跳转至

长运行 AI 智能体内存中的“压缩悬崖”现象

文章背景与核心概要

在长时间运行的 AI 智能体应用中，安全规则与情境日志往往需要争夺有限的上下文 Token 空间。传统的摘要工具通常会以统一的速率对这两种类型的信息进行压缩，然而事实上，安全规则必须保持准确的字面措辞才能具备可执行性。本文揭示了一种被称为“压缩悬崖”（Compaction Cliff）的关键现象：在实际生产配置中，标准压缩手段在经过一轮压缩后仅能保留 53% 的安全规则，而经过五轮压缩后这一比例更是骤降至 10%。

为了彻底解决这一痛点，论文提出了“知识分诊”（Knowledge Triage）框架。该框架根据智能体知识的类型进行分类，并通过三个确定性操作算子（TypeCompact、TypeDecompose、TypeRetrieve）应用定制化的保留策略。在公开语料库和行为基准测试上的实验评估表明，该方法在安全规则保留率、局部性违规控制、检索召回率以及下游任务通过率方面均显著优于基准方法。此外，作者还开源了包含 396,934 个智能体配置的 AgentArtifactCorpus 数据集。

执行摘要 (Executive Summary)

当 AI 智能体长时间运行时，安全规则和情境日志会争夺相同的上下文 Token。当 Token 预算溢出时，两者会以相同的速率被摘要；但只有规则需要准确的措辞才能保持可执行性。在 20 个生产智能体配置上，Claude Code 在 Sonnet 4.6 上的 /compact 提示词在经过一轮上下文压缩后仅能保留 53% 的安全规则，五轮后则降至 10%。我们将此现象命名为“压缩悬崖”（Compaction Cliff）。

为了解决这一问题，本文引入了知识分诊（Knowledge Triage）框架，该框架将智能体知识库中的每一行按类型进行分类，并让每种类型通过其专属的保留策略。三个确定性算子在三个上下文管理操作中实现了这种分诊机制：TypeCompact 根据每种类型的保真度要求就地重写条目；TypeDecompose 在安全复制范围内安全规则的同时，对过大而无法安全压缩的主题进行分区；TypeRetrieve 从外部存储中获取条目，并将范围内的规则置于语义相关性之前进行置顶。

在五个公共语料库上的实证评估表明，在所有压缩比下，TypeCompact 保留的安全规则是单次最强 LLM 压缩器的 2-4 倍，在五轮压缩中达到了 96% 的召回率。TypeDecompose 的局部性违规率达到 0%，而统一分区方法的违规率高达 93%。TypeRetrieve 的 Recall@50 达到 100%，而最佳单次 LLM 检索器仅为 73%。在三个下游行为基准测试中，我们在医疗合规性方面优于生产级 Sonnet 压缩器（配对 McNemar 检验 \(p < 10^{-8}\)，保真度，\(N = 200\)），在零售任务通过率方面优于全策略和分层基准（\(p < 0.01\)，\(N = 115\)），并在航空领域优于分层压缩（\(p = 0.024\)）。我们同时开源了 AgentArtifactCorpus（来自 54,628 个公开 GitHub 仓库的 396,934 个智能体配置）、分类器以及参考实现。

When a safety rule and an episodic log compete for the same tokens in an AI agent's context, and the budget overflows, both are summarized at the same rate; only the rule needs exact wording to remain enforceable. On 20 production agent configurations, Claude Code's /compact prompt on Sonnet 4.6 preserves 53% of safety rules after one compaction round and 10% after five. We name this the Compaction Cliff. We address it with Knowledge Triage, a framework that classifies each line of an agent's knowledge base by type and routes each type through its own retention policy. Three deterministic operators implement this triage across the three context-management operations: TypeCompact rewrites items in place under per-type fidelity, TypeDecompose partitions a topic too large to compact safely, replicating in-scope safety rules across partitions, and TypeRetrieve fetches items from external storage with in-scope rules pinned ahead of relevance. On five public corpora, TypeCompact preserves 2--4\(\times\) more safety rules than the strongest single-shot LLM compactor at every ratio, with 96% recall over five rounds. TypeDecompose reaches 0% locality violations against 93% under uniform partitioning. TypeRetrieve reaches 100% recall@50 against 73% for the best single-shot LLM retriever. On three downstream behavioral benchmarks, we outperform the production Sonnet compactor on medical compliance (paired McNemar \(p < 10^{-8}\) on preservation, \(N = 200\)), the full-policy and hierarchical baselines on retail task pass rate (\(p < 0.01\), \(N = 115\)), and the hierarchical compaction on the airline domain (\(p = 0.024\)). We release AgentArtifactCorpus (396,934 agent configurations from 54,628 public GitHub repositories), the classifier, and the reference implementation.

