Source-linked AI summary
Compute Globally, Materialize Locally: The Memory Contract of Sparse Event-KV
Zefeng Cai, Zerui Cai
TL;DR
Sparse event-KV serving assumes retained rows remain informative after their source observations are evicted, but this has rarely been tested directly. The paper omits source observations while serving downstream rows and finds that answers follow the omitted values, showing that cached events can materialize computation whose inputs are gone.
Problem
Eviction evaluations rarely isolate whether retained KV spans still carry state derived from observations that have been evicted.
Method
The paper compares donor-paired histories, omitting a source event while serving a downstream event whose text does not state the source value.
Results
99:0 donor-aligned answers on Qwen3-8B show that served downstream rows can carry information about an omitted source value.
Takeaways & Limitations
Dropping a source event without accuracy loss does not show it was unnecessary, because a retained row may already carry its answer.
Takeaways & Limitations
The evidence supports compact-state transfer, while larger payloads rarely transfer and negative accessibility results remain dependent on the output interface.
Abstract
from arXiv · showhide
Long-horizon agents increasingly reuse their KV cache as memory: a serving system keeps a subset of cached entries and drops the rest. Eviction and episodic-memory schemes therefore rest on a premise rarely tested directly, that a retained event is still informative once the observations that produced it are gone. We test it by omitting one earlier observation from what is served, across otherwise identical agent histories. Among items sensitive to that observation, the answer overwhelmingly follows the omitted value, though no served span says which value is correct. We call this semantic materialization: a downstream event's cached rows act as an independently servable view of computation whose inputs are gone. It can also be written on purpose. A deliberately phrased, answer-free event raises donor-aligned recovery from 6% to 51% on Qwen3-8B without ever naming the value, whereas passively harvesting natural mentions from long-term dialog yields no detected advantage. What such a row carries is specific and bounded. Compact state survives, larger payloads decay toward chance, and whether a construction writes at all turns on phrasing rather than on meaning alone, so two phrasings the model comprehends equally well can diverge sharply. The result is a memory contract for sparse event-KV serving: what to write, where it lands, and what survives once the source is gone. For anyone who evicts the corollary is that dropping a source event and observing no accuracy loss does not show the source was unnecessary.
1 INTRODUCTION
This paper shows that downstream cached rows can retain source-omitted state, so sparse serving selects more than visible token content. The effect is programmable but bounded by phrasing, landing structure, and readout calibration, while passive harvesting is unreliable.
- Semantic materialization: Among donor-sensitive items, answers follow the omitted source 99:0 on Qwen3-8B although no served span states which value is correct.The controlled donor-pair comparison isolates hidden state from visible answer text and decoy elimination.
- Semantic materialization: Global prefill can materialize compact, source-omitted state into selected downstream event spans without repeating that state verbatim.The downstream representation can behave like a precomputed result recoverable at read time without recomputing upstream computation.
- Programmability: Deliberately written carrier events make the primitive programmable, whereas passive harvesting of natural mentions is not a dependable interface.An explicit textual record remains the reliable fallback when state must survive operand eviction.
- The memory contract: Across 16 constructions read correctly at .98 on average, write-through ranges from chance to .95, making trigger behavior dependent on surface form rather than meaning alone.No construction is class W on all three recent models, so materialization and readout require per-checkpoint calibration.
- Eviction consequence: Dropping a source event without accuracy loss does not prove it was unnecessary, because a retained downstream row may already carry the answer.Corrections can then follow as served patches rather than recomputation.
2 THE SERVING CONTRACT
The serving contract tests whether retained rows can recover upstream state without the source event, future query wording, auxiliary readers, or fine-tuning. It distinguishes materializing carriers and conditional landings from routing reference edges, while making query placement a protocol choice.
- Serving contract: Source events defining the queried state are excluded, the exact future query instance and wording are absent at write time, and no auxiliary reader or fine-tuning is allowed.The frozen model must recover state through its native interface; a predicate or target schema may be anticipated.
- Predicates: A served span materializes v when its contextualized rows KV(e) induce donor-aligned behavior relative to isolated re-encoding with the source omitted and visible tokens and positions fixed.This defines materialization as a behavioral property of the retained rows, not a textual mention of the value.
- Predicates: A conditional landing materializes v under span-level ablation when selected with fixed donor-invariant scaffolding suffices, distinguishing roots that land the value from reference edges that mostly route to it.The decoy and unrelated register are held constant across donors, and “on its own” means selected rather than served in isolation.
