🤖 AI

The Compaction Cliff in Long-Running AI Agent Memory

This paper identifies the "Compaction Cliff," a phenomenon where standard context compression causes AI agents to lose critical safety rules, and proposes "Knowledge Triage," a framework using type-specific operators to preserve safety fidelity and improve downstream task performance across multiple domains.

Original authors: Saber Zerhoudi, Jelena Mitrovic, Michael Granitzer

Published 2026-08-25

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saber Zerhoudi, Jelena Mitrovic, Michael Granitzer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a digital assistant that never forgets. Unlike a human who might lose track of a conversation after an hour, these artificial intelligence agents are designed to run for days, weeks, or even months, constantly learning new facts, remembering past events, and following a long list of rules. To function, they hold all this information in a temporary workspace, much like a person keeping a stack of papers on their desk. However, this workspace has a strict size limit. As the conversation grows and the stack of papers gets too thick, the system must throw some things away to make room for new details. This is where the danger lies. If the system simply throws away the oldest or least obvious papers to save space, it might accidentally discard a critical safety rule, such as "do not prescribe this medication to patients with a specific allergy." The result is an agent that is efficient but dangerously forgetful, potentially giving harmful advice because it lost the very instruction meant to prevent it.

Researchers at the University of Passau in Germany have identified a specific failure pattern they call the "Compaction Cliff." They found that when these long-running agents try to shrink their memory to fit the size limit, they treat all information as if it were equal. A safety rule is summarized and shortened just like a casual observation about the weather. The researchers discovered that this approach is fragile. In their tests, using a popular AI model, the system managed to keep about half of the safety rules after one round of shrinking. But as the process repeated over time, the number of surviving rules plummeted. After just five rounds of compression, only one in ten of the original safety rules remained intact. The agent had effectively climbed a cliff and fallen off, losing the guardrails that kept it safe.

To solve this, the team developed a new method they call "Knowledge Triage." The name comes from the medical practice of sorting patients by urgency, deciding who needs immediate care and who can wait. In this digital version, the system first sorts every piece of information in the agent's memory into one of five distinct categories. Some items are strict safety rules that must never be changed. Others are step-by-step instructions for tasks, which can be rewritten as long as the steps still work. Then there are general beliefs, soft preferences, and records of past events. The crucial insight is that these different types of information do not need to be treated the same way. A safety rule requires perfect preservation, while a memory of a past event can be summarized or even discarded if space is tight.

The researchers built three specific tools to handle these different categories. The first tool, designed for shrinking the memory, locks the safety rules in place so they cannot be altered or deleted, while allowing the less critical information to be compressed or replaced with placeholders. The second tool handles situations where a topic is simply too large to fit, even after shrinking. Instead of chopping the topic in a way that might separate a rule from the situation it applies to, this tool copies the relevant safety rule into every new section it creates, ensuring the rule travels with the information it governs. The third tool manages information that is stored outside the main workspace. When the agent needs to look something up, this tool ensures that any safety rules relevant to the question are brought back first, before the system even considers looking at other, less critical details.

The team tested this approach on a massive collection of real-world agent configurations, pulling nearly 400,000 examples from public software repositories. They found that their new method preserved safety rules far better than the standard tools used in production today. While the best existing methods kept only about half of the rules after a single round of compression, the new system kept nearly all of them. Crucially, the new system's performance stabilized at 96% recall from the second round onward, whereas the old methods had dropped to just 10% by the fifth round. This difference held true across different types of AI models and different ways of organizing the data.

The impact of this improvement was not just about keeping text intact; it changed how the agents behaved in real tasks. In a medical scenario, the new system successfully followed safety guidelines in 97% of cases, significantly outperforming the standard system which failed more often. In retail and airline customer service tests, the agents using the new method completed more tasks correctly than those using the old methods, even when the old methods were given more total space to work with. The researchers concluded that the key to safe, long-running AI is not just having more memory, but knowing how to sort it. By classifying information by its importance and treating safety rules as non-negotiable, they prevented the agent from falling off the compaction cliff, ensuring that the digital assistant remains both capable and safe.

Technical Summary: The Compaction Cliff in Long-Running AI Agent Memory

1. Problem Statement

Long-running AI agents operate under a finite token budget, requiring the context window to be managed via compaction (summarization), decomposition (splitting topics), and retrieval (external storage). Current production strategies treat all knowledge items uniformly, applying the same compression or retention logic regardless of the item's semantic nature.

The authors identify a critical failure mode termed the Compaction Cliff: when safety rules (e.g., "Patient is allergic to penicillin") compete with episodic logs for token space, uniform summarization degrades safety constraints at the same rate as background information. Empirical analysis of Claude Code's /compact prompt on Sonnet 4.6 reveals that safety rule recall drops from 53% after one compaction round to just 10% after five rounds. This occurs because abstractive summarization and hierarchical truncation fail to distinguish between items that tolerate paraphrasing (e.g., episodic logs) and items requiring exact wording to remain enforceable (e.g., safety constraints).

