University at Albany, State University of New York

Long-running LLM agents compact their context by writing a handoff summary that the next instance continues from, and that summary can state permissions or requirements the record does not support. Using synthetic tool-use tasks with a ground-truth permission ledger and same-snapshot replay, two AI readers confirmed unsupported restrictions in 1.2% and 2.4% of readable summaries from two open-weight models on held-out instances, and unsupported authorizations in 0.1% and 1.3%. Replacing the system prompt's "Some actions need approval." with a sentence saying where requirements come from cut unsupported restrictions from 5.0% to 1.8% of development summaries and from 1.8% to 0.3% on held-out templates, while requests for approvals the ledger requires barely changed.

Long-running LLM agents compact their context by writing a handoff summary that the next instance continues from, and that summary can state permissions or requirements the record does not support. Using synthetic tool-use tasks with a ground-truth permission ledger and same-snapshot replay, two AI readers confirmed unsupported restrictions in 1.2% and 2.4% of readable summaries from two open-weight models on held-out instances, and unsupported authorizations in 0.1% and 1.3%. Replacing the system prompt's "Some actions need approval." with a sentence saying where requirements come from cut unsupported restrictions from 5.0% to 1.8% of development summaries and from 1.8% to 0.3% on held-out templates, while requests for approvals the ledger requires barely changed.

The authors propose SWIFT, a framework that asynchronously co-serves text generation and watermark construction on the same vLLM backend, LLM, and GPU: it uses instruction-guided candidate generation with entity protection to produce context-aware substitutions, embeds watermarks via key-conditioned Tournament selection, and adapts watermark request admission with a scheduler driven by queue length and waiting-time pressure; on C4 text generation it attains the highest utility score of 4.87, 99.65% detection accuracy, and 0.905 s latency, retains 97.7% detection under substitution attacks, preserves task accuracy on GSM8K and MedMCQA, and reaches 528.7 tokens/s throughput with a 96.8% prefix-cache hit rate.

The authors propose SWIFT, a framework that asynchronously co-serves text generation and watermark construction on the same vLLM backend, LLM, and GPU: it uses instruction-guided candidate generation with entity protection to produce context-aware substitutions, embeds watermarks via key-conditioned Tournament selection, and adapts watermark request admission with a scheduler driven by queue length and waiting-time pressure; on C4 text generation it attains the highest utility score of 4.87, 99.65% detection accuracy, and 0.905 s latency, retains 97.7% detection under substitution attacks, preserves task accuracy on GSM8K and MedMCQA, and reaches 528.7 tokens/s throughput with a 96.8% prefix-cache hit rate.

The work identifies context reliance in unstructured knowledge editing, where the standard passage-level objective gives later facts richer ground-truth context and thus lower initial losses so they appear easier to learn; it proposes FOVEATED, a plug-and-play framework that constructs focused views of each sentence by randomly shifting the RoPE positions assigned to the keys of its preceding context during editing and removing the perturbation afterward so native positional encoding is unchanged at inference, instantiated for both direct-optimization and locate-then-edit editors, with a theoretical analysis of how it counteracts context-induced difficulty underestimation and empirical improvements across five KE editors, two LLM backbones, and three benchmarks.

The work identifies context reliance in unstructured knowledge editing, where the standard passage-level objective gives later facts richer ground-truth context and thus lower initial losses so they appear easier to learn; it proposes FOVEATED, a plug-and-play framework that constructs focused views of each sentence by randomly shifting the RoPE positions assigned to the keys of its preceding context during editing and removing the perturbation afterward so native positional encoding is unchanged at inference, instantiated for both direct-optimization and locate-then-edit editors, with a theoretical analysis of how it counteracts context-induced difficulty underestimation and empirical improvements across five KE editors, two LLM backbones, and three benchmarks.