- Where the query goes: Retained rows keep their original positions, but query placement differs: synthetic arms append the query after the last retained row, whereas eviction-style serving preserves the original timeline and key rotations.Reference implementations apply RoPE before compression, so retained keys keep their original rotation.
3 DISCOVERY: A SERVED ROW ANSWERS FROM AN OMITTED SOURCE
A served downstream event can answer from an omitted source, with responses overwhelmingly following the hidden donor despite no served span stating the value. This materialized state is semantic, lossy, and bounded: explicit updates override it, while wording transfers weakly.
- Donor Following: 99:0 donor-sensitive items on Qwen3-8B followed the omitted source rather than its opposite, despite no served span identifying the correct value.The result was statistically significant at p=3.2×10−30.
- Donor Following: 39:1 was the narrowest donor-following root cell measured, with no Table 1 cell showing more than one anti pair across serving setups, models, and readouts.The narrowest cell was Qwen3 with the mention co-served.
- Semantic Materialization: Selecting contextualized event rows can preserve materialized results of omitted computation rather than only their visible token content.The served downstream event acts as an independently usable carrier of the omitted computation’s result.
- Lossy Representation: 64% of matched swap pairs transferred semantic polarity, versus 9.7% transferring hidden donor wording and 8% in the isolated re-encoding control.The carrier transfers state rather than verbatim string content.
- Explicit Overrides: 0/96 items showed old-value leakage after an explicit reset, while the served update won 96/96 times.The carry-over does not retain a stale value against a fresh instruction; only what was already written downstream persists.
4 TRIGGER: WHICH EVENTS MATERIALIZE THE STATE
Materialization is triggered by surface construction as well as semantic relation: equally comprehended carriers can differ sharply in write-through. The write aperture varies by model, so constructions and readout protocols require per-model calibration rather than universal assumptions.
- Evaluation: Sixteen carrier constructions span mirror and flag families, neither naming a value, and are evaluated by comprehension and write-through after source omission.Write classes are W (≥.75), P (.625–<.75), U (<.625), and X for failure of the full criterion.
- Evaluation: .98 comprehension mean and .77 minimum show near-ceiling understanding, but comprehension does not predict whether a construction writes through.Write-through, rather than comprehension, determines the construction’s class.
- Surface trigger: .94 versus .52 write-through on Qwen3 and .95 versus .56 on Ministral-3 show that semantically equivalent constructions can have sharply different write fates.The write gate depends on semantic relation × surface construction, not semantics alone.
- Model dependence: 5/4/7/0, 7/2/7/0, and 0/2/14/0 are the W/P/U/X class totals for Qwen3, Ministral-3, and Gemma-4, respectively.No construction is W on all three models; mirrors reach W on Qwen3 at .80 but never on Gemma-4.
- Readout calibration: 8 of 16 Gemma-4 constructions have reachable candidate logits despite none being W under trace readout, separating latent accessibility from free-generation realization.The divergence makes donor-aligned accessibility a model × construction × protocol property; explicit textual records recover on every evaluated model.
5 LANDING: ROOTS CARRY, REFERENCE EDGES ROUTE
Materialized values reside in root events, while reference edges route later queries to those roots; serving protocol, serve-set composition, and wording all change the readout. The surviving information is therefore routed and readout-sensitive rather than uniformly preserved.
- Root storage and edge routing: Roots carry materialized values, while reference edges route queries to them across multiple downstream events.For Gemma-4, querying T after omitting the source follows the root donor 41:0, whereas the edge without the root carries 2:0; Ministral-3 reproduces routing at 298:0.
- Serving protocol: The root contrast changes with serving protocol: Qwen3 shows a larger contrast when the mention is absent, whereas Gemma-4 reverses that ordering.The protocols also differ in the appended query’s absolute position, motivating a position-controlled replication.
- Serve set and wording: 41% →22%: adding a value-free target mention lowers Qwen3 root-donor sensitivity, tracking the serve-set change rather than the referent.This effect is distinguished from wording effects because the value-free mention changes what is served.
- Serve set and wording: 3%: valenced phrasing reduces sensitivity in the same serve-set slot, indicating read-time competition rather than write-time erasure.Wording acts at a fixed serve set, so equally targeted constructions can produce sharply different readouts.
