“Attackers can achieve 16x to 100x compression on large language model weights with minimal trade-offs by tailoring compression for exfiltration and relaxing decompression constraints.”