PaperlayerView exact revision on arXiv

Source-linked AI summary

Kernel-Managed Shared Memory for System-Wide Personalization

Ryan Lum, Yongfeng Zhang

arXiv:2609.10144v1cs.AIcs.LG

TL;DR

Multi-agent systems can learn useful user context in separate agents without making that context available system-wide. The paper introduces kernel-managed shared memory, in which agents write structured memories and the agent-system kernel controls retrieval, privacy, and prompt injection. Across three models and 1,800 trials, it outperforms unmanaged memory and standard retrieval augmentation, while largely matching full-context quality at lower latency and cost.

  • Problem

    Multi-agent systems lack a system-wide way to make context learned by one agent available to others while controlling which information each agent can access.

  • Method

    Kernel-managed shared memory lets agents write structured, tagged memories while the agent-system kernel manages identity resolution, ordering, retrieval, privacy filtering, ranking, formatting, token budgets, and prompt injection.

  • Results

    Kernel-managed shared memory reliably outperforms unmanaged memory and standard retrieval augmentation across three models, matches full-context performance on two of three models, and reduces latency by 15–61%.

  • Takeaways & Limitations

    Centralizing memory retrieval, privacy enforcement, and injection in the kernel delivers most of unconstrained context’s personalization benefit at a fraction of its cost.

Abstract

from arXiv · show

AI systems become more useful when they can adapt to the people using them, but in multi-agent systems, useful context learned by one agent often remains unavailable to others. We present kernel-managed shared memory, a system-level abstraction in which specialized agents write structured, tagged memories while the agent-system kernel, not individual agents, governs retrieval, privacy enforcement, and prompt injection. We implement and evaluate this design on AIOS and compare it against three alternatives across three assistant models (GPT-4o, Llama-3.1:8B, Qwen-2.5:7B) and 1,800 total trials. Against an unmanaged external memory backend (Mem0) using identical underlying storage, kernel-managed retrieval and injection improve personalization scores by 2.4-4.0 points on a 5-point scale (e.g., 1.05 to 4.69 profile usage on GPT-4o), with every comparison significant at p < 10^-18. Against standard retrieval-augmented injection, gains are similarly large and consistent across all three models. Against full, unfiltered context concatenation, a soft ceiling on available context rather than on response quality, kernel-managed injection statistically matches performance on two of three models and shows a small, model-specific deficit on the third, while using substantially shorter prompts: end-to-end latency is 15-61% lower across all three models, with corresponding reductions in per-call token usage and inference cost. These results indicate that centralizing memory management in the agent-system kernel, rather than leaving retrieval and privacy enforcement to individual agents, delivers most of the personalization benefit of unconstrained context at a fraction of its cost.

1 Introduction

Personalization becomes difficult in multi-agent systems when agents learn different parts of user context but keep that information isolated. The paper addresses this by moving memory retrieval, privacy enforcement, and prompt injection into the agent-system kernel, achieving near-full-context quality with lower cost.

  • Motivation and approach: Isolated agent memories prevent coherent system behavior when different agents learn stable preferences, current task context, and other parts of a user’s context.The motivation is especially acute in multi-agent systems, where context is distributed across specialized agents.
  • Motivation and approach: Kernel-managed shared memory centralizes retrieval, privacy enforcement, and prompt injection at the agent-system kernel rather than in individual agents.Agents write structured, tagged memories while the kernel governs shared-memory operations.
  • Evaluation: 1,800 total trials compare kernel-managed memory with an unmanaged external backend, standard retrieval-augmented injection, and full unfiltered context across three assistant models.The evaluation spans GPT-4o, Llama-3.1:8B, and Qwen-2.5:7B.
  • Findings: Kernel-managed injection matches full-context personalization quality at substantially lower latency and token cost, while outperforming unmanaged memory and standard retrieval augmentation.The comparison treats personalization as a system capability rather than repeated application-level logic.

2 Related Work

Prior work improves memory persistence, agent coordination, and personalization largely within application or agent-level pathways. This paper instead frames shared personalization memory as a kernel-level service governed by system-wide policy.