6 ACCESS: BINARY STATE RECOVERS, LARGER PAYLOADS FADE
Access recovers compact binary and derived state substantially better than larger numeric payloads, but recovery depends on how the state was written and queried. Write-time computation can improve derived recovery without rescuing source-omitted numeric payloads, while preferred addressing varies by construction.
- Access: 0.934 binary-state recovery exceeds chance (.5), while four-way and eight-way recovery remain near their respective chance rates.Four-way recovery is .223 against .25 chance, and eight-way recovery is .156 against .125 chance.
- Access: About four-fifths of successes are attributed to genuine recall, with harvested recovery clearing both decoy-based heuristic baselines.The separate decoy-stratified audit distinguishes recall from decoy-exclusion and includes answering the complement.
- Access: .542 → .703 derived recovery follows a write-time computation note, but harvest-dropped numeric payload recovery remains 0 → 0.The same note improves source-present computation from .401 → .938, showing that the intervention did not extend to source-omitted numeric recovery.
- Access: .20 first-digit and .62 quantile queries outperform exact numeric recall, while latent carriers vary in whether source- or target-addressed queries succeed.Two compact bindings can be carried in parallel, and the preferred address varies by construction.
7 PROGRAMMING THE PRIMITIVE
Programming the primitive requires deliberate, compact carrier events rather than relying on natural-dialog mentions. The effective construction varies by model and readout, while explicit textual records recover across recent models and corrections are cheaper as appended patches than recomputation.
- Deliberate carriers: 6% to 51%: an answer-free NL-compute directive raises donor-aligned recovery on Qwen3 without naming the value.The directive says to determine and record the verdict, but remains answer-free.
- Construction dependence: No materialization syntax is universal: construction success depends on model and readout, while explicit textual records recover on every recent model.Qwen3 shows a non-saturating ordering, Gemma-4 ceilings on every arm, and Ministral-3 is abstention-dominated under free generation.
- Harvested carriers: 4,229/256=.895 harvested versus .516 echo and .484 complement, with recall share r≈.80 and 95% CI [.73, .86].These are the reported harvested, echo, complement, recall-share, and confidence-interval values.
- Natural-dialog stress test: Natural-dialog harvesting yields no detectable benefit on REALTALK and LoCoMo long-term dialogs for either recent model.On Gemma-4, harvesting is equivalent to isolated encoding within the ±.05 band.
- Corrections: O(pL+p^2) versus O(L^2): appending a p-token patch repairs the current state more cheaply than recomputing an L-token prefix.Served patches can hijack historical queries unless query-scoped, degrade accuracy by their presence, and are template-fragile.
8 RELATED WORK
Prior work manages, repairs, compresses, or composes reused KV and builds episodic-memory shells, while this work audits what omitted source events leave behind in downstream KV. Its closest analogue studies source-omitted mementos, but the paper frames its contribution as a substrate-level contract for event-KV serving.
- Nearest mechanism work: Models Take Notes and MEMENTO are the nearest mechanism precedents, respectively memoizing downstream conclusions and retaining implicit information from masked reasoning blocks.Models Take Notes also includes field-level editing, append-only errata, and position-portable notes; MEMENTO trains models to emit compressed mementos.
- KV reuse and repair: CacheBlend, EPIC, InfoFlow KV, and KEEP repair, recompute, group, or reconstruct reused KV, whereas this work audits what omitted sources leave behind.The cited systems selectively recompute cross-chunk dependencies or reconstruct cross-attention between grouped memories.
- Memory systems: EpiCache selects and compresses episodic KV under query-time uncertainty but retains original-history episodes, unlike this work’s source omission and audit of answer-free downstream spans.The comparison is made on the same REALTALK/LoCoMo distributions.
- Limitation: 10 dyads in REALTALK form 3 participant components, so the dataset contributes a descriptive point estimate rather than 10 independent units.This limitation is stated in §9.
- Memory systems: MEM, MemGPT, EM-LLM, and long-context stress tests extend structured memory, episodic-context management, and serving-distribution research, while this work targets the substrate-level contract beneath those shells.The paper explicitly distinguishes its contribution from building another memory shell.
9 LIMITATIONS AND SCOPE
The findings establish a causal channel for compact state, but payload transfer and native numeric recovery are limited, while some results rely on costly prompting or oracle row selection. Negative accessibility results measure the output interface rather than representation-level accessibility.
