PaperlayerView exact revision on arXiv

Source-linked AI summary

DRSR: Learning Set-Level Deletion Risk for Efficient Long-Horizon Agents

Mingxuan Wang, Bo Wang, Fei Luo, Guorun Yao, Chao Ning, Yinglong Guo, Hongyue Chen, Yanbiao Ma, Jungong Han

arXiv:2609.27276v1cs.AI

TL;DR

Long-horizon agents accumulate histories whose relevance changes with the current decision, while deleting several units can be unsafe even when singleton scores appear acceptable. DRSR learns set-level deletion risk from completed trajectories and uses a lightweight scorer to gate online pruning with abstention. On WorkBuddyBench Full260, it raises reward from 0.699 to 0.802 while reducing tokens by 20.820%.

  • Problem

    Historical relevance changes with the current decision, and independent unit scores cannot reliably recover the risk of deleting a set.

    Source: §1 · p. 1

  • Method

    DRSR jointly deletes protocol-valid Blocks in completed trajectories to rescore the same recorded next output, then trains a lightweight relational set-risk scorer for online pruning.

    Source: §1 · p. 2, §3.1 · p. 4

  • Results

    On WorkBuddyBench Full260, DRSR raises reward from 0.699 to 0.802 while reducing tokens by 20.820%; on Eval40, it reaches 0.794 reward with 35.850% fewer tokens.

    Source: §6 · p. 11

  • Takeaways & Limitations

    The results support state-dependent, set-level context compression over independent importance ranking of historical units.

    Source: §6 · p. 11

Abstract

from arXiv · show

Long-horizon language-model agents accumulate reasoning traces, tool exchanges, and observations whose relevance changes with the current decision. Existing compression strategies often score historical units independently, but the safety of deleting several units is generally not determined by their singleton scores: redundant evidence, accumulated small effects, and the information that remains after deletion all matter. We introduce Direct Relational Set-Risk Pruning (DRSR), which formulates agent-history compression as risk-constrained selection over deletion sets. Offline, DRSR constructs exact counterfactual supervision by jointly deleting protocol-valid history Blocks and measuring the change in teacher-forced likelihood of the same recorded next output. A lightweight scorer then predicts set-level harm from online-visible relations between candidate history and the current pre-action state, together with deleted-retained and pairwise set structure. At deployment, DRSR evaluates a small set of structurally valid deletion candidates with the lightweight scorer and removes the largest feasible set under recency, protocol, budget, and learned-risk constraints, abstaining when no set is sufficiently safe. On WorkBuddyBench Full260, DRSR increases mean reward from 0.699 to 0.802 while reducing total model tokens by 20.820%. On the fixed Eval40 comparison, it obtains 0.794 reward at 1.211M tokens per task, using 35.850% fewer tokens than the uncompressed agent. Mechanistic analyses and ablations further show that decision-conditioned relations, retained-context information, pair interactions, and abstention each contribute to reliable pruning.

1 Introduction

Long-horizon agents accumulate histories whose relevance changes with the current decision, while safe pruning must account for the joint effects of deleting multiple units. DRSR learns set-level deletion risk from completed trajectories and uses it to gate online pruning with abstention.

1 Introduction

  • Historical value changes with the current decision, so age, position, or a fixed context window alone cannot reliably identify what remains necessary.An error trace can become redundant after its conclusion is recorded, while an early task constraint may remain important until completion.Source: §1 · p. 2
  • Removing several Blocks can eliminate the only remaining evidence or accumulate individually small effects into substantial harm.Two Blocks may each appear removable in isolation because either preserves the same fact.Source: §1 · p. 2
  • DRSR learns set-level deletion risk from completed trajectories by jointly deleting protocol-valid Blocks and rescoring the same recorded next output.This directly measures the proposed set rather than combining independently evaluated singleton scores.Source: §1 · p. 2
  • DRSR models relations between candidate history and the current decision state, including both removed and retained information and interactions within the deletion set.The representation backbone and task model remain frozen.Source: §1 · p. 2
  • Online, DRSR gates protocol-valid deletion candidates with learned risk, selects the feasible set with the largest token saving, and abstains when none is sufficiently safe.The pipeline uses offline fixed-output supervision and online risk-gated selection.Source: §1 · p. 3, Figure 1 · p. 3

2 Related Work

Prior work addresses agent memory management, prompt compression, structured pruning, and learned eviction, while DRSR focuses on the risk of jointly deleting protocol-valid history Blocks. Its offline fixed-output supervision and online abstention also connect to privileged supervision and selective prediction.

