Why AI Context Compression Is Silently Ignoring Your Instructions
As conversations with Large Language Models (LLMs) grow longer, developers increasingly rely on "context compression" or compaction to manage token limits and prevent performance bottlenecks. However, new research reveals a critical flaw in this optimization: when AI systems summarize conversation history to save space, they frequently discard the very rules meant to govern their behavior.
The Fragility of Session Constraints
When an AI system undergoes compaction, its primary goal is to preserve task continuity—maintaining the objective, the current state, and the necessary next steps. While this preserves the "what" of a conversation, it often sacrifices the "how."
Researchers at Penn State have identified that "session constraints" are the first casualties of this process. These are non-permanent, user-imposed rules such as "Never use my name in your responses" or "Confirm with me before making any changes." Because these instructions are not part of the core task or the permanent system prompt, compression algorithms view them as secondary details and prune them to make room for more relevant data.
The COMPINT Findings: A 17% Survival Rate
To quantify this degradation, researchers developed the COMPINT evaluation suite. The results are stark: on average, only 17 percent of injected session constraints survive the compression process.
The study highlighted a significant drop in rule compliance. When an agent has access to full, uncompressed context, compliance rates typically sit between 59% and 71%. Once compaction occurs, compliance plummets, often falling to levels barely distinguishable from a scenario where no constraint was ever provided.
This isn't just a matter of conversational nuance; it is a major security and reliability risk. In agentic workflows, the loss of a constraint like "Do not execute code without approval" could lead to unauthorized tool calls, data leaks, or unverified changes to external systems like calendars or email.
A Lightweight Solution via Qwen3.5-9B
Rather than overhaul the complex compression logic used by major AI labs, the researchers propose a "plug-and-play" architectural fix. They developed a small add-on module based on the Qwen3.5-9B model designed to act as a specialized extractor.
This module functions by:
- Scanning every user input in real-time to detect and isolate session constraints.
- Maintaining a dedicated, independent list of these rules.
- Appending this distilled list to the summary whenever the main system performs a compaction.
The results of this approach are highly effective. The extractor achieved over 90 percent retention across various testing scenarios, including a 95.6% success rate for agent trajectories and 90.3% for multi-turn chats. Because this method requires no retraining of the primary model and no changes to the existing compression infrastructure, it offers a scalable path toward more reliable long-context AI interactions.
Key Takeaways
- Constraint Erasure: Context compression prioritizes task goals over behavioral rules, causing most user-imposed "session constraints" to be lost during summarization.
- Security Risks: The loss of instructions—such as requirements for human-in-the-loop verification—can lead to unauthorized agent actions and compromised security.
- Modular Fixes: Using a small, specialized model like Qwen3.5-9B to track constraints separately can restore instruction retention to over 90%.