- Limitations and scope: 9.7%: Verbatim payloads rarely transfer, limiting the donor-swap causal channel to compact state.The donor swaps certify a causal channel for compact state only.
- Limitations and scope: Derived conclusions require a write-time prompt that reduces full-context accuracy from .818 to .698.Exact numeric payloads are not natively recovered.
- Limitations and scope: The flat multi-hop curve uses oracle row selection, so it represents a mechanism ceiling rather than a deployed number.This limits how directly the curve generalizes to deployment.
- Limitations and scope: Negative accessibility verdicts measure the output interface, leaving representation-level probing as an outstanding limitation.The passage identifies representation-level probing as unresolved.
10 CONCLUSION
A downstream event row can preserve a computation’s conclusion after its source observation is omitted, showing that sparse event-KV serving is more than retrieval. Consequently, unchanged accuracy after source eviction does not establish that the source was unnecessary.
- 10 CONCLUSION: 99:0 answers on Qwen3-8B followed the omitted donor among donor-sensitive items, despite the served event never stating its value.The result identifies an independently served, source-omitted event row as carrying a computation’s conclusion after its inputs are gone.
- 10 CONCLUSION: Sparse event-KV serving is more than retrieval over rows because independently served event rows can carry conclusions whose inputs are gone.The primitive is described as programmable, making it a system-building substrate rather than only a retrieval mechanism.
- 10 CONCLUSION: Dropping a source event without accuracy loss does not show that the source was unnecessary, because another retained row may already carry its answer.Reusable KV can act as a semantic memory substrate under calibrated write and read conditions.
REPRODUCIBILITY · A PROTOCOL DETAILS
The paper fixes model checkpoints, decoding, donor-pair controls, serving mechanics, statistical tests, compatibility gates, and active- and real-dialog protocols to make sparse event-KV results reproducible. Its headline claims are checkpoint-specific and supported by explicit causal, behavioral, and answerability checks.
- REPRODUCIBILITY: Experiments use frozen open-weight checkpoints with greedy decoding, code-enforced donor pairs, leak assertions, and echo controls; headline claims are checkpoint-specific rather than family-level.Headline claims use Qwen3-8B, Ministral-3-8B (instruct), and Gemma-4-12B, each at one frozen bf16 revision.
- A PROTOCOL DETAILS: Events are encoded once, then selected rows are reassembled at original position ids with a fresh query appended into contiguous cache slots.Windowed attention counts windows in slots, whereas full-attention layers are unaffected by contiguity.
- A PROTOCOL DETAILS: The headline causal effects replicate with near-perfect directionality on 2026 Gemma-4.This result is reported for the headline causal effects rather than as a family-level claim.
- A PROTOCOL DETAILS: Donor pairs differ only in the omitted source, and donor dependence is established when greedy-decoded outputs differ under the byte-identity control.The protocol partitions pairs into transition classes including donor-aligned follow cases.
- A PROTOCOL DETAILS: Recent 2025–26 models pass behavioral-compatibility gates comparing one-shot prefill with encode–assemble–continue at content, first-token, and logit-deviation levels.Qwen3 matches one-shot prefill on 21/24 full decoded answers and 23/24 first-token outcomes; all arms are 24/24 task-correct.
- A PROTOCOL DETAILS: Active-materialization arms use 192 donor pairs per arm per model, two templates, 24-event trajectories, a mid-trajectory source, a following-slot carrier, and an unrelated-query echo control.A secondary target-addressed readout moves Qwen3 grounded binding from .089 to .188.
- A PROTOCOL DETAILS: Real-dialog QA require an answer-free late mention, balanced candidate order, paired harvested-versus-isolated encodings, clustered bootstrap with B=4000, and a preregistered ±.05 equivalence band.A gold-evidence arm certifies answerability at .85–.96 under the two-choice condition.
B ADDITIONAL TABLES
The additional analyses delimit the memory contract: construction is model- and phrasing-sensitive, compact state can survive source removal, and retained rows expose specific rather than unrestricted information. Mirror-chain, denoising, transition, and passive-harvest results further distinguish genuine materialization from routing effects, unrelated-query leakage, and naturally harvested mentions.
- Construction classes: Gemma-4 reaches ≥.90 candidate-logit reachability on 8/16 constructions and ≥.85 on 10/16 despite writing none, while trace/direct readouts differ by −.46 to +.65.The four legacy 2024 models are reported separately, and comprehension-failed models are excluded from write claims.
