Researchers propose the relinking vulnerability: LLM agent compression boundaries can be exploited to assemble malicious instructions

Summary-based prompt compression introduces a relinking vulnerability in agents, causing trusted compressors to reassemble scattered, locally benign fragments into complete backend-executable malicious instructions.

• Problem scenario and significance: Modern LLM agents accumulate context rapidly in long-horizon tasks, and production-grade systems (e.g., Claude Code, Cursor, OpenClaw) commonly adopt LLM-summary-based prompt compression to reduce token costs while preserving semantics; however, compression shifts the security boundary, creating a check-time-to-use-time (TOCTOU) representation gap.
• Limitations of existing defenses and threat models: Traditional input filters only inspect discrete source inputs before compression, while output validators mainly perform entity- or span-level grounding; prompt injection and payload splitting rely on the source side containing a complete malicious instruction or explicit reassembly rules, and existing methods cannot detect transformation processes where the source side contains no malicious instruction at all and no explicit reassembly markers.
• Core mechanistic observations: The authors propose a three-fold mechanistic hypothesis—attention mechanisms make scattered fragments across documents globally visible during compression (Cross-Fragment Binding), pretraining introduces typed slot priors based on surface types (Typed Slot Priors), and helpfulness preferences in post-training (Helpfulness Preference) drive the compressor to actively merge scattered related fragments into compact handoff instructions.
• Proposed method and defense: The authors propose an automated attack construction tool, Relink, which uses a three-stage pipeline to implant scattered, locally benign action and parameter fragments on the source side; they also propose a defense mechanism based on compression-boundary auditing, KBRA (Keyed Binding Reassembly Audit), which verifies whether compressed instructions obtain source-context permission through locality requirements.
• Threat model:
  • Victim system: Compressed-agent pipeline, where the source context is divided into trusted context Htrust and untrusted channel Huntrust, and the attack surface is entirely Huntrust.
  • Attacker knowledge: Black-box, possessing only application-level knowledge of the deployment environment, with no access or ability to modify internal weights, prompts, or configurations.
  • Attacker capabilities: Cannot modify Htrust, the compressor Cθ and its prompt qc, the token budget β, the backend model B, or any tool implementations; can only implant attack payload fragments into the untrusted channel to replace Huntrust.
  • Attack goals: During the compression stage, make the compressed context express the target instruction (Express(Sadv, τ) = 1); during the backend stage, make the backend model actually execute the target action (Act(aadv, τ) = 1).

Research on Prompt Compression and Summarization Fidelity

• Compression methods and evaluation orientation: Methods like LLMLingua (Jiang et al., 2023) and LLMLingua-2 (Pan et al., 2024) reduce long-context inference overhead through token selection or distillation; the authors note that existing work often evaluates based on task accuracy or information retention, while this paper treats summarization compression of long-horizon agents as a security boundary.
• Summarization hallucination benchmarks: FaithBench (Bao et al., 2025) and multi-document summarization hallucination research (Belem et al., 2025) focus on fabricated information not supported by the source text; the authors note that all semantic fragments in relinking genuinely exist in the source context, and are not unfounded fabrication.
• Perturbation-based compression attacks: CompressionAttack (Liu et al., 2025) induces semantic drift through adversarial perturbations outside the training distribution; the authors note that relinking does not rely on adversarial perturbations, operating entirely within the compressor's normal abstractive summarization capabilities.

Agent Prompt Attacks and Payload Splitting

• Indirect prompt injection: Greshake et al. (2023) and Perez et al. (2022) demonstrate the risk of applications following untrusted instructions; the authors note that such attacks embed complete malicious instructions directly at the source.
• Payload splitting attacks: Variable reconstruction (Kang et al., 2024), semantic decomposition and reconstruction DrAttack (Li et al., 2024), and context splitting (Liu et al., 2023) disperse adversarial content across the context; the authors note that these methods rely on explicit reconstruction rules provided by the attacker (e.g., instruction concatenation), while relinking is autonomously completed by the compressor.

