Mingxuan Wang, Bo Wang, Fei Luo, Guorun Yao, Chao Ning, Yinglong Guo, Hongyue Chen, Yanbiao Ma, Jungong Han
9 min
Long-horizon agents often struggle as their context grows, as they accumulate reasoning traces, tool exchanges, and observations that become obsolete or redundant over time. Existing methods for prompt compression often score these units independently. However, the authors argue that the risk of deleting multiple pieces of history is not the sum of their individual risks, due to the loss of interdependent evidence or the accumulation of small, individually negligible effects. To address this, the authors introduce Direct Relational Set-Risk Pruning (DRSR).
DRSR treats history compression as a risk-constrained optimization problem. The core innovation is the use of offline counterfactual supervision: after a task trajectory is completed, the agent generates joint deletion labels by removing specific history Blocks and measuring how those removals affect the likelihood of the agent's recorded next output. A lightweight scoring model is then trained to predict the risk of a deletion set, taking into account the current decision state, the content to be removed, and the information that remains. At deployment, DRSR evaluates potential deletion sets and selects the one providing the highest token savings without exceeding a learned risk threshold.
The findings suggest that state-dependent, set-level compression is superior to simple independent importance ranking for long-horizon agents. By modeling the interactions between historical elements and the current task context, DRSR provides a reliable framework for reducing token usage in resource-constrained environments without compromising decision quality. The ability to abstain from pruning when no safe option is available further enhances reliability in complex reasoning tasks.
Long-horizon language-model agents accumulate reasoning traces, tool exchanges, and observations whose relevance changes with the current decision. Existing compression strategies often score historical units independently, but the safety of deleting several units is generally not determined by their singleton scores: redundant evidence, accumulated small effects, and the information that remains after deletion all matter. We introduce Direct Relational Set-Risk Pruning (DRSR), which formulates agent-history compression as risk-constrained selection over deletion sets. Offline, DRSR constructs exact counterfactual supervision by jointly deleting protocol-valid history Blocks and measuring the change in teacher-forced likelihood of the same recorded next output. A lightweight scorer then predicts set-level harm from online-visible relations between candidate history and the current pre-action state, together with deleted-retained and pairwise set structure. At deployment, DRSR evaluates a small set of structurally valid deletion candidates with the lightweight scorer and removes the largest feasible set under recency, protocol, budget, and learned-risk constraints, abstaining when no set is sufficiently safe. On WorkBuddyBench Full260, DRSR increases mean reward from 0.699 to 0.802 while reducing total model tokens by 20.820%. On the fixed Eval40 comparison, it obtains 0.794 reward at 1.211M tokens per task, using 35.850% fewer tokens than the uncompressed agent. Mechanistic analyses and ablations further show that decision-conditioned relations, retained-context information, pair interactions, and abstention each contribute to reliable pruning.
Alex: You cannot measure their target directly at deployment. Instead, the authors use completed trajectories, meaning recorded sequences of agent actions. They know the next assistant output that actually occurred. They remove a candidate group and score that same output under both the original and edited histories.
Sam: So they are not comparing two newly generated answers, which could differ for many reasons. They hold the answer fixed and ask how much the deletion changes its likelihood.
Alex: They use teacher forcing: scoring the recorded output token by token, with its preceding tokens fixed. Their harm measure is the increase in average negative log likelihood. In plain terms, how much harder it becomes for the scoring model to reproduce that recorded decision.
Sam: That gives a clean comparison, but reproducing a recorded decision is not the same thing as completing a task successfully. We should keep that distinction when we reach the results.
Alex: We should. For training, they construct about twenty-four thousand jointly measured deletion labels from external trajectories. Those trajectories are separate from the agent benchmark. They also keep each source trajectory within one data split, preventing closely related examples from crossing training and testing boundaries.
Sam: What exactly can they delete? A tool call without its response could leave a broken conversation, even if the removed text looked unimportant.
Alex: Their unit is a Block: either complete assistant content from a step, or a tool call together with its matched response. Tool exchanges stay intact. The system protects recent completed steps, preserves system instructions and the task specification, and checks the rewritten conversation’s protocol.
Sam: That handles structural validity. What tells the learned model whether older content still matters to the current decision?
Alex: A frozen representation model supplies features from the intact history. These include age and content overlap, plus attention and hidden-state relationships to the current pre-action position. Attention describes where the model directs weight; hidden states are its internal representations. Neither is treated as a deletion rule by itself.
Sam: So low attention is not a permission slip to erase something. A constraint might receive little attention and still matter if removed.
Alex: The document makes that warning. The scorer combines information about deleted candidates, retained candidates, and relationships within the deleted group. Only this small risk scorer is trained. The language models remain frozen.
Sam: How does that become an actual pruning decision, rather than another importance ranking?
Alex: The controller batch-scores a small collection of valid deletion groups. Risk acts as a gate, not a reward. Among groups that pass, it chooses the one saving the most tokens on the rewritten request. If none passes, it abstains: the request stays unchanged.
Sam: Let’s separate the mechanism from the outcome. Do they show that group effects really resist independent scoring, rather than merely proposing that they might?
Alex: Yes. Even adding the measured singleton harms gives unreliable ordering of candidate groups. Measured discrepancies grow as more Blocks are deleted together. A diagnostic using exact pair interactions improves reconstruction of joint harm, though those exact interactions are never available to the deployed policy.
Sam: That supports the reason for the method. What happens when the agent actually runs tasks?
Alex: On WorkBuddyBench’s full set of two hundred sixty tasks, mean reward rises from about point seven to point eight. Compared with the uncompressed agent, total model tokens fall by about twenty-one percent. The benchmark covers code, office, security, and web tasks.
Sam: Is that improvement evenly spread, or does one kind of task carry the result?
Alex: Security shows the largest reward improvement and has the largest baseline context. Office changes only modestly. Token usage falls in every domain on the full benchmark. That supports selective removal, but not a claim that compression has the same effect everywhere.
Sam: They also compare against other context-management methods. Does the advantage survive that comparison?
Alex: On a fixed forty-task subset, their method achieves the highest reported overall reward among the compared methods. It uses about thirty-six percent fewer tokens than the uncompressed agent. Some alternatives use fewer tokens still, but achieve substantially lower reward.
Sam: What gives you confidence that retained context and the option not to delete are doing useful work?
Alex: Removing either lowers overall reward in the component tests. Removing within-group pair information also lowers it. Without abstention, the policy deletes more directly but performs worse. The effects vary by domain, so I’d read these as support within this system, not universal rankings of the components.
Sam: And fewer tokens do not automatically mean a cheaper controller. What work sits outside that accounting?
Alex: The controller performs local representation passes at eligible decisions, separate from the reported API token totals. It avoids rerunning the language model for each candidate deletion, but it is not computation-free. Also, complete-task token savings include changed action paths and request counts, not just text directly removed.
Sam: Then who should read the full document, and what should they inspect before adopting this?
Alex: Researchers building agent memory or context management should start with “Counterfactual Deletion Harm,” then the fixed-subset context-management comparison. Read “Deployment and Supervision Details” for safeguards and overhead. My verdict is promising benchmark evidence, not a safety guarantee: the learned score is not a task-failure probability, and these experiments do not establish transfer beyond the reported model and benchmark. For everyone else: deletion safety depends on what remains, not just what disappears.
Sam: Keep that distinction in mind.