Agent memory and context management

  • Agent memory systems and prompt compressors edit or compress active context, while DRSR supervises protocol-valid deletion sets by their measured effect on a fixed recorded next output.The cited approaches include explicit history-editing methods and token-budget prompt compression methods [4, 5, 7, 8, 20, 21, 22].Source: §2 · pp. 3–4

Structured pruning and KV-cache eviction

  • Inference-time pruning and KV-cache eviction often score individual units, whereas DRSR predicts the risk of jointly deleting serialized agent-history Blocks.Related methods use attention, recency, adaptive budgets, or learned future contribution [17, 28, 29, 30, 31].Source: §2 · p. 4

Removal-based measures and interactions

  • DRSR's interaction residual is related to discrete Shapley interaction terms, but it predicts harm for protocol-permitted deletion sets rather than symmetric attribution over all history [10, 11, 12, 13, 32, 33].Source: §2 · p. 4

Privileged supervision and selective prediction

  • DRSR transfers training-only deletion signals to a lightweight online predictor and abstains when no candidate passes its risk gate, but it neither estimates semantic uncertainty nor provides a conformal guarantee [14, 15, 16, 18, 19, 34, 35, 36, 37, 38, 39, 40].Source: §2 · p. 4

3 Problem Formulation

The formulation treats agent history as protocol-structured Blocks and defines deletion harm by comparing the likelihood of the same recorded next output under intact and edited contexts. Since set harm depends on what remains and cannot be known before the next output, DRSR learns an online risk estimate from offline measurements.

3.1 Structured History and Deletion Actions

  • A Block is either complete assistant content for a Step or an atomic tool exchange containing a call and matched response; pruning preserves valid protocol and original order.The deletion operator jointly removes a proposed set of eligible Blocks.Source: §3.1 · p. 4

3.2 Counterfactual Deletion Harm

  • Deletion harm compares the loss of the same recorded next assistant output under the edited context with its loss under the intact context.Holding the output fixed makes the comparison depend on deletion rather than a newly sampled continuation.Source: §3.2 · pp. 4–5
  • The same historical Block can be removable at one decision state and necessary at another, so deletion harm is state dependent rather than an intrinsic Block property.Source: §3.2 · p. 5

3.3 Why Singleton Scores Do Not Determine Set Risk

  • Joint harm sums conditional effects under changing retained contexts, so it is generally not the sum of singleton harms measured in the original context.Redundant Blocks may each appear safe to remove while their joint removal eliminates the last copy of evidence; only zero interaction permits exact additive reconstruction.Source: §3.3 · p. 5
  • Even when interaction is zero, several individually acceptable deletion harms can accumulate beyond the allowed tolerance.Set-level prediction and structural constraints address accumulation as well as interactions.Source: §3.3 · p. 5

3.4 Risk-Constrained Deletion Objective

  • The ideal policy maximizes direct context saving over structurally valid deletion sets subject to an allowed harm constraint.This separates compression benefit from deletion risk.Source: §3.4 · p. 6
  • Exact harm cannot be evaluated online because the realized next output is not yet available; separate candidate generations would not recover the fixed-target quantity.Source: §3.4 · p. 6
  • Completed trajectories permit exact offline supervision, from which DRSR learns a scorer that estimates risk from current causal context and the proposed deletion set at deployment.Direct token saving remains the online optimization objective.Source: §3.4 · p. 6

4 Direct Relational Set-Risk Pruning

DRSR represents candidate history in relation to the current pre-action state, predicts risk for deletion sets using removed and retained information, and applies the learned score as an online feasibility gate. It selects feasible sets for token saving and abstains when none pass.