Agent Defenses and Detection Benchmarks

• Single-representation security defenses: Llama Guard (Inan et al., 2023), ShieldGemma (Zeng et al., 2024), Llama Prompt Guard 2 (Chennabasappa et al., 2025), and the runtime policy CaMeL (Debenedetti et al., 2025); the authors note that these only validate source inputs or final outputs in isolation and cannot capture cross-representation semantic recombination.
• Span location and attribution methods: PromptLocate (Jia et al., 2025) and AttnTrace (Wang et al., 2025) are used to locate suspicious source spans; the authors note that in the relinking scenario, fragments are locally benign before compression and each has source support after compression, making single-point checks difficult to defend.

Baseline Methods and Benchmark Positioning

• Comparison baselines and benchmark environments: The paper selects Clean-split, Random-split, variable reconstruction, semantic decomposition and reconstruction, and context splitting as attack baselines, chooses 11 representative defense mechanisms, and builds long-context evaluations on four benchmarks: AgentDojo, ASB, InjecAgent, and τ2-bench.
• Essential difference from existing work: The authors state that the core difference of this paper from previous work is the elimination of explicit reconstruction on the attacker's side, using the compressor's innate abstractive summarization capability and helpfulness preference to bind benign elements across fragments, pointing out the systemic risk of the compression boundary.

In terms of overall approach, the paper formalizes the relinking process as the recombination of predicate-parameter bindings, extracts a domain-specific language (DSL) based on empirical corpora, constructs a three-stage automated attack tool Relink, and proposes a defense mechanism KBRA based on compression boundary auditing.

Problem Setting and Formalization

• Payload instruction composition: The target payload instruction is formalized as τ = (p, r, v, κ), where p is the backend agent action predicate, v is the parameter value, r is the semantic role filled by v relative to p, and κ is an optional constraint.
• Relinking determination condition: Four metrics (Ground, Support, Express, Act) are established; relinking is considered to occur when Ground(H, τ) = 1 ∧ Support(H, τ) = 0 ∧ Express(S, τ) = 1, meaning the source text contains action and parameter components without declared binding, but the compressed text expresses the bound instruction; if the backend further executes (Act = 1), it is an executable relink.

Corpus-Based DSL Abstraction

• Empirical design principles: After analyzing 11 agent corpora, the authors distilled three construction requirements: verbatim preservation of precise target values, adaptation to diverse carrier span styles (JSON, prose, key-value pairs, etc.), and explicit control of locality distance between segments.
• Dual coordinated views: The DSL maintains an instruction graph view (decoupling actions, parameter values, and constraints as nodes connected by binding edges) and a context sequence view (modeling low-privilege carriers as an ordered sequence of anchors), providing operational handles for cross-segment splitting and positioning.

RELINK Three-Stage Attack Construction Pipeline

• Decompose (binding edge pruning): Remove key binding edges between actions and parameters in the instruction graph, dividing it into an action subgraph Gp retaining open slots and a value subgraph Gv retaining surface types; cross-edge constraints are directly discarded, ensuring the source does not contain the complete instruction.
• Disguise (clue-constrained role instantiation): Project abstract role labels into discrete non-binding role handle coordinates (covering clues such as same workflow, reference roles, carrier context), attaching them to both subgraphs, enabling relational recoverability during compression without forming direct bindings.
• Distribute (masked anchor projection): Construct a binary placement mask Me on the carrier anchor sequence, zeroing the diagonal and filtering local binding combinations, select non-diagonal valid coordinate pairs through deterministic projection, insert rendered segments into host anchors, and linearize into an adversarial carrier.

Compression Boundary Audit Defense KBRA

• Boundary invariant: KBRA enforces a boundary invariant stating that a posterior instruction is only licensed when a single source text segment jointly declares the action, role, and value; separated mentions across segments do not constitute legitimate authorization.
• Three-step audit process: Extraction (Extract, recovering triple bindings), Projection (Project, mapping to a canonical key set, with unknown items mapped to the bottom element ⊥ for fail-closed rejection), and Matching (Match, verifying whether the posterior action key set is contained in the source key set, providing Exact and Semantic modes).

