarial information loss (AIL), the excess downstream distortion caused by adversarially steering a lossy compressor beyond benign compression alone. To exploit AIL, we present COMA, a transfer-based black-box attack that optimizes pre-compression perturbations using attacker-side surrogate compressors and backend LLMs. Across three tasks and six compressors, COMA achieves 0.71 average ASR, versus 0.21 for the strongest baseline, and transfers to two real-world agent case studies.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。