4.1 Candidate Construction and Relational Features

  • Candidate construction protects recent complete Steps and samples older protocol-valid history across the trajectory, preferring edits with meaningful direct token savings.The candidate rule is fixed before deletion outcomes are observed.Source: §4.1 · p. 6
  • Each candidate Block is represented by structural features and attention and hidden-state relations to the current pre-action state, rather than by intrinsic importance alone.Features include age, position, type, length, lexical and tool overlap, and redundancy.Source: §4.1 · p. 6
  • Attention mass measures attention from the current pre-action position to a Block, while density reduces the direct effect of Block length.Source: §4.1 · p. 6
  • Hidden-state relations compare Block and current-state representations, while projected semantic features retain directional information beyond a single similarity value.These are model inputs, not deletion rules; low attention does not establish safety, and high similarity does not require retention.Source: §4.1 · pp. 6–7

4.2 Set-Risk Representation and Learning

  • The set representation encodes removed candidates, retained candidates, relations within the deleted set, and relations between deleted and retained evidence.Risk therefore depends on whether equivalent or supporting information survives elsewhere.Source: §4.2 · p. 7
  • A lightweight pairwise summary supplies interaction-aware information without assuming that final deletion risk is a sum of pairwise terms.Source: §4.2 · p. 7
  • The scorer outputs predicted harm and an unsafe score; training combines harm regression, set ranking, and unsafe-set classification.The unsafe score supports thresholded decisions and is not interpreted as a probability of task failure.Source: §4.2 · p. 7

4.3 Risk-Gated Selection and Abstention

  • Online, structural constraints are enforced directly and the learned risk score gates valid candidate sets; DRSR selects the feasible set with greatest direct token saving or abstains.Candidate sets are scored by the lightweight network without candidate-specific deletion forwards or additional language-model queries.Source: §4.3 · pp. 7–8

5 Experiments

The experiments assess DRSR through mechanistic analyses and end-to-end evaluation on WorkBuddyBench Full260 and fixed Eval40. They examine set-risk prediction, benchmark performance, and the contributions of retained-context features, pair pooling, and abstention.

5 Experiments

  • The scorer evaluation uses 566 external trajectories, 1,698 decision states, and approximately 24,122 deletion-set labels; end-to-end tests use Full260 and a fixed 40-task Eval40 subset.Full260 aggregates are task-count weighted, while Eval40 uses an equal-domain mean.Source: §5 · p. 8

5.1 Mechanistic Analysis of History and Set Risk

  • Matched pre-action states yield 70.920% meaningful-gap pair accuracy, versus 62.020% for mismatched states; the best combined relation reaches 72.130%.The Block-level median within-state harm range is 0.028, versus 0.312 at Step level, motivating Block-level actions.Source: §5.1 · p. 8
  • Summing singleton harms reaches only 58.940% meaningful-gap pair accuracy, and mean absolute non-compositionality rises from 0.000 for singleton deletions to 0.027 for four-Block sets.At three Blocks the mean interaction magnitude is close to the δH = 0.020 harm-label threshold; at four Blocks it exceeds it.Source: §5.1 · pp. 8–9, Table 1 · p. 8
  • Including exact pair interactions reduces joint-harm reconstruction MAE from 0.018 to 0.008, a 54.400% reduction.This is a diagnostic analysis; the deployed policy learns risk without observing exact pair interactions online.Source: §5.1 · p. 9, Table 2 · p. 9

5.2 Full260 End-to-End Results

  • On Full260, DRSR reaches 0.802 reward at 2.126M tokens per task, versus Structural Pruning’s 0.701 reward at 2.292M tokens per task.The domain analysis reports token reductions in all four domains, with the largest reward improvement in Security and only modest change in Office.Source: §5.2 · p. 9, Table 3 · p. 10

5.3 Context-Management Comparison on Eval40

  • On Eval40, DRSR achieves 0.794 overall reward at 1.211M tokens per task, versus 0.675 reward at 1.887M tokens for the uncompressed agent.This corresponds to a 0.119 reward gain and 35.850% fewer total tokens.Source: §5.3 · p. 10

5.4 Component Ablation

  • Removing abstention, retained-context features, or pair pooling lowers Eval40 overall reward, though ablation effects vary by domain.Removing abstention raises direct deletion from 25.155K to 30.093K tokens per task while reward falls from 0.794 to 0.752; removing retained-context features or pair pooling yields rewards of 0.750 and 0.757, respectively.Source: §5.4 · pp. 10–11, Table 5 · p. 11

6 Conclusion

DRSR frames agent-history pruning as risk-constrained selection over deletion sets, using offline counterfactual supervision and a compact scorer with abstention. The reported benchmarks show higher reward alongside token reductions.