  • Memory systems for LLM agents: Prior memory systems extend persistence or improve memory structure, but memory control remains an application-layer component.Examples include MemoryBank, MemGPT, LongMem, ReadAgent, Mem0, Zep, LangMem, and A-MEM.
  • Multi-agent frameworks and shared state: Multi-agent frameworks emphasize coordination and role specialization, typically representing shared state through message passing or workflow-specific context.Personalization is commonly reconstructed separately by each agent.
  • Personalization and user modeling: Existing personalization work commonly assumes a single application or inference path and does not address system-level visibility, retrieval, or injection decisions across agents.The paper treats these decisions as kernel-level infrastructure.
  • OS-inspired agent infrastructure: OS-inspired agent infrastructure separates agent applications from runtime services, but existing systems do not make shared personalization memory a central kernel service.The paper builds on this infrastructure perspective while targeting shared user-specific state.

3 Methodology and Architecture

Kernel-managed shared memory moves personalization logic into the agent-system kernel, which coordinates structured memory production, identity, ordering, visibility, retrieval, formatting, and prompt injection for multiple agents.

  • System architecture: Kernel-managed shared memory centralizes identity resolution, write ordering, retrieval, privacy filtering, ranking, formatting, token control, and prompt injection in the agent-system kernel.Agents write structured memories with standardized metadata, while the kernel controls the personalization path.
  • Identity and ordering: The kernel resolves user identity through an explicit priority order rather than per-agent convention, addressing cross-user contamination during concurrent trials.The order uses request-attached identity, the latest session identity, a registry fallback, and the requesting agent’s identifier last.
  • Retrieval pipeline: The kernel transforms each prompt into an augmented prompt by retrieving, filtering, ranking, truncating, formatting, and injecting memories in the system call path.This pipeline exposes unified user context while preventing direct access to private agent-local memories.
  • System architecture: ProfileAgent and TaskAgent produce stable-user and task-context memories, while AssistantAgent consumes kernel-injected context without querying memory or constructing its own personalization prompt.This separates memory production from user-facing response generation.
  • Visibility control: Private memories remain invisible to non-owners, while malformed or absent sharing metadata defaults to private, making privacy a kernel invariant.The visibility rule permits owner access or explicitly shared access and rejects other cases.
  • Identity and ordering: A per-user write barrier provides read-after-write consistency up to a bounded timeout, preventing retrieval from racing ahead of pending writer operations.The barrier snapshots issued writes for the user and waits for them to drain; after timeout, retrieval proceeds fail-open.

4 Experiments

The experiments compare kernel-managed shared memory with three alternatives across three assistant models and 1,800 trials. Evaluation combines automated judging with a blinded human-rated subset and measures personalization quality across profile usage, task usage, and integration.

  • Experimental setup: 1,800 trials compare kernel-managed shared memory with three baselines across GPT-4o, Llama-3.1:8B, and Qwen-2.5:7B.The baselines are an unmanaged external memory backend, standard retrieval-augmented injection, and full unfiltered context concatenation.
  • Experimental setup: Scores measure Profile Usage, Task Usage, and Integration on a 1–5 scale using GPT-5.4 as the sole judge.GPT-5.4 is distinct from every evaluated assistant model.
  • Human validation: Human and automated scores strongly correlate, with Spearman’s ρ = 0.727 and agreement within one point on 83.3% of items.The human subset independently confirms the central GPT-4o comparison between kernel_shared, naive_concat, and mem0_default.
  • Quantitative results: Vanilla RAG profile scores remain nearly flat across models at 1.84/1.91/1.84, while task scores are higher at 3.84/3.78/3.84.The passage attributes this pattern to retrieval consistently dropping profile chunks rather than to model capability.
  • Quantitative results: Kernel-managed injection ties naive_concat on GPT-4o Profile/Integration and all Qwen-2.5:7B dimensions, but is significantly lower on Llama-3.1:8B Task/Integration.Against vanilla_rag and mem0_default, the advantage is large and overwhelmingly significant everywhere, with all p < 10^-18.
  • Latency analysis: 15–61% lower latency makes kernel_shared faster than naive_concat on all three models.Reported times are 7.5s vs. 19.2s for GPT-4o, 21.7s vs. 25.5s for Llama-3.1:8B, and 26.3s vs. 36.3s for Qwen-2.5:7B.

5 Discussion and Conclusion

Kernel-managed shared memory reliably outperforms standard RAG and an unmanaged external memory backend across all three models, while achieving lower latency than full unfiltered context. Its comparison with naive_concat is more nuanced, tying on two models and showing an unexplained Llama-3.1:8B deficit.

