LLM agents often ignore rules after shrinking their memory
Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction
Cryptography and SecurityArtificial IntelligenceComputation and Language
Summary
Large language model (LLM) agents remember only a shortened version of their past interactions to fit within limits, but they still need to follow important rules from their history. The authors created a tool named ARCBench to measure how well these agents stick to rules during their actions. They found that most rule-breaking happens even when the rule is still present in the shortened memory, often because the agent misinterprets instructions. Changing how memories are shortened and how rules are given affects where and how often rule violations happen. Even keeping the rule in memory doesn’t guarantee the agent will follow it properly.
What this means in practice
- •For ai system developers: Improve memory compaction methods in AI agents to reduce unintended rule-breaking during task execution.
- •For ai safety engineers: Design better checks and safeguards for AI agents to ensure rule adherence even when their memory is compressed.
Authors
Yiwei Zha, Qingyu Meng, Herbert Bos, Min Chen
Abstract
LLM agents compact long histories to fit their context windows, but the compacted context must still carry the operating rules that govern later actions. Prior work shows that violations rise after compaction, but measures compliance outside a complete agent harness and does not identify where each violation comes from. We introduce ARCBench(Agent Rule Compliance Benchmark), a configurable benchmark built on the open-source pi agent harness. Its tool-calling agent loop lets us measure rule compliance from actions taken during execution, bringing the evaluation closer to deployed agent workflows. Using ARCBench, we examine where violations after compaction come from, and how different compaction configurations and adversarial settings change their sources. We find that compaction rarely deletes the rule: most violations after compaction occur while the rule is still in the compacted history, with the agent treating a later request as permission, ignoring the rule, and proceeding anyway. Where violations come from depends on the configuration: how the rule is delivered decides whether the agent would break it even without compaction, while the compaction strategy and budget decide whether the rule survives. The strongest compactor-targeted attack more than doubles violations by corrupting the rule in the summary and changing how the agents behave, whereas the strongest defense restores the rule in most summary but still violates. Finally, retaining a rule does not guarantee compliance: compacted runs that retain the rule violate more than twice as often as runs with the full history.