- Payload capacity: Observed binary-bit accuracies of .500 and .508 remain near chance, while four-way accuracy is .285 and the bit pair reconstructs the four-way answer at .262.The neutral YES/NO relabelling is uninformative because the model answers NO almost always, so the envelope concerns what rows expose rather than label decoding.
- Mirror-chain location: Only the root mirror answers above the text floor: C1 alone reaches .699, versus .465 for C2 and .484 for C3 after the source is dropped.C2 and C3 are respectively level with the .473 text floor and below the .539 constant-answer baseline on this label split.
- Source-present denoising: 377/384 dependency-chain selections preserve accuracy across 1, 2, and 4 hops with the source served, whereas full-context reading achieves only 16/384 on far spans.Clean-text re-encoding performs comparably at 384/384 versus 377/384, attributing the gain to routing/denoising rather than source-omitted materialization.
- Transition and harvest specificity: 0/192 unrelated-query flips occur with accuracy 1.00 in every transition arm, while an answer-free compute directive lifts Qwen3-8B donor-aligned recovery from 11/192 under passive mention to 97/192.The transition analysis reports anti≤4/192 throughout, and Qwen3 is construction-sensitive with dir−pas +.172 and nld−pas +.448.
C LEGACY-MODEL DIAGNOSTICS … G POSITION-CONTROLLED PRESENCE × ROOT-DONOR REPLICATION (X11)
The merged sections establish limits and controls on sparse event-KV interpretation: legacy-model results are exploratory, serving geometry can distort outcomes, and X11 shows that the replicated root-donor effect is driven mainly by added-row displacement rather than mention content. They also document scoring safeguards and frame corrections as newly served events rather than cache edits.
- C LEGACY-MODEL DIAGNOSTICS: Legacy models are exploratory diagnostics, not support for headline claims, with uneven coverage across construction, active-materialization, serve-set, and true-edge experiments.The four 2024-generation models differ in which experiment arms they ran; headline claims rest on three recent models.
- C LEGACY-MODEL DIAGNOSTICS: 8/16 W is Gemma-2’s widest trace-readout aperture, while Llama reaches 0/16 W and Mistral fails the comprehension control.Llama has 14/16 U readouts, and Mistral’s 13/16 X results exclude it from write claims.
- D SLIDING-WINDOW ORACLE GATE (GEMMA-4): Beyond Gemma-4’s 1024-token local-attention window, compact and native serving diverge sharply, whereas within-window aggregate follow counts agree and first-token argmax agrees on 29/32 cases.The divergence reflects sliding-window mask distortion and position/slot effects rather than simple over-exposure of the far row.
- D SLIDING-WINDOW ORACLE GATE (GEMMA-4): Native serving makes harvested and isolated real-dialog arms land at the same rate, .562 vs. .562, while compact serving reports a −.064 deficit.The two paths disagree on 34% of harvested items and 29% of isolated items, showing item-level rather than uniform differences.
- E DECOY DESIGN AND SCORING CONVENTIONS: Independent decoys and explicit treatment of unscorable readouts prevent elimination backdoors and conditioning-away of non-{ONLINE,OFFLINE} outcomes.Appendix B reruns effects with unscorable readouts counted as failures.
- F UPDATING THE SERVED STATE: CURRENT VERSUS HISTORY: Corrections are treated as new served events rather than cache edits, completing the write/serve/update contract without claiming priority on correction or cache editing.The update discussion isolates three update-management effects and distinguishes the paper’s scope from prior work.
- G POSITION-CONTROLLED PRESENCE × ROOT-DONOR REPLICATION (X11): X11 reports root-donor effects of +.086, +.138, and +.336 for men, fil, and abs, respectively, with intervals directionally consistent with earlier co-served and mention-absent values.The Qwen3-8B replication analyzes 116/128 length-matched items from a 24-event log.
- G POSITION-CONTROLLED PRESENCE × ROOT-DONOR REPLICATION (X11): −.052 is the position-controlled mention effect, versus −.198 for filler-plus-displacement and −.250 for the original contrast, so the mention-specific component is not distinguishable from zero.Roughly four-fifths of the confounded contrast is carried by serving the donor-invariant filler at the mention slot; TOST p=.32 does not establish equivalence at ±.075.