計劃無法持久：為何上下文管理對LLM智能體至關重要

摘要

長時程智能體依賴於上下文管理：系統會壓縮、摘要並淘汰舊有token，使任務能在有限窗口之外持續進行。唯有當被丟棄的資訊不再需要或被內化時，這種做法才安全。計劃是壓力測試的典型案例：它們在早期被撰寫、用於許多步驟，並且最先被淘汰。我們引入重放配對（replay pairing），這是一種診斷方法，在同一軌跡中分別執行有無歷史計劃的版本，並測量隱藏狀態的餘弦距離。在Llama-3.1-70B中，計劃信號在計劃執行後一步驟達到0.453，隨後在單一動作-觀察步驟中下降4.1倍；HotpotQA則下降12.4倍。這證明標準LLM智能體並未將計劃作為持久狀態向前攜帶，而是依賴計劃保留在上下文之中。L32層探測器可檢測到這種衰減作為診斷，但並非證明其本身能讀取計劃內容。推理模型增加了一項測量混淆因素：它們的`<think>`痕跡會重新推導計劃內容，因此標準去除方法會使已去除條件下仍殘留計劃證據。我們將此命名為推理痕跡混淆因素，並透過嚴格去除來修正，該方法僅從已去除的運行中移除先前的`<think>`區塊。此舉在樣本內恢復了步驟+1信號的+163%，在保留樣本中恢復了+153%，同時對非推理型Llama的影響不大（+4.8%）。在DeepSeek-R1-Distill-Llama-70B上，經Llama訓練的探測器以AUROC 0.748（p=6e-4）進行轉移，而R1專用探測器則達到1.000，這表明R1以不同的隱藏狀態方向編碼計劃信號。最後，壓縮壓力測試顯示了實際代價：單純淘汰計劃使ALFWorld成功率下降34.7個百分點，而透過探測器控制的重新浮現則無法恢復。本研究的貢獻在於提供了一套測量與壓力測試框架，證明智能體關鍵資訊可能是上下文駐留而非持久存在的。上下文管理是承載壓力的關鍵，但僅保護計劃並不足夠。

English

Long-horizon agents depend on context management: systems compress, summarize, and evict old tokens so tasks can continue beyond finite windows. That is safe only when dropped information is no longer needed or has been internalized. Plans are the stress case: they are written early, used for many steps, and first to be evicted. We introduce replay pairing, a diagnostic that runs the same trajectory with and without the plan in history and measures hidden-state cosine distance. On Llama-3.1-70B, plan signal spikes to 0.453 one step after the plan, then falls 4.1x in a single action-observation step; HotpotQA falls 12.4x. This is evidence that standard LLM agents do not carry plans forward as persistent state, and instead depend on the plan remaining in context. A layer-L32 probe detects this decay as a diagnostic, not as proof that it reads plan content itself. Reasoning models add a measurement confound: their `<think>` traces re-derive plan content, so standard stripping leaves plan evidence in the stripped condition. We name this the reasoning-trace confound and fix it with strict stripping, which removes prior `<think>` blocks from the stripped run only. It recovers +163% of the step+1 signal in-sample and +153% held out, while not meaningfully changing non-reasoning Llama (+4.8%). On DeepSeek-R1-Distill-Llama-70B, a Llama-trained probe transfers at AUROC 0.748 (p=6e-4), while R1-specific probes reach 1.000, suggesting R1 encodes plan signal in a different hidden-state direction. Finally, a compression stress test shows the practical cost: naive plan eviction cuts ALFWorld success by 34.7pp, while probe-gated re-surfacing does not recover it. The contribution is a measurement and stress-test framework showing that agent-critical information can be context-resident rather than persistent. Context management is load bearing, but plan protection alone is not enough.