6 Conclusion

  • DRSR formulates agent-history pruning as selection over the joint deletion risk of structured Blocks.It learns this risk from offline counterfactual supervision and uses a compact scorer to gate online pruning with abstention.Source: §6 · p. 11
  • On WorkBuddyBench Full260, DRSR improves reward from 0.699 to 0.802 while reducing tokens by 20.820%.On Eval40, it reaches 0.794 reward with 35.850% fewer tokens.Source: §6 · p. 11
  • The results support state-dependent, set-level compression over independent importance ranking of historical units.The paper concludes that safe context reduction requires modeling the current decision state and the joint structure of candidate deletions.Source: §6 · p. 11

Reproducibility Statement

The statement directs readers to the paper sections and appendices that specify DRSR’s formulation, implementation, evaluation, and deployment constraints.

Reproducibility Statement

  • Section 3 defines the deletion action space, counterfactual harm target, and label threshold.These are the components of the main formulation identified by the statement.Source: Reproducibility Statement · p. 11
  • Section 4 specifies candidate construction, relational features, set representation, training objective, and online selection.Source: Reproducibility Statement · p. 11
  • The appendices cover the decision procedure, scorer configuration, metrics, structural baseline, token summaries, and deployment information boundary.Appendix J also documents the validation-frozen deployment rule.Source: Reproducibility Statement · p. 11

AI Use Statement

The AI use statement describes writing and retrieval support, with author review and responsibility. The decision procedure evaluates protocol-valid deletion candidates and returns an unchanged request when its safeguards fail or no candidate is feasible.

AI Use Statement

  • Generative AI aided writing, formatting, and literature discovery; the authors reviewed and approved assisted text and references and take responsibility for the submission.Source: AI Use Statement · p. 11

A Decision Procedure

  • The procedure protects the system/task prefix and two most recent Steps, then constructs outcome-blind, protocol-valid candidates.It returns the original request if there are too few candidates, alignment fails, or the protocol is invalid.Source: A Decision Procedure · p. 14
  • A batch-scored candidate set is eligible only under protocol, recency, removal-budget, and risk constraints; the procedure chooses the feasible set with greatest token saving.If no feasible set remains, it returns the original request; the rewritten request is protocol-validated before return.Source: A Decision Procedure · p. 14

B Supervision and Task Sets

This material describes the supervision and design of DRSR’s set-risk scorer, the limits of singleton-based reasoning, and a structural pruning baseline. The baseline reports lower token use than the canonical Full260 baseline.

B Supervision and Task Sets

  • Approximately 24,122 set-level deletion labels are split 80:10:10 by source trajectory, keeping states and sets from each trajectory in one partition.Identical task counts alone do not establish a paired benchmark comparison; that also requires a shared task manifest, acting-model configuration, and token-accounting rules.Source: B Supervision and Task Sets · p. 14, Table 6 · p. 14

C.1 Candidate Construction and Structural Controls

  • Candidate construction protects the two most recent complete Steps and selects the longest protocol-valid atom from each of up to four chronological bins; structural controls are not standalone importance rules.Requests with fewer than three candidates, alignment failure, or invalid rewrites are left unchanged.Source: §C.1 · p. 15

C.2 Attention Relations

  • Attention mass records attention assigned to a Block and density normalizes by Block length, but attention is only one relation feature, not a deletion score.The implementation also records head-level measures and summary statistics across heads.Source: §C.2 · p. 15

C.3 Hidden-State Relations; C.4 Fixed Projected Semantic Relations; C.5 Candidate Feature Assembly

  • Hidden-state features compare a Block with the current pre-action state through similarity, distance, and magnitude, while fixed projections retain semantic-direction information.These relations are computed from the intact causal prefix without executing candidate deletions or using future outputs or measured harm.Source: §C.3 · p. 16, §C.4 · p. 16, §C.5 · p. 17