摘要 (Abstract)

A safety rule and an episodic log compete for the same tokens in an AI agent's context. When the budget overflows, both are summarized at the same rate; only the rule needs exact wording to remain enforceable. On 20 production agent configurations, Claude Code's /compact prompt on Sonnet 4.6 preserves 53% of safety rules after one compaction round and 10% after five. We name this the Compaction Cliff. We address it with Knowledge Triage, a framework that classifies each line of an agent's knowledge base by type and routes each type through its own retention policy. Three deterministic operators implement this triage across the three context-management operations: TypeCompact rewrites items in place under per-type fidelity, TypeDecompose partitions a topic too large to compact safely, replicating in-scope safety rules across partitions, and TypeRetrieve fetches items from external storage with in-scope rules pinned ahead of relevance. On five public corpora, TypeCompact preserves 2--4\(\times\) more safety rules than the strongest single-shot LLM compactor at every ratio, with 96% recall over five rounds. TypeDecompose reaches 0% locality violations against 93% under uniform partitioning. TypeRetrieve reaches 100% recall@50 against 73% for the best single-shot LLM retriever. On three downstream behavioral benchmarks, we outperform the production Sonnet compactor on medical compliance (paired McNemar \(p < 10^{-8}\) on preservation, \(N = 200\)), the full-policy and hierarchical baselines on retail task pass rate (\(p < 0.01\), \(N = 115\)), and the hierarchical compaction on the airline domain (\(p = 0.024\)). We release AgentArtifactCorpus (396,934 agent configurations from 54,628 public GitHub repositories), the classifier, and the reference implementation.

核心贡献与框架 (Key Contributions & Framework)

  1. “压缩悬崖”现象的发现： 量化了长运行 LLM 智能体交互在经历重复上下文压缩时，安全约束所发生的灾难性衰减。
  2. 知识分诊框架（Knowledge Triage Framework）： 一种专门的架构，能够分离知识类型以应用针对性的保留策略，而不是对所有上下文文本进行统一处理。
  3. 确定性操作算子（Deterministic Operators）：
  4. TypeCompact：维持按类型划分的保真度约束。
  5. TypeDecompose：拆分大型上下文，同时安全地传播必要的安全规则。
  6. TypeRetrieve：在检索阶段优先处理规则，然后再考虑通用相关性。
  7. 实证验证与数据集： 在多个严苛基准（医疗合规、零售、航空领域）进行了验证，并开源了 AgentArtifactCorpus（从 GitHub 挖掘的近 400,000 个配置）。
  1. The Compaction Cliff Discovery: Quantified the catastrophic decay of safety constraints in long-running LLM agent interactions undergoing repetitive context compaction.
  2. Knowledge Triage Framework: A specialized architecture separating knowledge types to apply dedicated retention policies rather than treating all context text uniformly.
  3. Deterministic Operators:
  4. TypeCompact: Maintains per-type fidelity constraints.
  5. TypeDecompose: Splits large contexts while safely propagating necessary safety rules.
  6. TypeRetrieve: Prioritizes rules before general relevance during retrieval phases.
  7. Empirical Validation & Datasets: Validated across multiple rigorous benchmarks (medical compliance, retail, airline domains) and released the AgentArtifactCorpus (nearly 400,000 configurations mined from GitHub).