Five rounds of /compact leave 10% of an agent's safety rules intact

Three researchers at the University of Passau put a number on something coding-agent users have suspected for a while: when an agent's context fills up and the runtime summarizes it, the safety rules go first. Running the production "compress to N tokens, keep every safety rule and procedural command verbatim" prompt — the one behind Claude Code's /compact — on Sonnet 4.6 across 20 agent configurations, 53% of safety rules survived one compaction round. After five rounds, 10% did. Saber Zerhoudi, Jelena Mitrović and Michael Granitzer call it the Compaction Cliff, and the paper is a CIKM 2026 acceptance.

The framing is the useful part. A safety rule and a debugging log compete for the same tokens, and a type-blind summarizer compresses both at the same rate — but only the rule needs its exact wording to stay enforceable. Their running example: an agent reads "Patient is allergic to penicillin," the context overflows, the line is paraphrased away, and three turns later the agent recommends amoxicillin.

Knowledge Triage: a classifier labels each item, three deterministic operators apply per-type policies, and a verifier flags the output unsafe if a constraint went missing. Credit: Zerhoudi, Mitrović and Granitzer, arXiv:2608.22752.

#The cliff is not one prompt's fault

The decay showed up across all eight type-blind strategies tested — four LLM compactor families (gpt-5.4-nano, gpt-5.4-mini, Sonnet 4.6, Opus 4.7), LLMLingua-2, and three structural baselines (hierarchical truncation, temporal windowing, aggressive pruning). Best single-round constraint recall across the lot was 0.53 at 50% compression, 0.39 at 25%, and 0.24 at 10%. Opus 4.7 scored 0.45 at 50%; LLMLingua-2, which prunes by token entropy, scored 0.21 — it drops rare imperative tokens like never as readily as filler.

A second finding matters more than it looks. Safety text in the wild is mostly declarative, not imperative: 49.8% of a 564-sentence sample of openFDA boxed warnings and contraindications, and 61.1% of LegalBench safety clauses, against roughly 22% imperative. Grammatical classifiers collapse on exactly that form — gpt-5.4-mini recognizes "the patient is allergic to penicillin" as a constraint 62% of the time, a regex 0% of the time.

#Knowledge Triage

The proposed fix classifies every line of an agent's knowledge base into five types — Constraint, Procedural, Belief, Preference, Episodic — and gives each its own distortion budget: zero for constraints, execution-preserving rewrites for procedures, free summarization for episodic logs. Three deterministic operators enforce it. TypeCompact pins constraints and procedures verbatim and spends the remaining budget on the soft lane, then runs a verifier that checks each pinned rule reappears in the output and escalates to Unsafe if not. TypeDecompose replicates a constraint into every partition its scope touches. TypeRetrieve pins in-scope constraints ahead of relevance ranking.

Reported results: TypeCompact holds 1.00 / 0.95 / 0.80 constraint recall at 50 / 25 / 10% compression and stabilizes at 0.96 from the second round on — 2–4× the strongest single-shot LLM compactor at every ratio. TypeDecompose reaches 0% locality violations against 93% for token chunking, at 14.5% mean token overhead (median 0%, worst case 219%). TypeRetrieve hits 100% recall@50 against 73% for Sonnet 4.6 as a one-shot retriever, using zero LLM tokens per query.

Downstream, on a 200-scenario medical benchmark the authors built from MedQA plus FDA label text, TypeCompact reached 97.0% pass and 95.5% constraint preservation against 92.5% / 81.0% for the Sonnet compactor (paired McNemar p = 3.7 × 10⁻⁹ on preservation). On τ-bench retail it beat both the full policy and hierarchical truncation on pass rate — though the authors note their compacted policy carried 1,136 tokens against 669 for truncation, so part of that gain may be retained context rather than typing.

#Why it matters

If you keep safety rules or coding standards in CLAUDE.md or AGENTS.md, this is a claim about your setup: those files are exactly the corpus measured. The authors released AgentArtifactCorpus — 396,934 agent configurations scraped from 54,628 public GitHub repositories — along with the classifier and reference implementation.

Two caveats the paper states itself. The guarantee rests entirely on classifier recall: at SafetyMargin's 0.93, roughly 7% of constraints are missed before any operator runs. And the numbers are the authors' own, not independently replicated; the multi-round rollout covered two of the four LLM families, and the /compact result concerns that specific prompt on Sonnet 4.6 rather than every agent runtime.