Plans Don't Persist: Why Context Management Is Load Bearing for LLM Agents

• URL: http://arxiv.org/abs/2606.22953v1
• Date: Mon, 22 Jun 2026 07:30:47 GMT
• Title: Plans Don't Persist: Why Context Management Is Load Bearing for LLM Agents
• Abstract summary: We show that agent-critical information can be context-resident rather than persistent.<n>The contribution is a measurement and stress-test framework showing that agent-critical information can be context-resident rather than persistent.
• Score: 3.4511611443217802
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Long-horizon agents depend on context management: systems compress, summarize, and evict old tokens so tasks can continue beyond finite windows. That is safe only when dropped information is no longer needed or has been internalized. Plans are the stress case: they are written early, used for many steps, and first to be evicted. We introduce replay pairing, a diagnostic that runs the same trajectory with and without the plan in history and measures hidden-state cosine distance. On Llama-3.1-70B, plan signal spikes to 0.453 one step after the plan, then falls 4.1x in a single action-observation step; HotpotQA falls 12.4x. This is evidence that standard LLM agents do not carry plans forward as persistent state, and instead depend on the plan remaining in context. A layer-L32 probe detects this decay as a diagnostic, not as proof that it reads plan content itself. Reasoning models add a measurement confound: their `<think>` traces re-derive plan content, so standard stripping leaves plan evidence in the stripped condition. We name this the reasoning-trace confound and fix it with strict stripping, which removes prior `<think>` blocks from the stripped run only. It recovers +163% of the step+1 signal in-sample and +153% held out, while not meaningfully changing non-reasoning Llama (+4.8%). On DeepSeek-R1-Distill-Llama-70B, a Llama-trained probe transfers at AUROC 0.748 (p=6e-4), while R1-specific probes reach 1.000, suggesting R1 encodes plan signal in a different hidden-state direction. Finally, a compression stress test shows the practical cost: naive plan eviction cuts ALFWorld success by 34.7pp, while probe-gated re-surfacing does not recover it. The contribution is a measurement and stress-test framework showing that agent-critical information can be context-resident rather than persistent. Context management is load bearing, but plan protection alone is not enough.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• SANE: State Anomaly Neutralization for Stable Extreme-Context Delta-Rule Models [53.86918766240095]
  Delta-Rule recurrent models maintain a fixed-size state, enabling $O(1)$ inference memory but potentially becoming unstable under extreme-context extrapolation.<n>We propose textbfState Anomaly Neutralization (SANE), which applies adaptive $tanh$ compression at chunk boundaries while preserving the intra-chunk parallel structure.
  arXiv  Detail & Related papers  (2026-08-23T10:41:07Z)
• Depth-Wise Probing and Pruning of the Planning Token in a Driving Vision-Language-Action Model [10.925063608741844]
  We study a representative driving VLA whose entire plan is carried by a single planning token that a generative planner decodes into a trajectory.<n>We measure two signals: the linear decodability of the navigation command and trajectory compatibility with the frozen native planner.
  arXiv  Detail & Related papers  (2026-08-07T16:02:34Z)
• Coupling Planning with Episodic Memory in LLM Agents for Software Issue Resolution [13.491535879221901]
  PMCoder is an issue-resolution agent that couples a hierarchical phase planner with episodic memory.<n>On SWE-bench Verified, PMCoder resolves an average of $25$ more cases than a harness-matched baseline.
  arXiv  Detail & Related papers  (2026-08-07T05:05:05Z)
• Doomed from the Start: Early Abort of LLM Agent Episodes via a Recall-Controlled Probe Cascade [14.63102636181275]
  Large language model (LLM) agents often waste inference compute by continuing multi-step trajectories that are already doomed to fail.<n>We study early failure prediction and inference-time early stopping for LLM agents using hidden-state probes.<n>We turn this signal into a recall-controlled abort cascade for reducing LLM agent inference costs.