  • Discussion and conclusion: Kernel-managed shared memory outperforms standard RAG and an unmanaged external memory backend across all three models.The advantage over naive_concat is model-dependent rather than uniformly positive.

A.1 Human Validation Design Detail

The human-validation appendix describes a blinded GPT-4o subset scored with the same rubric as the automated judge and reports agreement, correlation, and rater consistency measures.

  • Validation design: 30 GPT-4o trials comprise 24 unique items and 6 duplicates, presented in randomized order under opaque identifiers.The rater was blind to both condition and automated judge score.
  • Validation design: A single human rater scored the Integration dimension using the automated judge’s 1–5 rubric.The table reports human-rater versus automated-judge agreement by method.
  • Agreement results: The rater gave identical scores on 5 of 6 duplicate pairs, with a mean absolute difference of 0.17.Using one rater prevents computation of inter-rater reliability statistics such as Krippendorff’s α.

A.2 Threat Model and Empirical Verification Detail

The threat model considers agents attempting to access unauthorized memories, while empirical verification tests the privacy policy at fully private and fully shared endpoints. The benchmark does not yet sweep intermediate configurations or adversarial queries.

  • Threat model: A compromised, buggy, or malicious agent cannot exfiltrate unauthorized memories by bypassing its own filtering because visibility is checked at the kernel on every retrieval path.The attacker would need to compromise the kernel’s enforcement mechanism.
  • Empirical verification: The study has not run a designed sweep over intermediate sharing configurations or an adversarial query campaign.Both evaluations are identified as future work.
  • Empirical verification: The existing benchmark provides an empirical check of the privacy rule at the two endpoints of the sharing policy.At the fully-private endpoint, retrieval-eligible cross-agent exposure is 0/450 trials.

A.3 Significance Testing Detail

Table 4 and Figure 3 report the complete set of nine kernel_shared versus naive_concat comparisons discussed in Section 4.4.

  • Nine model-dimension comparisons underlie the kernel_shared versus naive_concat analysis.
  • Table 4 and Figure 3 together provide the full comparison set for Section 4.4.
  • The reported comparisons span the model-dimension combinations evaluated in Section 4.4.

A.4 Latency Mechanism Detail

Latency differences between kernel_shared and naive_concat reflect both output-length patterns and input-side savings. Figure 3 shows that six of nine comparisons do not differ significantly, while Llama-3.1:8B remains 15% faster despite no significant output-length difference.

  • Significance pattern: Six of nine kernel_shared versus naive_concat intervals cross zero, indicating no significant difference.
  • Output-length mechanism: Output length and latency correlate strongly within every condition (r = 0.52–0.86, all p < 10^-11).
  • Output-length mechanism: The output-length difference is significant for GPT-4o and Qwen-2.5:7B but not for Llama-3.1:8B (p = 0.27).
  • Input-side savings: Llama-3.1:8B remains 15% faster with kernel_shared, implicating input-side savings rather than generation length.
  • Interpretation: A plausible but untested explanation is that unfiltered context elicits longer responses, whereas curated context elicits more targeted responses.

A.5 Ablation Pilot Detail

The pilot and implementation details describe a shared-memory evaluation pipeline refined through successive scoring changes and mediated by kernel-level modules, retrieval, injection, and bounded write coordination.

  • Ablation pilot: Raw JSON injection scored worse than the private baseline on all three dimensions in the 30-trial Qwen-2.5:7B pilot.
  • Ablation pilot: Natural-language formatting and an explicit system-prompt instruction narrowed the pilot gap without closing it.
  • Ablation pilot: Only the hybrid keyword+LLM judge produced a positive pilot result.
  • Kernel implementation: Kernel module indirection lets the system change providers, retrieval strategies, or barrier timeouts without changing agent code.
  • Write barrier: The write barrier uses per-user sequence numbers, snapshots, releases, and bounded wait-until-drained operations.
  • Write barrier: Fail-open bounded waits preserve partial responses when writes stall, but behavior at larger memory-store sizes was not evaluated.
  • Injection pipeline: The kernel injection pipeline retrieves, merges, filters, ranks, formats, truncates, and injects shared memories as a system message.
  • Cross-agent retrieval: Cross-agent retrieval can fall back to a global user registry, enabling personalization when the requesting agent has no prior memory.
Loading 2609.10144v1…