Experimental Setup

• Models under test: The main experiment defaults to Gemma-4-31B-it (used simultaneously as the compression model and the backend model); compression model generalization tests cover GPT-OSS-20B, Qwen3.6-27B, Qwen3.5-9B, Qwen3.5-4B, GPT-4o-mini; backend model generalization tests cover DeepSeek-v4-flash, Qwen3.6-max-preview, Claude-opus-4-7, GPT-5.5, Gemini-3.5-flash; defense tests cover Llama Prompt Guard 2, ProtectAI DeBERTa-v2, ShieldGemma-2B, ShieldGemma-9B, PromptLocate, AttnTrace, SecAlign, CaMeL; the mechanism analysis control model is Gemma-4-31B(base).
• Datasets and scale: Based on reconstruction and filtering of 4 long-context agent benchmarks, the evaluation set totals 619 samples (AgentDojo 30, ASB 188, InjecAgent 200, τ2-bench 201); generalization and ablation experiments use a fixed diagnostic subset of 180 samples (AgentDojo 30, and 50 each from the other three benchmarks).
• Baseline methods: Attack baselines include Clean-split (benign split control), Random-split, variable reconstruction, semantic decomposition and reconstruction, and context splitting; defense baselines include 11 mechanisms covering input filtering, prompt defenses, source purification, backend reinforcement, and runtime policies.
• Metric definitions: Relink Rate (RR, the proportion of compressed contexts satisfying the action predicate and exactly matching parameter values); Backend Action Rate (BAR, the proportion of actions actually emitted or accepted by the backend model); Filter Pass, BAR After, Attack Block, Utility FP, and Avg. Cost.
• Evaluation and judgment method: RR uses deterministic exact parameter matching; BAR uses each benchmark's built-in code-based metric for automated judgment, without LLM judge scoring; the default compression rate is 0.6, and the default prompt is agent_handoff.
• Number of repetitions: The paper body does not report the number of random seeds for repeated sampling or standard deviations across multiple runs (Appendix B.1 reports 95% bootstrap confidence intervals and statistical test p-values).

Main Results

According to the main experimental results reported in Table 3 (default compression pipeline, compression model and backend model both Gemma-4-31B-it, compression rate 0.6):

Swipe horizontally to read the table

Benchmark	Clean-split RR	Clean-split BAR	RELINK RR	RELINK BAR	∆ BAR
AgentDojo	9.5%	9.5%	90.5%	90.5%	81.0 pp
ASB	1.1%	1.1%	100.0%	100.0%	98.9 pp
InjecAgent	47.5%	47.5%	98.0%	98.0%	50.5 pp
τ2-bench	2.5%	2.5%	63.2%	63.2%	60.7 pp
Overall	17.0%	17.0%	86.9%	86.9%	69.9 pp

• Attack improves execution rate: The authors state that RELINK increases the overall RR and BAR from 17.0% in the control group to 86.9%, reaching 100.0% on ASB and 98.0% on InjecAgent, indicating that relation-guided construction adds significant signal compared to merely exposing fragments.
• Task structure affects relinking difficulty: The authors note that τ2-bench is the hardest scenario (BAR 63.2%), and they believe that customer service workflows have stronger task, state, or source structure, making it harder for the compressor to integrate separated fragments into an executable handoff state.
• Balancing stealth and executability: In comparison with splitting attacks, the authors state that baselines like variable reconstruction fail to pass source-side filtering (Filter Pass 0%) due to explicit concatenation rules, while RELINK maintains source-side acceptability and achieves high backend execution rates (Figure 6).

