The Compaction Cliff in Long-Running AI Agent Memory

• URL: http://arxiv.org/abs/2608.22752v1
• Date: Mon, 24 Aug 2026 03:21:56 GMT
• Title: The Compaction Cliff in Long-Running AI Agent Memory
• Abstract summary: A safety rule and an episodic log compete for the same tokens in an AI agent's context.<n>On 20 production agent configurations, Claude Code's /compact prompt on Sonnet 4.6 preserves 53% of safety rules after one compaction round and 10% after five.<n>We address it with Knowledge Triage, a framework that classifies each line of an agent's knowledge base by type and routes each type through its own retention policy.
• Score: 3.2058241360543254
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: A safety rule and an episodic log compete for the same tokens in an AI agent's context. When the budget overflows, both are summarized at the same rate; only the rule needs exact wording to remain enforceable. On 20 production agent configurations, Claude Code's /compact prompt on Sonnet 4.6 preserves 53\% of safety rules after one compaction round and 10\% after five. We name this the Compaction Cliff. We address it with Knowledge Triage, a framework that classifies each line of an agent's knowledge base by type and routes each type through its own retention policy. Three deterministic operators implement this triage across the three context-management operations: TypeCompact rewrites items in place under per-type fidelity, TypeDecompose partitions a topic too large to compact safely, replicating in-scope safety rules across partitions, and TypeRetrieve fetches items from external storage with in-scope rules pinned ahead of relevance. On five public corpora, TypeCompact preserves 2--4$\times$ more safety rules than the strongest single-shot LLM compactor at every ratio, with 96\% recall over five rounds. TypeDecompose reaches 0\% locality violations against 93\% under uniform partitioning. TypeRetrieve reaches 100\% recall@50 against 73\% for the best single-shot LLM retriever. On three downstream behavioral benchmarks, we outperform the production Sonnet compactor on medical compliance (paired McNemar $p < 10^{-8}$ on preservation, $N = 200$), the full-policy and hierarchical baselines on retail task pass rate ($p < 0.01$, $N = 115$), and the hierarchical compaction on the airline domain ($p = 0.024$). We release AgentArtifactCorpus (396{,}934 agent configurations from 54{,}628 public GitHub repositories), the classifier, and the reference implementation.

