Ghost in the Context: Measuring Policy-Carriage Failures in Decision-Time Assembly

• URL: http://arxiv.org/abs/2605.12535v2
• Date: Tue, 19 May 2026 10:38:59 GMT
• Title: Ghost in the Context: Measuring Policy-Carriage Failures in Decision-Time Assembly
• Abstract summary: LLM agents do not act on raw interaction history; they act on a bounded decision state assembled by truncation, summarization, reordering, and rewriting.<n>We study this failure mode over local Llama 3.1 8B, Qwen 2.5 7B, and Mistral 7B using judged exact constraint respect and direct audits of assembled-state visibility.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LLM agents do not act on raw interaction history; they act on a bounded decision state assembled by truncation, summarization, reordering, and rewriting. If directive-bearing state is dropped, weakened, or rebound during that step, an agent can cross a policy boundary without prompt override, model changes, or persistent-memory compromise. We study this failure mode over local Llama 3.1 8B, Qwen 2.5 7B, and Mistral 7B using judged exact constraint respect and direct audits of assembled-state visibility. We evaluate SafeContext, a control layer that pins control state, reuses retained control prefixes, and optionally injects reminders under pressure while keeping model weights fixed. Unmitigated risk is systematic, but absolute exact compliance remains low. Against truncation, SafeContext yields small gains; against a strong structured-compaction policy, most aggregate lift disappears, leaving residual benefit mainly in overflow eviction and selected aliasing slices. Replay-only does not explain the effect. A larger-model extension on Qwen 14B and Llama 70B shows the same failure object under larger models, although sign and magnitude remain policy-conditional. Decision-time context assembly is therefore a measurable part of the control path that can be partially hardened.

