Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents

Abstract

Summarization-based prompt compression is increasingly used by LLM agents to shorten long, distributed contexts, but it shifts the security boundary: filters inspect the pre-compression prompt while the backend acts on a newly generated compressed context. We identify relinking, a compression-boundary vulnerability where the compressor behaves as a confused deputy, summarizing distributed, locally benign fragments into a complete malicious instruction. Unlike prompt injection, relinking need not

Categories

Framework mappings

Suggested from the entry's categories.

@misc{liu2026safe,
  title = {{Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents}},
  author = {Zesen Liu and Zihan Zhang and Dongdong She},
  year = {2026},
  month = jun,
  eprint = {2606.21732},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.21732}
}