C.6 Exact Set Representation

  • The set representation combines deleted and retained summaries, deleted-set pair structure, and deleted-to-retained geometry; these features inform a learned scorer rather than imposing additive or hand-written redundancy rules.For a singleton deleted set, the pair statistic is the zero vector.Source: §C.6 · pp. 17–18

C.7 Scorer and Training Objective; C.8 Model and Training Configuration

  • The scorer uses cardinality-indexed heads for harm ranking and unsafe gating; training covers deletion cardinalities one through four, while online selection permits at most three.The unsafe score is not interpreted as a calibrated probability of downstream task failure; the language models are frozen and only the set-risk scorer is optimized.Source: §C.7 · p. 18, Table 7 · p. 19

D Algebraic Properties and Design Implications; D.1 Telescoping Decomposition of Joint Harm; D.2 Singleton Additivity and Interaction Residuals; D.3 Why Retained Context Changes Deletion Risk; D.5 Oracle Constraint and Learned Online Gate; D.6 Accumulation Without Interaction; E Structural Pruning Baseline

  • Joint harm can differ from summed singleton effects, and a Block’s conditional deletion effect depends on what remains; even additive singleton harms can accumulate past the safety threshold.The online gate is a learned surrogate for the exact harm constraint, while the structural baseline protects recent Steps and state-bearing content and removes only short witnessed transition narration.Source: §D.1 · p. 20, §D.2 · p. 20, §D.3 · p. 20

E Structural Pruning Baseline

  • 14.640% reduction from the canonical Full260 baseline accompanies structural pruning’s reported overall reward of 0.701 and 2.292M mean total tokens per task.The baseline’s domain rewards are 0.703, 0.814, 0.640, and 0.659 for Code, Office, Security, and Web, respectively.Source: E Structural Pruning Baseline · p. 22

F Additional Representation Results

The additional analyses support decision-conditioned and fine-grained deletion, while showing that joint deletion effects grow with set size. They also characterize the risk gate, attention features, and offline prediction metrics.

F Additional Representation Results

  • At the primary harm margin, matched pre-action relations reach 70.920% pair accuracy versus 62.020% for mismatched-state relations; the best combined relation reaches 72.130%.The layerwise analysis examines how the signal changes with representation depth.Source: F Additional Representation Results · p. 22, Figure 3 · p. 23
  • Step-level deletion has a wider within-state harm range than Block-level deletion (0.312 versus 0.028), and 71.400% of unsafe parent Steps contain a safe-to-remove Block.This illustrates why finer-grained actions can preserve useful parts of an unsafe Step.Source: F Additional Representation Results · pp. 22–23, Figure 4 · p. 23
  • Mean absolute non-compositionality rises from 0 for singleton deletion to 0.008, 0.016, and 0.027 for sets of two, three, and four Blocks.At four Blocks, the mean magnitude exceeds the δH = 0.020 threshold for unsafe supervision; larger-set and per-domain panels are exploratory.Source: F Additional Representation Results · p. 23, Figure 5 · p. 24

F.1 Composition, Risk Scores, and Attention

  • Interaction residuals are inspected by component composition, semantic overlap, attention-head overlap, and temporal separation, as diagnostics rather than hand-written deletion rules.Attention density is treated as one relational feature, not a standalone pruning criterion.Source: §F.1 · pp. 23, 25, 26, Figure 6 · p. 24
  • The learned unsafe score separates candidate sets around a frozen deployment threshold, but that distributional separation is not a probability-calibration guarantee.The risk-gate curve tracks empirical unsafe rate and mean direct removal as the threshold changes.Source: §F.1 · p. 25, Figure 7 · p. 25, Figure 8 · p. 25
  • Validation selects β = 0, so the deployed score uses the ensemble mean without an additional standard-deviation penalty.The analysis varies β and tracks selection coverage, direct removal, and empirical unsafe rate.Source: §F.1 · pp. 25–26, Figure 9 · p. 26

G.1 Harm Standardization and Ranking

  • Ranking pairs are grouped by source trajectory and deletion cardinality, while within-state Spearman correlation compares set orders at a common state and cardinality.Brier score evaluates unsafe-score error and AUROC ranks unsafe events above safe events; neither is task reward.Source: §G.1 · p. 27, §G.2 · p. 27

G.3 Direct and Complete-Task Token Accounting

This section distinguishes direct token removal from complete-task token changes and specifies how token totals are accounted for. It also cautions against treating the totals as monetary cost or as a causal decomposition of rollout effects.