Related papers

• Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense [49.05879299987137]
  Scaling laws are usually read as a capability story: lower language-modeling loss yields more useful models.<n>We study a safety consequence of this mechanism in emphcross-session decomposition attacks, where benign-looking subqueries are asked across independent interactions and later recomposed toward a forbidden objective.<n>We formalize this setting as emphcompositional safety risk and prove a conditional risk-transfer bound.
  arXiv  Detail & Related papers  (2026-08-28T05:39:29Z)
• Revelation Control [0.0]
  Revelation Control is the problem of choosing priced interventions that reveal hidden state only insofar as the revealed distinctions can change a consequential decision.<n>We develop this theory for learning systems, where states equivalent under declared current information can respond differently to future training and favor different actions.
  arXiv  Detail & Related papers  (2026-08-24T22:07:57Z)
• One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI [0.0]
  We show that a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment.<n>We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting.<n>This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.
  arXiv  Detail & Related papers  (2026-08-18T22:24:44Z)
• StateFuse: Deterministic Conflict-Preserving Memory for Multi-Agent Systems [6.160059055899747]
  StateFuse is a conflict-aware replicated memory contract built on standard OpSet/CRDT merge.<n>We evaluate StateFuse against flat multi-value, raw-log, provenance-style, and collapsed baselines under matched resolver and verification policies.
  arXiv  Detail & Related papers  (2026-07-07T05:06:33Z)
• Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents [0.4855342112648282]
  We show that in-context governance constraints reliably obey while visible can be silently removed by compaction.<n>Across 1,323 episodes, violation rises from 0% with the policy in full context to 30% after compaction.<n>We propose Constraint Pinning, a training-free mitigation that quarantines governance constraints from lossy compaction.
  arXiv  Detail & Related papers  (2026-06-21T14:30:20Z)
• FAIR-Calib: Frontier-Aware Instability-Reweighted Calibration for Post-Training Quantization of Diffusion Large Language Models [50.86041384789834]
  We propose a two-stage PTQ framework for dLLMs that prioritizes the protection of fragile frontier states without requiring end-to-end diffusion rollouts.<n>We show that FAIR-Calib consistently outperforms state-of-the-art baselines on LLaDA and Dream (W4A4), reducing frontier decision flips and suppressing post-commit mismatches across diverse benchmarks.
  arXiv  Detail & Related papers  (2026-06-04T08:00:51Z)
• One-Way Policy Optimization for Self-Evolving LLMs [63.8638342097375]
  Reinforcement Learning with Verifiable Rewards (RLVR) has become a promising paradigm for scaling reasoning capabilities of Large Language Models (LLMs)<n>We propose One-Way Policy Optimization (OWPO), a method based on the principle of decoupling optimization direction from update magnitude.<n> Experimental results demonstrate that OWPO outperforms strong baselines, including DAPO, OPD, and MOPD.
  arXiv  Detail & Related papers  (2026-05-21T08:25:27Z)
• Agent-BRACE: Decoupling Beliefs from Actions in Long-Horizon Tasks via Verbalized State Uncertainty [70.43119366710778]
  We introduce Agent-BRACE: Agent Belief state Representation via Abstraction and Confidence Estimation.<n>It is a method that decouples an LLM agent into a belief state model and a policy model, jointly optimized via reinforcement learning.<n>It achieves an average absolute improvement of +14.5% across long-horizon, partially observable language environments.
  arXiv  Detail & Related papers  (2026-05-12T02:37:04Z)
• IMPACT-CYCLE: A Contract-Based Multi-Agent System for Claim-Level Supervisory Correction of Long-Video Semantic Memory [73.22944697933603]
  Existing pipelines produce opaque, end-to-end outputs that expose no intermediate state for inspection.<n>We present IMPACT-Cycle, a supervisory multi-agent system that reformulates long-video understanding as a multimodal iterative claim-level maintenance.
  arXiv  Detail & Related papers  (2026-04-22T03:03:33Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Support Sufficiency as Consequence-Sensitive Compression in Belief Arbitration [0.0]
  When a system commits to a hypothesis, much of the evidential structure behind that commitment is lost to compression.<n>Standard accounts assume that selected content and scalar confidence suffice for downstream control.<n>We develop a recurrent arbitration architecture in which active constraint fields jointly determine a hypothesis geometry over candidates.
  arXiv  Detail & Related papers  (2026-04-06T18:28:45Z)
• Bayesian Conservative Policy Optimization (BCPO): A Novel Uncertainty-Calibrated Offline Reinforcement Learning with Credible Lower Bounds [1.2183405753834562]
  offline reinforcement learning (RL) aims to learn decision policies from a fixed batch of logged transitions.<n>We propose emphBayesian Conservative Policy Optimization (BCPO), a unified framework that converts uncertainty into emphprovably conservative policy improvement.<n>BCPO maintains a hierarchical Bayesian posterior over environment/value models, constructs a emphcredible lower bound (LCB) on action values, and performs policy updates under explicit KL regularization.
  arXiv  Detail & Related papers  (2026-03-06T01:46:02Z)
• Verifier-Bound Communication for LLM Agents: Certified Bounds on Covert Signaling [0.0]
  Colluding language-model agents can hide coordination in messages that remain policy-compliant at the surface level.<n>We present CLBC, a protocol where generation and admission are separated.<n>We show how this protocol yields an upper bound on transcript leakage in terms of latent leakage plus explicit residual channels.
  arXiv  Detail & Related papers  (2026-02-27T23:42:37Z)
• Sparsity Is Necessary: Polynomial-Time Stability for Agentic LLMs in Large Action Spaces [11.62669179647184]
  Tool-augmented LLM systems expose a control regime that learning theory has largely ignored.<n>We formalize this setting as Sparse Agentic Control (SAC), where policies admit block-sparse representations over M.<n>We show that under partial observability, LLMs matter only through a belief/representation error epsilon_b, yielding an additive O(epsilon_b) degradation.
  arXiv  Detail & Related papers  (2026-01-13T06:56:53Z)
• Refusal Steering: Fine-grained Control over LLM Refusal Behaviour for Sensitive Topics [2.4839105527363574]
  We introduce Refusal Steering, an inference-time method to exercise fine-grained control over Large Language Models refusal behaviour.<n>We show that it can remove political refusal behaviour while retaining safety alignment for harmful content.
  arXiv  Detail & Related papers  (2025-12-18T14:43:04Z)
• Hallucinated Adversarial Control for Conservative Offline Policy Evaluation [64.94009515033984]
  We study the problem of conservative off-policy evaluation (COPE) where given an offline dataset of environment interactions, we seek to obtain a (tight) lower bound on a policy's performance. We introduce HAMBO, which builds on an uncertainty-aware learned model of the transition dynamics. We prove that the resulting COPE estimates are valid lower bounds, and, under regularity conditions, show their convergence to the true expected return.
  arXiv  Detail & Related papers  (2023-03-02T08:57:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.