[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83336-en":3,"doc-seo-83336-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83336,687197207919,"Theodora","https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552",8,"Research & Report","Out of Sight Compression-Aware Content Protection against Agentic Crawlers","The rise of LLM-based agents with reasoning, summarization, and memory creates a new threat surface for online content that perimeter defenses often cannot address. Existing access controls can be bypassed by agent-driven browsers, and injection-style protections can harm usability. The work identifies context compression as a critical, previously underused chokepoint and introduces CAPE, which injects invisible perturbations that preserve human-visible form while causing severe information loss during compression. CAPE uses surrogate-derived seed discovery, prior-guided evolutionary adaptation, and preference-calibrated query selection, achieving up to 75.8% degradation improvements under low query budgets and transferring to real agent pipelines including LangGraph and GitHub Copilot.","Out of Sight: Compression-Aware Content Protection against Agentic  \nCrawlers  \nXuefei Wang  \nBeihang University  \n[xuefeiw@buaa. edu. cn](xuefeiw@buaa. edu. cn)  \narXiv :2607 .08 180v 1 [ cs .CR] 9 Jul 2026  \nAbstract  \nThe rise of LLM-based agents with reasoning, summarization, and memory capabilities has created a new threat surface for online content that conventional defenses fail to address. Existing defenses like access controls can be circumvented by agents mimicking ordinary browsers, and injection-based defenses often degrade human readability. In this paper, werevisit the agent pipeline and identify context compression, which agents routinely invoke to fit context budgets, as a critical yet overlooked defense layer. We propose CAPE, a framework that protects high-value textual content by injecting invisible perturbations without changing its human-visible surface form, thereby inducing severe information loss during agent compression. CAPE extracts disruptive seed perturbations from an accessible surrogate compressor, then adapts them to query-only target compressors through prior-guided evolution and preference-calibrated candidate prioritization, achieving effective protection under a low query budget. Experiments on three content types and four compression settings show that CAPE improves information loss by up to 75.8% over the strongest baseline while keeping protected content visually indistinguishable from originals. CAPE also transfers to realworld settings, including the LangGraph agent workflow and GitHub Copilot, highlighting its generality and practical value. This paper aims to reveal context compression as a new defense layer, promoting content protection research in the agent era.  \n1 Introduction  \nUnauthorized scraping has long been a critical threat to online knowledge and digital assets, as highlighted by lawsuits such as The New York Times against Microsoft (Bobby Allyn, 2023) and Reddit against Anthropic (Aakriti Bansal, 2025) . The widespread deployment of large language model (LLM) agents in web environments has  \nseverely exacerbated this issue. Unlike traditional scrapers that store pages verbatim, agent-driven crawlers possess strong reasoning, summarization, and memory capabilities. They actively chain retrieval with context compression and memory writing, reusing condensed information across downstream tasks (Jiang et al., 2023 ; Pan et al., 2024 ; Chevalier et al., 2023 ; Ge et al., 2023) . In addition, recent studies reveal that automated traffic now accounts for nearly half of all internet activity, with certain AI scraping bots experiencing up to a 300% surge in requests within a single year (Imperva, 2024 ; Tome et al., 2025) . These trends underscore the urgent need for content protection methods tailored to the agentic era.  \nDespite the various methods proposed to defend against and prevent unauthorized crawling, they exhibit clear limitations when facing modern agentic crawlers. First, access control mechanisms such as robots . txt, Cloudflare’s one-click block (Bocharov et al., 2024), and standardized licensing protocols (W3C, 2024 ; IPTC, 2023) rely on crawler identification and voluntary compliance, both of which agents easily circumvent by issuing requests from regular browser sessions (Kim et al., 2025 ; Zhong et al., 2025) . Since these mechanisms act before content is delivered, they are rendered powerless once the agent successfully slips through and retrieves the page. In addition, agenttargeted attacks such as prompt injection and jailbreaking (Zou et al., 2023 ; Liu et al., 2023, 2024 ; Debenedetti et al., 2024 ; Wei et al., 2023) primarily mislead agent outputs rather than protect the underlying content. Their disruptive perturbations will also raise compliance issues and degrade user readability, limiting practical value as a content protection mechanism.  \nTo fill this gap, we revisit the structure of agent pipelines and identify context compression as a critical ch","cbCaivUUeV7143a9","https://ap.wps.com/l/cbCaivUUeV7143a9","pdf",13129994,5,1,33,"English","en",105,"# Introduction\n## Threat model and limitations of existing defenses\n## Context compression as a new defense layer\n## The CAPE framework and optimization stages","[{\"question\":\"What vulnerability does the paper focus on in agentic web crawling?\",\"answer\":\"The paper focuses on context compression within agent pipelines, which agents use to fit context budgets and therefore becomes a critical defense chokepoint.\"},{\"question\":\"How does CAPE protect content without changing how it looks to humans?\",\"answer\":\"CAPE injects invisible perturbations into protected text so that the human-visible surface form remains indistinguishable, while compression induces severe information loss.\"},{\"question\":\"What are the main stages of CAPE’s method?\",\"answer\":\"CAPE performs (1) structural prior discovery using an accessible surrogate compressor, (2) prior-guided evolutionary adaptation to adapt candidates to target compressors, and (3) preference-calibrated query selection using compression feedback to prioritize high-value candidates under limited queries.\"}]",1784186833,83,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"out-of-sight-compression-aware-content-protection-against-agentic-crawlers","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/out-of-sight-compression-aware-content-protection-against-agentic-crawlers/83336/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-25","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What vulnerability does the paper focus on in agentic web crawling?","Question",{"text":76,"@type":77},"The paper focuses on context compression within agent pipelines, which agents use to fit context budgets and therefore becomes a critical defense chokepoint.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does CAPE protect content without changing how it looks to humans?",{"text":81,"@type":77},"CAPE injects invisible perturbations into protected text so that the human-visible surface form remains indistinguishable, while compression induces severe information loss.",{"name":83,"@type":74,"acceptedAnswer":84},"What are the main stages of CAPE’s method?",{"text":85,"@type":77},"CAPE performs (1) structural prior discovery using an accessible surrogate compressor, (2) prior-guided evolutionary adaptation to adapt candidates to target compressors, and (3) preference-calibrated query selection using compression feedback to prioritize high-value candidates under limited queries.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":20,"slug":138},19,"General","general"]