Triple Mechanism Probe Validation (RQ1)

• Test setup: On 619 samples or their attention-feasible subsets, construct a role-destruction control (pctrl), measuring attention difference ∆attn, slot prior probability difference ∆log P, and helpfulness preference utility difference ∆util.
• Experimental results: ∆attn is positive on 99.4% of samples (p < 10^-27, Table 9), because causal masking restricts signal flow strictly unidirectionally from Rv → Rp; ∆log P is positive on 95.2% of samples (Table 10); ∆util is positive on 75.3% of samples (Figure 5), with the fine-tuned model showing selective preferences on 81.6% of samples, while the base model only 15.7% (Table 11).
• Author interpretation: The authors state that the probe results support three mechanistic hypotheses, indicating that cross-fragment connections are widespread, and the post-training helpfulness preference is the key root cause driving the compressor to autonomously close disconnected bindings.

Generalization and Real-System Cases (RQ3 & RQ5)

• Test setup: On the 180-sample subset, vary compression rate, compression prompt, compression model, and backend model, and test default compression commands in OpenClaw and Claude Code.
• Experimental results: When the compression rate varies from 0.3 to 0.8, RELINK remains between 87.7% and 91.2% (Figure 7); under the agent handoff prompt, BAR reaches 89.5% (Table 4); with GPT-4o-mini as the compressor, BAR is 36.8%, while Gemma-4-31B-it reaches 89.5% (Table 5); with Gemini-3.5-flash as the backend, BAR is 35.1% (Table 6); in OpenClaw it facilitates unauthorized RSVP submission, and in Claude Code it induces modification of webhook configuration (Figures 8, 9).
• Author interpretation: The authors state that the vulnerability is universal across budgets, models, and workflows; prompt wording is the largest source of variation; real-system compaction commands actually execute malicious operations synthesized by relinking separated fragments.

Defense Mechanisms and KBRA Boundary Audit Evaluation (Section 8)

• Test setup: Evaluate 11 representative defense mechanisms and the KBRA audit mechanism on residual backend execution rate (BAR After), attack interception rate (Attack Block), benign false positive rate (Utility FP), and overhead (Table 8).
• Experimental results: Among existing defenses, Llama Prompt Guard 2 reduces residual BAR to 0.00% but has a false positive rate of 100.0%; ShieldGemma-2B has a false positive rate of 1.5% but residual BAR as high as 84.6%; KBRA-exact has residual BAR of 0.0%, KBRA-semantic (backend audit) has residual BAR of 0.3%, with Utility FP only 0.93% and CPU latency 69.9ms.
• Author interpretation: The authors state that single-point defenses inevitably fall into the security-versus-utility dilemma, while by auditing the H → S cross-boundary state, KBRA breaks this tradeoff, eliminating unauthorized execution while preserving benign utility.

Other Ablations and Analyses

• Removing cue (No cue): BAR drops from 89.5% to 80.7% (Table 7, 180-sample diagnostic set).
• Mismatched cue: BAR drops to 70.8%, and to 2.0% on τ2-bench (Table 7).
• Distance-only insert: BAR is 86.5%, a 3.0 percentage point drop relative to the full configuration (Table 7).
• Generic realization: BAR is 87.7%, a 1.8 percentage point drop relative to the full configuration (Table 7).
• Attention head ablation (Head-Ablation Sweep): Ablating the top-64 heads reduces the utility difference from 0.397 to 0.079, while ablating random 64 heads reduces it to -0.131 (Appendix B.4).

Exceptions and Measurement Limitations

The authors note that on the τ2-bench benchmark, relinking difficulty is higher than other benchmarks, and under mismatched cues BAR drops to 2.0% (Table 7); additionally, full attention extraction on Gemma-4-31B-it fails on the longest 231 long-context samples due to insufficient memory (Appendix B.2).