Related papers

• Codebook Agent: Amortized Topology Design for LLM Multi-Agent Systems [67.04448659688579]
  We develop a query-independent 16-entry codebook that ranks the top decoded candidates in a single batched forward pass.<n>With no iterative search and no message passing at test time, Codebook Agent is the most accurate method on all six benchmarks.
  arXiv  Detail & Related papers  (2026-09-02T08:10:22Z)
• Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learning [67.04448659688579]
  FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.<n>Federation is not optional: off-the-shelf transfer collapses under distribution shift.<n>Live FGLGuard cuts AgentDojo's ground-success rate by 43% at near-unguarded utility, zero API cost, and negligible capability loss.
  arXiv  Detail & Related papers  (2026-09-02T07:57:12Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• PACE: Policy-Attested Contract Execution for Safe AI Agents in Decentralized Finance [9.22772901752634]
  We present PACE, a transaction-level authorization framework that interposes between an LLM-based agent and on-chain execution.<n> PACE cryptographically bind the approved intent, policy, and simulation report to the exact execution bytes, with replay and expiration protection.<n> PACE achieves a 0.00 unsafe execution rate and 0.00 false-positive rate on benign tasks, compared to 0.80 for the unguarded baseline.
  arXiv  Detail & Related papers  (2026-08-18T00:22:46Z)
• The Recall Trap: A Recall-Maximizing Retriever Configuration Reduces Issue Resolution in Fixed-Budget Code Context [45.88028371034407]
  We report a controlled case study in code repair, not a new phenomenon.<n>We toggle one flag (one-chunk-perfile deduplication) on an otherwise identical stack.<n>We map where it holds: it reverses on a lexical BM25 (3.2pp, significant cross-paradigm interaction)<n>We show that at a tight fixed budget, do not hard-deduplicate by file, and A/B packing policies against the task, not the metric flag was tuned.
  arXiv  Detail & Related papers  (2026-08-14T19:22:50Z)
• ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems [0.0]
  We present ChannelGuard, a framework placing information-bottleneck gates on every inter-agent channel.<n>ChannelGuard blocks Tool Poisoning 30 of 30 at the application layer, identically across Azure GPT-5, Anthropic Sonnet 4.5, and Anthropic Haiku 4.5.<n>It also lowers Prompt Injection attack success by half (0.333 to 0.167) and preserves GSM8K accuracy exactly (0.867)
  arXiv  Detail & Related papers  (2026-07-20T19:11:17Z)
• Token Budgets: An Empirical Catalog of 63 LLM-Agent Budget-Overrun Incidents, with an Affine-Typed Rust Mitigation as a Case Study [0.0]
  We build a Rust crate that operationalizes affine ownership so that cloning, double-spending, or using a budget after delegating it are compile errors rather than runtime hazards an operator must remember to avoid.<n>Across five runtimes, three providers, and a temperature-stratified live-API test, the approach reports zero cap violations and zero false refusals, at operational parity with concurrent work.
  arXiv  Detail & Related papers  (2026-06-02T10:46:57Z)
• Which Defense Closes Which Threat? Attributing OWASP-LLM-Top-10 Coverage and Its Brittleness Under Paraphrasing [51.56484100374058]
  Production LLM applications stack several defense families -- refusal-phrase filters, tokenbudget controls, model allowlists, rate limits, tool-registry authentication -- yetBAS benchmarks report a single aggregate coverage number.<n>We add four-LLM-Top-10-aware agents to a 21-agent baseline scanner and target a lattice of four synthetic LLM endpoints.
  arXiv  Detail & Related papers  (2026-06-01T19:39:25Z)
• SNARE: Adaptive Scenario Synthesis for Eliciting Overeager Behavior in Coding Agents [40.270213696031625]
  A coding agent executes a benign task as a sequence of shell, file, and network actions, any of which can quietly exceed the authorized scope while the task still completes.<n>We call this overeager behavior: the prompt is not adversarial and the run succeeds, yet an out-of-scope step can leak credentials or delete files.<n>Existing benchmarks miss it: task-completion suites credit any finished run, jailbreak suites probe adversarial prompts, and the one prior overeager benchmark applies a single fixed prompt to every agent-model pair.<n>We present SNARE, a pipeline that composes benign scenarios from reusable scope
  arXiv  Detail & Related papers  (2026-05-27T08:14:07Z)
• Skill-as-Pseudocode: Refactoring Skill Libraries to Pseudocode for LLM Agents [50.78646963535282]
  We propose Skill-as-Pseudocode (SaP), an automatic conversion of markdown skill libraries into typed pseudocode.<n>For each cluster of similar procedural passages drawn from one or more skills, SaP extracts a typed contract and filters it through a four-check deterministic verifier.<n>Promoted contracts are inlined into a rewritten skill skeleton together with restored concrete action templates, giving the agent two complementary signals.
  arXiv  Detail & Related papers  (2026-05-27T04:48:40Z)
• Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks [40.270213696031625]
  OverEager-Gen is a benchmark dedicated to overeager behavior on benign tasks.<n>On Claude Code, stripping the consent declaration alone raises the overeager rate from 0.0% to 17.1%.<n>OverEager-Gen therefore certifies each scenario's discriminative power before admission.
  arXiv  Detail & Related papers  (2026-05-18T16:00:41Z)
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems [35.65937852381774]
  Document-Driven Implicit Payload Execution (DDIPE) embeds malicious logic in code examples and configuration templates within skill documentation.<n>We generate 1,070 adversarial skills from 81 seeds across 15 MITRE ATTACK categories.<n>DDIPE achieves 11.6% to 33.5% bypass rates, while explicit instruction attacks achieve 0% under strong defenses.
  arXiv  Detail & Related papers  (2026-04-03T14:58:58Z)
• Structured Distillation for Personalized Agent Memory: 11x Token Reduction with Retrieval Preservation [0.0]
  Long conversations with an AI agent create a simple problem for one user: the history is useful, but carrying it verbatim is expensive.<n>We study personalized agent memory: one user's conversation history with an agent, distilled into a compact retrieval layer for later search.<n> Applied to 4,182 conversations (14,340 exchanges) from 6 software engineering projects, the method reduces average exchange length from 371 to 38 tokens, yielding 11x compression.
  arXiv  Detail & Related papers  (2026-03-13T14:21:58Z)
• Know the Ropes: A Heuristic Strategy for LLM-based Multi-Agent System Design [27.246783209927464]
  Know-The-Ropes is a framework that converts domain priors into an algorithmic blueprint hierarchy.<n>Three GPT-4o-mini agents raise accuracy from 3% zero-shot to 95% on size-5 instances after patching a single bottleneck agent.
  arXiv  Detail & Related papers  (2025-05-22T17:52:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.