When Adversarial Data Still Compresses: Towards Robust LLM-Based Compression

Much of the data stored in real-world business systems is text, and lossless LLM-based compressors can outperform traditional schemes such as FSST or Brotli by up to 2x on text data. However, the robustness of LLM-based compression to inputs that induce poor model predictions remains understudied. In this paper, we show that LLM prediction failure does not necessarily imply compression failure: unlikely tokens often represent many source bytes, offsetting their higher coding cost. To study this effect, we decompose LLM-based compression into a two-layer system of tokenization and next-token prediction and evaluate an LLM-based compressor on natural, random, and adversarial inputs. A standard prediction attack, MinProb, repeatedly selects the model’s least-probable next token. Although it increases prediction cost by 5.68x relative to natural text, the resulting output still compresses to (36.2\%) of the original size. We therefore introduce a new attack objective, MaxSurprisal/Byte, which targets coding cost per source byte rather than per token. This attack expands the encoded output to (144.3\%) of the original size. Our results show that robustness of LLM-based compression must be assessed end-to-end, accounting for both tokenization and prediction.