Limitations and future directions noted by the authors

• Protects only the compression boundary, not the full-stack architecture: The authors note that KBRA protects only the compression boundary; if the trusted source input Hlic itself already permits malicious actions (e.g., direct prompt injection), KBRA will allow that action, in which case traditional input filters must be relied upon (Section 8.2).
• Dependence on security auditing of configuration artifacts: The authors note that configuration artifacts defining the extractor E and projection function Φ (such as tool schemas and entity alias tables) are security-critical assets that must undergo dedicated auditing (Section 8.2).
• Single-segment authorization adaptive attack (A1): The authors note that a white-box attacker can merge actions and parameters into a single low-privilege segment to satisfy locality requirements; this attack abandons the re-chain form and becomes direct injection, which is left to input-layer defenses (Appendix C.3).
• Entity collision adaptive attack (A2): The authors note that an attacker can craft specific parameter values that collide with legitimate source keys under the semantic matcher, resulting in a 0.2%–0.3% residual execution rate vulnerability that must be reduced by extending the frozen alias table (Appendix C.3).
• Long-text full-attention measurement limitation: On the longest 231 samples, Gemma-4-31B-it full-attention extraction failed with out-of-memory errors on 8 H800 GPUs; the authors instead used the lightweight model Qwen3.5-4B to verify one-way attention routing (Appendix B.2).

Experimental coverage

• Benchmark and sample coverage: Evaluation covers 4 long-context benchmarks: AgentDojo, ASB, InjecAgent, and τ2-bench; after filtering, the final evaluation set consists of 619 samples, and ablation and generalization experiments use a fixed subset of 180 samples (Section 7.1, 7.4).
• Model coverage: The main experiment uses Gemma-4-31B-it; compression model generalization tests cover 6 models, and backend model generalization tests cover 6 models (Table 5, Table 6).
• System case coverage: Real-system cases cover the default compression instructions of the task automation platform OpenClaw and the software maintenance agent Claude Code (Section 7.6).
• Defense baseline coverage: Defense evaluation covers 5 categories with 11 mechanisms in total: input filters, compression prompt defenses, source-side sanitizers, backend hardening, and runtime policies (Section 8.1).
• Experimental reporting information: The paper reports deterministic matching metrics and statistical test values, but does not report the number of repeated rounds or dispersion distributions for multiple sampling in the main experiments.

This paper studies a new security vulnerability introduced by summary-based prompt compression in agents—relinking—and proposes a systematic attack construction method and a boundary audit defense mechanism.

• Problem identification: Long-horizon agents widely use LLM summarization for context compression, leading to a representation-level TOCTOU gap between the forward safety filter and the backend execution model, causing the compressor to act as an "obfuscation proxy."
• Attack mechanism and method: Due to the combined effects of cross-segment attention, typed slot priors, and helpfulness preferences, the compressor autonomously assembles scattered and benign actions and parameters from the source text into executable malicious instructions; the authors developed the automated tool RELINK, which uses a DSL to construct undetectable malicious segments at the source through Decompose (pruning binding edges), Disguise (adding role handles), and Distribute (masked anchor projection).
• Main experimental findings:
  • On 619 samples across 4 agent benchmarks, RELINK achieves a relinking rate and backend execution rate of 86.9% under default settings (Gemma-4-31B-it, compression rate 0.6), compared to 17.0% for the control group (Table 3).
  • On the ASB benchmark, the execution rate reaches 100.0%, and on the customer service benchmark τ2-bench, it reaches 63.2% (Table 3).
  • In a 180-sample generalization test, the attack maintains an execution rate above 87% across compression rates from 0.3 to 0.8 (Figure 7), and is effective across 6 compression models and 6 backend models (Tables 5, 6).
  • Case studies on real industrial agents OpenClaw and Claude Code show that default compaction commands actually execute unauthorized actions and repository configuration modifications synthesized by relinking separated segments (Figures 8, 9).
• Defense scheme and conclusion: All 11 existing representative single-point defenses face a severe trade-off between safety and utility; the proposed KBRA boundary audit scheme reduces the residual execution rate to 0.0%–0.3% by verifying the local source support of posterior instructions, with a false positive rate of only 0.93% in semantic mode (Table 8); the authors call for future agent architectures to explicitly incorporate prompt compression into critical security boundaries for coordinated protection.