G.3 Direct and Complete-Task Token Accounting

  • Cache-read and cache-creation counts reported as input components are already included in input totals and should not be added again.A negative token change denotes a decrease; token totals alone do not determine monetary cost.Source: §G.3 · p. 27
  • The complete-task token difference is decomposed into direct deletion and a rollout residual, but that residual is an accounting term rather than causal identification.The distinction matters because changes in action paths, retries, termination, and request counts can separate direct removal from full-rollout differences.Source: §G.3 · p. 27

H Comparator Token Accounting

  • Eval40 comparator totals include reported input and output tokens from auxiliary summarization models, and the per-task column uses the same accounting rule as the main comparison.The table reports totals for 40 tasks.Source: H Comparator Token Accounting · p. 28, Table 9 · p. 28

I Detailed Task and Token Summaries

  • Token magnitudes are presented in millions or thousands for readability, without changing the underlying values.The accounting separates local representation computation from API token totals; the former is not automatically captured by those totals.Source: §G.3 · p. 27, I Detailed Task and Token Summaries · p. 28

I.1 Domain-Level Ablations

The appendices detail domain-level ablations and token accounting, then specify DRSR’s information boundary, online selection, exact supervision, and frozen validation policy. They also identify the fixed Eval40 task manifest.

I.1 Domain-Level Ablations

  • Removing retained-context features lowers overall reward, removing pair pooling produces the largest direct deletion in Security, and removing abstention is particularly harmful in Security.The ablation effects vary by domain and affect different parts of the pruning decision.Source: §I.1 · p. 28

I.2 Token Components

  • Eval40 token differences are driven mainly by input-side processing rather than output length; cache quantities are components of input, not additional totals.The table captions specify equal-domain token decomposition and its units.Source: §I.2 · p. 29, Table 11 · p. 29

I.3 Full260 Token Accounting

  • On Full260, Security has the largest baseline context and largest absolute reward improvement, while Office changes modestly; processed tokens fall in all four domains.Direct same-request removal is not identical to the complete-rollout token difference.Source: §I.3 · pp. 29–30, Table 13 · p. 30

J.1 Training and Deployment Information Boundary

  • The realized next output and exact deletion harm construct offline supervision, while deployment uses only the current causal prefix, candidate features, and proposed deletion mask.The information-boundary table distinguishes quantities available only for labels from online features.Source: §J.1 · p. 31, Table 14 · p. 31

J.2 Exact Online Risk Aggregation and Feasible Set

  • With β = 0, the online policy chooses the largest-saving feasible set under candidate-count, token-budget, recency, learned-risk, and protocol constraints.Ties favor lower unsafe score and then lower predicted harm; all candidate subsets are batch-scored without online counterfactual deletion forwards.Source: §J.2 · p. 31

J.3 Online Computational Cost

  • The controller makes two local representation passes over the intact prefix, batch-scores candidate sets, and applies only the selected deletion set to the acting-model request.The online controller executes zero candidate-specific counterfactual deletion forwards.Source: §J.3 · p. 32

J.4 Protocol-Preserving Deletion; J.5 Exact Set-Level Supervision

  • Protocol checks protect the two latest complete Steps and keep matched tool calls and results atomic; offline labels jointly delete candidate Blocks and rescore the same recorded output.The supervision corpus contains 566 external trajectories, 1,698 target states, and approximately 24,122 set-level labels, split by source trajectory.Source: §J.4 · p. 32, §J.5 · p. 32

J.6 Validation Selection and Frozen Deployment Policy; K Eval40 Task Manifest

  • Validation admits policies only with empirical unsafe rate at most 0.10 and mean selected-set exact harm at most 0.02; Eval40 uses ten tasks from each of four domains.Validation maximizes the mean fraction of the full request removed among admissible policies; test labels and WorkBuddyBench outcomes are excluded from selection.Source: §J.6 · p. 33, K Eval40 Task Manifest · p. 34

Related papers

Loading 2609.27276v1…