The Compaction Cliff in Long-Running AI Agent Memory
Saber Zerhoudi, Jelena Mitrovic, Michael Granitzer
cs.AI, cs.IR
2026-08-24
Type-blind compaction treats safety rules like logs. Sonnet 4.6 /compact keeps 53% after one round, 10% after five. Knowledge Triage holds 96% recall over five rounds.
Long-running agents fill their context window. Runtimes then compact in place, split oversized topics, or push knowledge out and retrieve it later. Production systems apply one compression policy to every line. A safety rule and a debug log get summarized at the same rate.
Only the rule needs its exact wording. "Patient is allergic to penicillin" becomes "note allergy history," and the next turn can prescribe amoxicillin. Researchers at the University of Passau ran Claude Code's /compact prompt on Sonnet 4.6 across 20 production agent configs: 53% of safety rules survive one round, 10% survive five. They call the decay the Compaction Cliff.
The same cliff shows up across four LLM compactor families and LLMLingua-2, the strongest non-LLM compressor they tested. The prompt already said to keep every safety rule and procedural command verbatim. Rules still evaporate at the summary rate. This is not a missing instruction.
Knowledge Triage labels each knowledge-base line as one of five types, then applies a retention policy per type. The five types cover 97% of 396,934 agent artifacts scraped from 54,628 GitHub repositories:
The default classifier is SafetyMargin. It asks whether removing the line would make some action unsafe, scores 0-1 with gpt-5.4-mini, and marks Constraint above 0.5. That catches declarative rules such as "the patient is allergic to X." Regex only matches never / must not.
Three deterministic operators cover the three context operations:
When even the hard lane will not fit, compaction falls through to decomposition and parks the rest for retrieval. Classification runs once at index time.
Compaction, budget-matched on 20 configs, constraint recall:
| Method | 50% | 25% | 10% | after 5 rounds |
| TypeCompact | 1.00 | 0.95 | 0.80 | 0.96 |
| Sonnet 4.6 /compact | 0.53 | 0.39 | 0.24 | 0.10 |
| LLMLingua-2 | 0.21 | 0.08 | 0.01 | not run |
TypeCompact trades belief and preference fidelity (0.50 / 0.51) for full constraint and procedure retention. Drop indexing-time labels, the verifier, or Unsafe escalation, and recall on this sample falls below 0.50. At 50% compression the verifier restored a mean 0.46 rules per call and never escalated.
Decomposition on 200 configs at a 25% per-partition budget: TypeDecompose has 0% locality violations. Uniform token chunking leaves at least one violation in 93% of configs. Mean replication overhead is 14.5%; median 0% (74% of configs have no global-scope rules); worst case 219%.
Retrieval on a 1,033-item mixed corpus and 50 queries: TypeRetrieve hits 100% recall@50 against 73% for the best single-shot LLM retriever (Sonnet). Pinning is a database lookup, 0 LLM tokens per query versus 5,776-6,741.
Downstream, they swap "is the rule still there" for "does the agent do the wrong thing":
Human raters are stricter than the automated key-token test. TypeCompact's preserved rate falls from 91% to 86%; hierarchical truncation falls from 64% to 41%. The gap widens under the harder ruler.
Production agents already draft medical notes and change customer accounts. If compaction still delegates "please keep the safety rules" to a frontier model, those rules will vanish at the summary rate. The patch is engineering: classify once, pin the hard class, refuse to compact when verification fails.
For people who write AGENTS.md and CLAUDE.md, type mix is itself a quality signal. Configs dominated by preferences and recent logs are weaker than configs with explicit constraints and procedures. Multi-agent planners that summarize before delegating inherit the same cliff.
This is incremental and shippable. At 0.93 classifier recall, the missed 7% of constraints still disappear. The guarantee stops at the storage layer; it does not cover alignment training or chain-of-thought.
The guarantee is only as good as classifier recall. The 4.5-point preservation gap on SafetyMed is the nine declarative sentences SafetyMargin missed.
AgentArtifactCorpus comes from public GitHub. Closed enterprise distributions may differ; the classifier should be re-fit before deployment. Five-class annotator agreement is only κ=0.45; the constraint-versus-other split reaches 0.79. Decomposition overhead hits 219% in the worst case. Multi-round decay was measured on two of four LLM families. MaRS has no public implementation; the baseline is their reimplementation of a single submodular utility with no per-type pinning.
The retail comparison is not token-matched: TypeCompact keeps 1,136 tokens against 669 for hierarchical truncation. On airline, TypeCompact is shorter (647 vs 718) and still leads, but a token-matched behavioral control is missing. Items that become constraints only mid-session need an online classifier; this paper does not provide one.