  arXiv  Detail & Related papers  (2026-07-07T17:03:55Z)
• When Agents Commit Too Soon: Diagnosing Premature Commitment in LLM Agents [0.0]
  Long-answer LLM agents can fail quietly: they settle on one reading of the evidence early, then spend the rest of the run defending it.<n>We define representational commitment as cross-run hidden-state convergence at a fixed reasoning step.<n>A runtime monitor detects inconsistent trajectories from hidden states at AUROC up to 0.97 (0.85--0.88 under a stricter split)
  arXiv  Detail & Related papers  (2026-06-22T07:13:13Z)
• Control-Plane Placement Shapes Forgetting: An Architectural Study of Agent Memory Across Thirteen System Configurations [1.2763567932588586]
  ForgetEval is a 1000-case templated suite plus a 385-case adversarial layer (132 hand-crafted + 253 LLM-drafted oracle-validated)<n>We observe three placement regimes with partly complementary coverage: deterministic primitives suffice for lexical/temporal categories but fail canonicalization.<n>We expose the trade-off via ForgetEval, a 1000-case templated suite plus a 385-case adversarial layer.
  arXiv  Detail & Related papers  (2026-06-14T16:32:15Z)
• AEGIS: A Backup Reflex for Physical AI [0.0]
  We introduce AEGIS, a selective escalation method that uses a lightweight probe on a weak policy's frozen activations to detect high-risk steps.<n>When the probe flags a step, control switches to a stronger separate policy, but only for the steps that need it.<n>On LIBERO-Spatial, AEGIS recovers 10.1% of the trajectories the weak policy alone loses, versus 4.6% for budget-matched blind escalation and 5.1% for a random-trigger placebo.
  arXiv  Detail & Related papers  (2026-06-04T19:09:22Z)
• PRISM: : Planning and Reasoning with Intent in Simulated Embodied Environments [59.07829883257003]
  Built on five multi-room apartments, PRISM structures 300 human-verified tasks into three capability tiers.<n>PRISM exposes an agent-agnostic executable action API that allows arbitrary agents to be evaluated end-to-end.
  arXiv  Detail & Related papers  (2026-05-12T04:59:47Z)
• Long-Horizon Manipulation via Trace-Conditioned VLA Planning [55.80061850746898]
  LoHo-Manip is a framework that scales short-horizon VLA execution to long-horizon instruction following via a dedicated task-management VLM.<n>LoHo-Manip predicts a progress-aware remaining plan that combines a subtask sequence with an explicit done + remaining split as lightweight language memory.<n>The executor VLA is adapted to condition on the rendered trace, thereby turning long-horizon decision-making into repeated local control.
  arXiv  Detail & Related papers  (2026-04-23T17:59:04Z)
• Traversal-as-Policy: Log-Distilled Gated Behavior Trees as Externalized, Verifiable Policies for Safe, Robust, and Efficient Agents [18.383906296536185]
  Traversal-as-Policy: distill sandboxed OpenHands execution logs into a single executable Gated Behavior Tree (GBT)<n>Each node encodes a state-conditioned action macro mined and merge-checked from successful trajectories.<n>At runtime, a lightweight traverser matches the base model's intent to child macros.
  arXiv  Detail & Related papers  (2026-01-30T16:25:08Z)
• Reading Between the Lines: Abstaining from VLM-Generated OCR Errors via Latent Representation Probes [79.36545159724703]
  We propose Latent Representation Probing (LRP) to train lightweight probes on hidden states or attention patterns.<n>LRP improves abstention accuracy by 7.6% over best baselines.<n>This establishes a principled framework for building deployment-ready AI systems.
  arXiv  Detail & Related papers  (2025-11-25T00:24:42Z)
• Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models [75.29749026964154]
  Ourmethod reduces the average Attack Success Rate to 4.41% across multiple benchmarks.<n>Clean accuracy and utility are preserved within 0.5% of the original model.<n>The defense generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios.
  arXiv  Detail & Related papers  (2025-10-11T15:47:35Z)
• Denial-of-Service Poisoning Attacks against Large Language Models [64.77355353440691]
  LLMs are vulnerable to denial-of-service (DoS) attacks, where spelling errors or non-semantic prompts trigger endless outputs without generating an [EOS] token. We propose poisoning-based DoS attacks for LLMs, demonstrating that injecting a single poisoned sample designed for DoS purposes can break the output length limit.
  arXiv  Detail & Related papers  (2024-10-14T17:39:31Z)
• Tree-Planner: Efficient Close-loop Task Planning with Large Language Models [63.06270302774049]
  Tree-Planner reframes task planning with Large Language Models into three distinct phases. Tree-Planner achieves state-of-the-art performance while maintaining high efficiency.
  arXiv  Detail & Related papers  (2023-10-12T17:59:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.