Topic · DiggingBeagle record
Compaction-induced loss of persistent agent constraints
An agent can retain a task summary yet lose the authoritative security constraints needed for later actions.
- Topic kind
- mechanism
Definition & limits
A context summary is a lossy account of what the agent has seen. It must not become the source of truth about what the agent is permitted to do. The failure can be literal omission of a rule, weaker wording, or a downstream decision that ignores a rule still present in the summary.
In ARCBench, rule-violation outcomes rose from 9.6% with the full context to 37.8% after compaction. The paper attributes 28.9 percentage points to cases that violated only after compaction. Yet 70.1% of compacted runs retained the rule text entirely, 26.9% partly retained it and only 3.0% lost it. A text-presence audit would miss the majority of the reported failure mechanism. Compactor-targeted injection was more damaging than adding sheer volume, raising violations to 46.3% while complete retention fell to 42.5%.
There are two different checks. The memory-integrity check compares a generated summary with original user restrictions and identifies omissions or hierarchy changes. The authorization check runs at the final tool or external-effect boundary using immutable user, tenant, resource and tool scopes. Passing the first is not evidence that the second was enforced. The same allowed and denied actions should be tested before and after the context is compacted, with the executor's decisions recorded independently of the agent's explanation.
This is a distinct mechanism from role-laundering through compaction, in which attacker-controlled content can gain apparent priority in a rewritten context. ARCBench includes failures without fresh hostile text. Both motivate permanent policy state outside the agent's summarizable narrative, but neither yields a universal estimate of deployed agent failures. The relevant evidence is the actual forbidden effect and its authorization state, not the existence of a sentence in memory.
Examples
- A summarizer preserves a task goal but drops a prohibition on sharing customer records.
- A later tool call is denied by an independent gate despite a misleading compressed summary.
- An agent reconstructs its conversation but cannot expand authorized tool scope on its own.