Compression May Preserve or Concentrate Injections
Why filtering and summarizing retrieved chunks doesn't reliably remove malicious content
The Conventional Framing
Contextual compression filters or summarizes retrieved chunks before injection into the prompt. Only relevant content passes through, reducing noise and fitting more useful context into limited token budgets.
The pattern optimizes context utilization—more signal, less noise.
Why This Doesn't Help Security
Compression is performed by an LLM that can't distinguish injection from content. Malicious instructions that look like relevant content pass through. Some compression even concentrates injections by removing irrelevant material around them.
The compressor has no security awareness—it optimizes for relevance, not safety.
Architecture
Components:
- Retrieved chunks— raw retrieval results
- Compressor— LLM that filters/summarizes
- Compressed output— reduced content for prompt
Trust Boundaries
- Chunks → Compressor — compressor sees injection in chunks
- Compressor → Output — injection may pass through or influence
Threat Surface
| Threat | Vector | Impact |
|---|---|---|
| Injection passthrough | Malicious content looks relevant, passes filter | Injection survives compression |
| Concentration effect | Compression removes benign content around injection | Higher injection-to-content ratio in output |
| Compressor manipulation | Injection instructs compressor to include specific content | Compressor follows injected instructions |
The ZIVIS Position
- •Compression is not sanitization.Filtering for relevance is different from filtering for safety. The compressor has no security awareness.
- •Security filtering needs security focus.If you want to remove malicious content, use a security-focused filter with injection detection, not a relevance compressor.
- •Monitor compression behavior.Log what goes in and what comes out. Unusual compression patterns may indicate the compressor is being manipulated.
What We Tell Clients
Contextual compression optimizes for relevance, not security. Don't rely on it to remove injections—it may actually concentrate them by removing benign surrounding content.
If you need security filtering, implement it separately from relevance compression. They're different objectives requiring different approaches.
Related Patterns
- Naive RAG— compression applied to baseline RAG
- Input Sanitization— security-focused filtering instead