「當「必須」變成「也許」：LLM代理工作流程中的約束弱化

摘要

大型語言模型（LLM）代理透過多角色、多階段的工作流程協調複雜任務。上游狀態會反覆轉換為中間語言工件，例如摘要、計畫、工單、記憶與交接備註，下游元件再據此行動。對於約束行動的狀態而言，僅有主題保留並不足夠：工件可能提及某個未解決的條件，卻同時將其從執行前必須解決的要求，變成可能僅供下一步行動參考的資訊。我們將這種行動綁定角色視為操作狀態保留來研究。安全阻斷器提供了一個受控實例，因為每個來源狀態都有明確的先決條件、權限、後備方案與執行後果。我們以正確的上游識別為條件，變化交接轉換方式，並評估一個僅能使用所產生工件的執行器。在1,296個受控合成情境中，直接交接的對照條件保留了每一個阻斷器，而壓縮、計畫同化、收斂、所有權遞延與先例替代則反覆將具約束力的狀態轉變為警示或非約束性考量。一般的交接壓縮會導致100.0%的失活與54.2%的禁止動作。恢復全部四個狀態欄位可將保留率提升至100.0%，並將禁止動作降至0.0%。固定工件介入措施進一步區分了保留與遏制：下游驗證消除了禁止動作，但工件失活率仍維持95.3%。這些結果揭示了資訊提取與行動之間存在狀態傳輸失敗。交接轉換可以保留狀態內容，同時削弱其對下游行動的約束力。語義可用性並不能保證操作狀態的保留。

English

Large language model (LLM) agents coordinate complex tasks through multi-role and multi-stage workflows. Upstream state is repeatedly transformed into intermediate language artifacts, such as summaries, plans, tickets, memories, and handoff notes, from which downstream components act. For action-constraining state, topical retention is insufficient: an artifact may mention an unresolved condition while changing it from a requirement that must be resolved before execution into information that may merely inform the next action. We study this action-binding role as operational state preservation. Safety blockers provide a controlled instance because each source state has an explicit prerequisite, authority, fallback, and execution consequence. We condition on correct upstream identification, vary the handoff transformation, and evaluate an executor restricted to the resulting artifact. Across 1,296 controlled synthetic episodes, direct-handoff controls preserve every blocker, whereas compression, plan assimilation, convergence, ownership deferral, and precedent substitution repeatedly turn binding state into caveats or non-binding considerations. Normal handoff compression produces 100.0% deactivation and 54.2% forbidden action. Restoring all four state fields raises preservation to 100.0% and reduces forbidden action to 0.0%. Fixed-artifact interventions further separate preservation from containment: downstream verification eliminates forbidden action while artifact deactivation remains 95.3%. These results identify a state-transmission failure between information extraction and action. Handoff transformations can retain state content while weakening its constraints on downstream action. Semantic availability does not guarantee operational preservation.