2. Methodology: Knowledge Triage

To address the Compaction Cliff, the paper proposes Knowledge Triage, a framework that classifies knowledge items by type and routes them through distinct retention policies. The framework consists of three core components:

A. Typed Knowledge Model

The authors define a five-type model derived from an analysis of 396,934 agent configurations:

Constraint (C): Rules bounding agent behavior where violation causes safety failure (e.g., "Never prescribe contraindicated drugs"). Distortion tolerance is zero.
Procedural (P): Step-by-step instructions where execution must be preserved (e.g., "Run pytest before merging").
Belief (B): Factual assertions treated as true (e.g., "Backend exposes REST API"). Tolerates bounded semantic distance.
Preference (F): Soft guidelines (e.g., "Use 2-space indentation"). High tolerance for summarization.
Episodic (E): Past events or observations. Free to discard.

B. Classification ( $\tau$ )

A classifier assigns each item to one of the five types. The default approach, SafetyMargin, estimates counterfactual safety: it scores an item based on how much the probability of an unsafe action increases if the item is removed from the knowledge base. This approach captures declarative safety rules (e.g., "The patient is allergic to X") that grammatical heuristics (like looking for imperative verbs) often miss.

C. Three Deterministic Operators

The framework implements three operators, each with specific safety requirements that uniform strategies violate:

TypeCompact:
- Mechanism: Routes items into fidelity lanes. Constraints and procedures are pinned (zero distortion) and preserved verbatim. Beliefs and preferences are compressed. Episodic items are replaced by placeholders.
- Safety Guarantee: Every constraint in the input must exist in the output with zero distortion.
- Verification: A post-compaction verifier checks that all pinned constraints survived; if missing, the system escalates to "Unsafe" or restores the item.
TypeDecompose:
- Mechanism: Partitions a knowledge base too large for a single context into sub-topics.
- Safety Guarantee (Locality): If a partition contains an item covered by a constraint's scope, that constraint must also be replicated in that partition.
- Implementation: Replicates scoped constraints to every partition intersecting their scope, incurring token overhead proportional to scope breadth.
TypeRetrieve:
- Mechanism: Fetches items from external storage based on query relevance.
- Safety Guarantee (Priority): All constraints in-scope with the query must be returned, regardless of their similarity score.
- Implementation: Pins in-scope constraints to the top of the result set before filling the remaining budget with relevance-ranked items.

3. Key Contributions

The Compaction Cliff: A documented structural failure of type-blind compaction, showing that safety rule recall collapses rapidly over sequential compaction rounds across multiple LLM families and structural baselines.
Five-Type Knowledge Model: A taxonomy covering 97% of real agent configuration content, distinguishing between items that require exact preservation and those that tolerate distortion.
Knowledge Triage Framework: A system of three operators (TypeCompact, TypeDecompose, TypeRetrieve) that enforce per-type safety guarantees, proven to satisfy requirements that uniform strategies cannot.
SafetyMargin Classifier: A counterfactual safety estimator that outperforms grammatical classifiers in detecting declarative safety rules, which are dominant in clinical, legal, and financial domains.
AgentArtifactCorpus: A new dataset of 396,934 agent knowledge artifacts from 54,628 GitHub repositories, used for taxonomy validation and operator benchmarking.

4. Empirical Results

The framework was evaluated on five public corpora and three behavioral benchmarks:

Compaction Performance: On 50 agent configurations, TypeCompact preserved 2–4× more safety rules than the strongest single-shot LLM compactor (Sonnet 4.6) at every compression ratio. After five rounds of 50% compression, TypeCompact maintained 96% recall, whereas Sonnet 4.6 dropped to 10%.
Decomposition Performance: TypeDecompose achieved 0% locality violations (ensuring scoped constraints are present in relevant partitions), compared to 93% violation rates for uniform partitioning baselines. This came with a mean token overhead of 14.5%.
Retrieval Performance: TypeRetrieve achieved 100% recall@50 for in-scope constraints across all retriever backends, compared to 73% for the best single-shot LLM retriever.
Behavioral Benchmarks:
- Medical Compliance (SafetyMed): TypeCompact outperformed the production Sonnet compactor on pass rate ( $p=0.022$ ) and constraint preservation ( $p < 10^{-8}$ ), with a 14.5-point lead in preservation.
- Retail Tasks ( $\tau$ -bench): TypeCompact outperformed both full-policy and hierarchical truncation baselines on pass rate ( $p < 0.01$ ).
- Airline Domain: TypeCompact outperformed hierarchical truncation ( $p=0.024$ ) and statistically tied the full-policy ceiling.

5. Significance and Claims

The paper argues that safety preservation in long-running agents is not merely a matter of better summarization models but a structural requirement of context management. The authors claim that type-blind retention is fundamentally insufficient for safety-critical applications because it lacks a mechanism to distinguish between "lossy" and "lossless" knowledge.

The significance of Knowledge Triage lies in its ability to:

Formalize Safety Guarantees: It links agent memory to information theory and belief revision, providing formal proofs that uniform strategies violate safety constraints under budget pressure.
Enable Production Deployment: By treating compaction, decomposition, and retrieval as a unified problem with type-dependent policies, it offers a practical path for agents to operate indefinitely without degrading safety rules.
Address Declarative Safety: Through the SafetyMargin classifier, it solves the specific failure mode where declarative safety rules (common in medical and legal texts) are ignored by grammatical heuristics.

The authors conclude that before delegating compaction to frontier LLMs, systems must classify items by safety role and retain the safety-critical class without modification. This approach transforms safety preservation from a probabilistic outcome of model behavior into a deterministic property of the storage layer.